The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:
- deploy/gitea/crs-exclusions.conf, loaded through the new setting
SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, covers Gitea's search, file-name
and branch-name fields, Referer, and file paths;
- smallwebwaf's defaults gain a seventh change: the registry upload
path's from parameter skips 932260.
A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start. internal/waf's tests and
script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.
Model: opus-5-5
The package passes nothing on since the one-process mode went: it answers rproxy's questions, takes its reports and answers servewaf's own endpoints. It is now named after the command it serves, with `git mv`, and its constructor is `servewaf.New`. `SPEC.md` and the other documents follow. No change of behaviour.
Model: opus-5-5
clawbot