smallwebwaf

117 Commits 9 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	348b881818	SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 ) check / check (push) Failing after 25m20s Details Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5	2026-11-10 02:49:37 +00:00
clawbot	56d6a12cc2	Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266 ) check / check (push) Successful in 7m49s Details Rule 900600 took paths of an owner named api for gitea's search, issues, pull requests and commit search inside a repository. /api/v2/search, Mastodon's search, /api/v2/issues and /api/v2/pulls were among them, so attacks in q scored 0 there. gitea has no owner named api, so a chained condition now leaves out each of those paths under /api/<x>/. Go's regular expressions have no lookahead, so the exclusion cannot be written inside the pattern. Model: opus-5-5	2026-11-10 03:26:14 +01:00
clawbot	719691d1e8	Name log fields, metrics and the Core Rule Set package for what they are (closes #192 ) check / check (push) Failing after 3m22s Details The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234. Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`. Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`. Model: opus-5-5	2026-11-09 08:47:26 +01:00

Author

SHA1

Message

Date

sneak

348b881818

SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 )

check / check (push) Failing after 25m20s

Details

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

2026-11-10 02:49:37 +00:00

clawbot

56d6a12cc2

Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266 )

check / check (push) Successful in 7m49s

Details

Rule 900600 took paths of an owner named api for gitea's search, issues,
pull requests and commit search inside a repository. /api/v2/search,
Mastodon's search, /api/v2/issues and /api/v2/pulls were among them, so
attacks in q scored 0 there. gitea has no owner named api, so a chained
condition now leaves out each of those paths under /api/<x>/. Go's regular
expressions have no lookahead, so the exclusion cannot be written inside
the pattern.

Model: opus-5-5

2026-11-10 03:26:14 +01:00

clawbot

719691d1e8

Name log fields, metrics and the Core Rule Set package for what they are (closes #192 )

check / check (push) Failing after 3m22s

Details

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

2026-11-09 08:47:26 +01:00