6 Commits

Include renames

Author	SHA1	Message	Date
sneak	5600ba1255	Core Rule Set tests: load each set of settings once (closes #252) ... Tests now share one Core Rule Set for each set of settings, loaded once through sync.OnceValues in shared(). Exclusions-file tests and TestCorazaWritesNoFile still load their own: loading is what they check. Loading was not most of the time: the WordPress and Drupal recorded requests, inspected one after another, were. Each recorded request now runs as its own parallel subtest, with the same request and outcome. Model: opus-5-5	2026-11-09 21:58:49 +00:00
sneak	35dfd1f5e0	Core Rule Set: test concurrent requests keep their own exclusions ... A Drupal and a WordPress request are inspected at once, many times over, on one Core Rule Set. Coraza v3.8.1 shares each rule's exclusions between requests, so the test fails under -race. Model: opus-5-5	2026-11-09 20:59:45 +00:00
clawbot	9f98982446	Core Rule Set: WordPress's names and addresses pass on more fields (closes #245) ... Each field skips only the rules its recorded requests set off: - page on all of wp-admin, and the JSON fields title, excerpt and name on /wp/v2/ routes: 930120, 932120, 932250 and 932260; - p, postId and slug on all of wp-admin, and the JSON slug on /wp/v2/ routes: 932120 and 932260, since WordPress writes these as slugs; - url on the block editor's link previews and embeds, and a commenter's url: 930120 and 932120. Every field keeps 932235. Add 61 requests recorded from WordPress 7.1.4 with these fields. Model: opus-5-5	2026-11-09 21:58:18 +01:00
clawbot	decd9b4658	Core Rule Set: Drupal's ordinary requests pass by default (closes #236) ... Adds drupal.conf, the tenth change: on Drupal's paths, the fields that carry a search, a name, a file name or an address skip the rules that refused ordinary requests there. The recorded requests from Drupal 11.4 pass at the defaults and while bodies are read; SQL injection, path traversal and script injection stay refused on those fields. Drupal's tests share the reader of recorded requests and the attack constants with the other apps' tests. Model: opus-5-5	2026-11-09 19:57:53 +01:00
clawbot	fd734fcc22	Core Rule Set: WordPress's ordinary requests pass by default (closes #235) ... Add the ninth change: wordpress.conf switches off, per path and field, each rule that refused ordinary WordPress 7.1.4 requests. Three groups of fields skip four rules on system files and commands, and only the addresses of the first group also skip 932235. Add the recorded requests, a test at the defaults and reading bodies, and list WordPress in the README. Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)	2026-11-09 19:26:17 +01:00
clawbot	719691d1e8	Name log fields, metrics and the Core Rule Set package for what they are (closes #192) ... The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234. Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`. Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`. Model: opus-5-5	2026-11-09 08:47:26 +01:00