smallwebwaf

125 Commits 9 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	828af271a6	SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 ) check / check (push) Failing after 14m14s Details Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5	2026-11-10 11:02:15 +00:00
clawbot	9f98982446	Core Rule Set: WordPress's names and addresses pass on more fields (closes #245 ) check / check (push) Successful in 4m55s Details Each field skips only the rules its recorded requests set off: - page on all of wp-admin, and the JSON fields title, excerpt and name on /wp/v2/ routes: 930120, 932120, 932250 and 932260; - p, postId and slug on all of wp-admin, and the JSON slug on /wp/v2/ routes: 932120 and 932260, since WordPress writes these as slugs; - url on the block editor's link previews and embeds, and a commenter's url: 930120 and 932120. Every field keeps 932235. Add 61 requests recorded from WordPress 7.1.4 with these fields. Model: opus-5-5	2026-11-09 21:58:18 +01:00
clawbot	fd734fcc22	Core Rule Set: WordPress's ordinary requests pass by default (closes #235 ) check / check (push) Successful in 4m43s Details Add the ninth change: wordpress.conf switches off, per path and field, each rule that refused ordinary WordPress 7.1.4 requests. Three groups of fields skip four rules on system files and commands, and only the addresses of the first group also skip 932235. Add the recorded requests, a test at the defaults and reading bodies, and list WordPress in the README. Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)	2026-11-09 19:26:17 +01:00

Author

SHA1

Message

Date

sneak

828af271a6

SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220 )

check / check (push) Failing after 14m14s

Details

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

2026-11-10 11:02:15 +00:00

clawbot

9f98982446

Core Rule Set: WordPress's names and addresses pass on more fields (closes #245 )

check / check (push) Successful in 4m55s

Details

Each field skips only the rules its recorded requests set off:

- page on all of wp-admin, and the JSON fields title, excerpt and name
  on /wp/v2/ routes: 930120, 932120, 932250 and 932260;
- p, postId and slug on all of wp-admin, and the JSON slug on /wp/v2/
  routes: 932120 and 932260, since WordPress writes these as slugs;
- url on the block editor's link previews and embeds, and a commenter's
  url: 930120 and 932120.

Every field keeps 932235. Add 61 requests recorded from WordPress 7.1.4
with these fields.

Model: opus-5-5

2026-11-09 21:58:18 +01:00

clawbot

fd734fcc22

Core Rule Set: WordPress's ordinary requests pass by default (closes #235 )

check / check (push) Successful in 4m43s

Details

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused ordinary WordPress 7.1.4 requests. Three groups of fields
skip four rules on system files and commands, and only the addresses of the
first group also skip 932235. Add the recorded requests, a test at the
defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)

2026-11-09 19:26:17 +01:00