smallwebwaf

5 Commits

Author	SHA1	Message	Date
sneak	53acf05bcb	Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266 ) check / check (push) Successful in 6m14s Details Rule 900600 took paths of an owner named api for gitea's search, issues, pull requests and commit search inside a repository. /api/v2/search, Mastodon's search, /api/v2/issues and /api/v2/pulls were among them, so attacks in q scored 0 there. gitea has no owner named api, so a chained condition now leaves out each of those paths under /api/<x>/. Go's regular expressions have no lookahead, so the exclusion cannot be written inside the pattern. Model: opus-5-5	2026-11-10 01:59:30 +00:00
sneak	c0313f7b27	Coraza: use the commit that keeps exclusions per request (closes #254 ) check / check (push) Successful in 5m27s Details Coraza v3.8.1 shares a rule's ctl:ruleRemoveTargetById exclusions between concurrent requests, so one request can be checked with another's. Coraza's main fixed it in its pull request 1745; no release carries it yet, so go.mod names commit d028be399c68 by its pseudo-version. Model: opus-5-5	2026-11-09 21:00:08 +00:00
sneak	35dfd1f5e0	Core Rule Set: test concurrent requests keep their own exclusions check / check (push) Failing after 2m41s Details A Drupal and a WordPress request are inspected at once, many times over, on one Core Rule Set. Coraza v3.8.1 shares each rule's exclusions between requests, so the test fails under -race. Model: opus-5-5	2026-11-09 20:59:45 +00:00
sneak	f6435b1a73	Add make publish: build the image on the Docker host and push it to the registry check / check (push) Successful in 3m23s Details `script/publish` runs `script/docker` against the Docker host and pushes the image to the registry under four tags: the UTC date, the short commit hash, the branch name and `latest`. It refuses a working tree with uncommitted changes, since the hash tag names a commit. Also carries sneak's `golines -m 77` line wrapping in three files, with no code change. Unverified: a real build on the Docker host and a real push from this commit. Deviation: sneak's FIXME comments are out, because the linter refuses them; they are #227, #228 and #229. Model: opus-5-5 Co-authored-by: sneak <sneak@sneak.berlin>	2026-11-09 02:03:39 +01:00
sneak	a0d2c21346	Add README, SPEC and tool evaluation, closes #1 Initial documents: what smallwebwaf is and why, the proposed feature list, the design spec with the rule file format and the open design questions, and the survey of existing tools. Model: fable-5-1	2026-09-21 07:42:45 +00:00