sneak/smallwebwaf
1
0 Fork 0
Code Issues 19 Pull Requests 6 Actions 93 Packages Projects Releases Wiki Activity
168 Commits 22 Branches 2 Tags
562430ebbf5329a0acfc6e3f016e0355bf937a60
Commit Graph
3 Commits
Author SHA1 Message Date
clawbot 0cb6dded98 Read every setting through viper and rename the settings (closes #211)
check / check (push) Waiting to run
Details 
Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)
 2026-11-12 05:43:47 +01:00
clawbot 75f30a34b2 Core Rule Set: a repository's name passes in the adopt form's id (closes #365)
check / check (push) Waiting to run
Details 
While bodies are read, the forms that adopt or delete an unadopted
repository were refused when the repository's name held a command, a
system file's name or a shell path, such as alice/python3-app,
alice/.profile or robin/assets. id there now skips 930120, 932120, 932160
and 932260. The paths are gitea's /-/admin/repos/unadopted, Forgejo's
/admin/repos/unadopted, and /user/settings/repos/unadopted, which both
serve.

Model: opus-5-5
 2026-11-12 03:43:51 +01:00
clawbot 4ebe8be8c1 Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)
check / check (push) Waiting to run
Details 
Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. The issue and pull request searches of a
team and of a milestone join 900600 and 900601, as a repository's do. A
repository's packages page and the admin packages page join 900602, which
also skips 944130. 900605, which lets /bin/sh through in q on branches and
owner packages, now also covers the tags page and those two pages, since tag
and package names can hold a slash.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
 2026-11-12 03:00:15 +01:00