smallwebwaf

149 Commits 11 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	64497b32cd	Core Rule Set: Forgejo's ordinary requests pass by default (closes #342 ) check / check (push) Waiting to run Details Forgejo 17.0.1's recorded requests are in testdata/forgejo-requests.txt, checked at the defaults. What Forgejo sends and gitea does not: - its flash cookie is named flash, which joins gitea_flash among the cookies left out; - its wiki search, whose q skips five rules in forgejo.conf, the fifteenth change. Gaps in gitea's fixes the recording showed: q on the name searches skips 932250 (ls -la), and the API's package search is one of them. User and organisation pages, any one-segment path, keep 932250. Model: opus-5-5	2026-11-11 07:55:08 +00:00
clawbot	fb25f5ebd2	Core Rule Set tests: check WordPress's recorded requests as the other apps' (closes #284 ) check / check (push) Successful in 5m4s Details TestOrdinaryWordPressRequestsPass skipped the inspection that reads bodies for a request with no body, including one with a Content-Type. It now calls wantRecordedRequestsPass. Model: opus-5-5	2026-11-10 15:57:53 +01:00
clawbot	f8d769fc17	Core Rule Set tests: check the recorded requests without the race detector (closes #290 ) check / check (push) Failing after 4m37s Details The tests that check the apps' recorded requests move to internal/coreruleset/recorded_test.go, behind the recorded build tag. The test phase runs only those tests in a second go test, without -race. The lint phase reads the same file, with the same tag. The Gitea and WordPress tests are split in two. Their recorded-request loops become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass; their attack checks stay in the race pass as TestGiteaAttacksAreRefused and TestWordPressAttacksAreRefused. Model: opus-5-5	2026-11-10 15:26:11 +01:00

Author

SHA1

Message

Date

sneak

64497b32cd

Core Rule Set: Forgejo's ordinary requests pass by default (closes #342 )

check / check (push) Waiting to run

Details

Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5

2026-11-11 07:55:08 +00:00

clawbot

fb25f5ebd2

Core Rule Set tests: check WordPress's recorded requests as the other apps' (closes #284 )

check / check (push) Successful in 5m4s

Details

TestOrdinaryWordPressRequestsPass skipped the inspection that reads
bodies for a request with no body, including one with a Content-Type.
It now calls wantRecordedRequestsPass.

Model: opus-5-5

2026-11-10 15:57:53 +01:00

clawbot

f8d769fc17

Core Rule Set tests: check the recorded requests without the race detector (closes #290 )

check / check (push) Failing after 4m37s

Details

The tests that check the apps' recorded requests move to
internal/coreruleset/recorded_test.go, behind the recorded build tag. The
test phase runs only those tests in a second go test, without -race. The
lint phase reads the same file, with the same tag.

The Gitea and WordPress tests are split in two. Their recorded-request loops
become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass;
their attack checks stay in the race pass as TestGiteaAttacksAreRefused and
TestWordPressAttacksAreRefused.

Model: opus-5-5

2026-11-10 15:26:11 +01:00