4 Commits

Include renames

Author	SHA1	Message	Date
sneak	828af271a6	SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220) ... Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5	2026-11-10 11:02:15 +00:00
clawbot	3d9e3976b0	Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270) ... Rule 900601 let Referer skip five rules when it named a repository's search, issues or pull requests with the owner api, such as /api/v2/search, Mastodon's search. A page opened from there skipped script and SQL injection checks on Referer. gitea has no owner named api, so a chained condition now leaves out those paths, as rule 900600 does. Model: opus-5-5	2026-11-10 04:26:08 +01:00
clawbot	56d6a12cc2	Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266) ... Rule 900600 took paths of an owner named api for gitea's search, issues, pull requests and commit search inside a repository. /api/v2/search, Mastodon's search, /api/v2/issues and /api/v2/pulls were among them, so attacks in q scored 0 there. gitea has no owner named api, so a chained condition now leaves out each of those paths under /api/<x>/. Go's regular expressions have no lookahead, so the exclusion cannot be written inside the pattern. Model: opus-5-5	2026-11-10 03:26:14 +01:00
clawbot	719691d1e8	Name log fields, metrics and the Core Rule Set package for what they are (closes #192) ... The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234. Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`. Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`. Model: opus-5-5	2026-11-09 08:47:26 +01:00