3 Commits

Include renames

Author	SHA1	Message	Date
sneak	7f1b0a14b4	Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270) ... Rule 900601 let Referer skip five rules when it named a repository's search, issues or pull requests with the owner api, such as /api/v2/search, Mastodon's search. A page opened from there skipped script and SQL injection checks on Referer. gitea has no owner named api, so a chained condition now leaves out those paths, as rule 900600 does. Model: opus-5-5	2026-11-10 03:00:27 +00:00
clawbot	56d6a12cc2	Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266) ... Rule 900600 took paths of an owner named api for gitea's search, issues, pull requests and commit search inside a repository. /api/v2/search, Mastodon's search, /api/v2/issues and /api/v2/pulls were among them, so attacks in q scored 0 there. gitea has no owner named api, so a chained condition now leaves out each of those paths under /api/<x>/. Go's regular expressions have no lookahead, so the exclusion cannot be written inside the pattern. Model: opus-5-5	2026-11-10 03:26:14 +01:00
clawbot	719691d1e8	Name log fields, metrics and the Core Rule Set package for what they are (closes #192) ... The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234. Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`. Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`. Model: opus-5-5	2026-11-09 08:47:26 +01:00