smallwebwaf

129 Commits 15 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	21c424b71f	Core Rule Set: random passwords pass on the remaining password fields (closes #288 ) check / check (push) Failing after 1m59s Details Each app's sign-in, sign-up, password change and reset fields that had no exclusion now skip the 35 rules random passwords set off, on that app's paths and only when the query has no field of that name. Added gitea, Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST password, Drupal's forms and JSON, MediaWiki retype and password on the pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset, change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's clients send a hash, which needs no exclusion. Model: opus-5-5	2026-11-10 16:43:16 +00:00
clawbot	f8d769fc17	Core Rule Set tests: check the recorded requests without the race detector (closes #290 ) check / check (push) Failing after 4m37s Details The tests that check the apps' recorded requests move to internal/coreruleset/recorded_test.go, behind the recorded build tag. The test phase runs only those tests in a second go test, without -race. The lint phase reads the same file, with the same tag. The Gitea and WordPress tests are split in two. Their recorded-request loops become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass; their attack checks stay in the race pass as TestGiteaAttacksAreRefused and TestWordPressAttacksAreRefused. Model: opus-5-5	2026-11-10 15:26:11 +01:00
clawbot	2d83961900	Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239 ) check / check (push) Failing after 3m1s Details Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to 900153. On Vaultwarden's account, organization and admin paths, names and password hints skip 930120, 932120, 932250 and 932260, and so does a security key's name. Email addresses skip 930120, 932120 and 932260 there, on the two-factor email paths and when signing in with another device. So does the address of the admin page's test email. The data breach report's address does too. The encrypted names of uploaded attachments and file sends skip 920120. Requests recorded from Vaultwarden 1.37.5 through the web vault, the Bitwarden command line client and the admin page pass at the defaults and while bodies are read. Model: opus-5-5	2026-11-10 07:26:13 +01:00

Author

SHA1

Message

Date

sneak

21c424b71f

Core Rule Set: random passwords pass on the remaining password fields (closes #288 )

check / check (push) Failing after 1m59s

Details

Each app's sign-in, sign-up, password change and reset fields that had no
exclusion now skip the 35 rules random passwords set off, on that app's
paths and only when the query has no field of that name. Added gitea,
Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST
password, Drupal's forms and JSON, MediaWiki retype and password on the
pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset,
change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's
clients send a hash, which needs no exclusion.

Model: opus-5-5

2026-11-10 16:43:16 +00:00

clawbot

f8d769fc17

Core Rule Set tests: check the recorded requests without the race detector (closes #290 )

check / check (push) Failing after 4m37s

Details

The tests that check the apps' recorded requests move to
internal/coreruleset/recorded_test.go, behind the recorded build tag. The
test phase runs only those tests in a second go test, without -race. The
lint phase reads the same file, with the same tag.

The Gitea and WordPress tests are split in two. Their recorded-request loops
become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass;
their attack checks stay in the race pass as TestGiteaAttacksAreRefused and
TestWordPressAttacksAreRefused.

Model: opus-5-5

2026-11-10 15:26:11 +01:00

clawbot

2d83961900

Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239 )

check / check (push) Failing after 3m1s

Details

Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to
900153. On Vaultwarden's account, organization and admin paths, names and
password hints skip 930120, 932120, 932250 and 932260, and so does a
security key's name. Email addresses skip 930120, 932120 and 932260
there, on the two-factor email paths and when signing in with another
device. So does the address of the admin page's test email. The data
breach report's address does too. The encrypted names of uploaded
attachments and file sends skip 920120. Requests recorded from
Vaultwarden 1.37.5 through the web vault, the Bitwarden command line
client and the admin page pass at the defaults and while bodies are read.

Model: opus-5-5

2026-11-10 07:26:13 +01:00