4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	7caad07de3	Core Rule Set: the API searches gitea and Forgejo share pass (closes #353) ... Recorded with python3, powershell, ls -la, .htaccess, file names and plain words from gitea 1.27.3 and Forgejo 17.0.1. q on the API's searches of topics, of an organisation's teams and of emails joins 900603, which skips 930120, 932120, 932250 and 932260. The same four rules are skipped by query on the search of unadopted repositories (900607) and by name on the search of a repository's milestones (900608). 900605 also lets /bin/sh through in q on the API's search of packages, since a package name can hold a slash. The searches of repositories, users and issues already passed. Model: opus-5-5	2026-11-12 10:54:35 +00:00
clawbot	4ebe8be8c1	Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352) ... Recorded with python3, powershell, ls -la, .htaccess, file names and plain words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips 930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and Forgejo's /admin/ alike, and in the body of the admin forms that adopt a repository or activate an email. The issue and pull request searches of a team and of a milestone join 900600 and 900601, as a repository's do. A repository's packages page and the admin packages page join 900602, which also skips 944130. 900605, which lets /bin/sh through in q on branches and owner packages, now also covers the tags page and those two pages, since tag and package names can hold a slash. Model: opus-5-5 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>	2026-11-12 03:00:15 +01:00
clawbot	883969a9cd	Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349) ... On a path of one segment made of the characters a user's or an organisation's name may hold, q now skips 932250 too, unless the path ends in a server-side script's extension, such as .php or .cgi. The searches on a user's and an organisation's page are recorded from gitea 1.27.3 and Forgejo 17.0.1. Model: opus-5-5	2026-11-11 14:13:33 +01:00
clawbot	719691d1e8	Name log fields, metrics and the Core Rule Set package for what they are (closes #192) ... The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234. Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`. Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`. Model: opus-5-5	2026-11-09 08:47:26 +01:00