smallwebwaf

124 Commits 8 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	88abecf801	Core Rule Set: random passwords pass at sign-in (closes #276 ) check / check (push) Failing after 3m25s Details A password manager's random password set off 35 Core Rule Set rules, about 1 in 40 refused. The password fields the app exclusions name now skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki wpPassword, lgpassword and password, Mastodon's sign-in, sign-up, password change, move and delete passwords, and Nextcloud's sign-in password. The tests draw 2,000 random passwords from a fixed seed, plus one rare password for each rule the 2,000 do not set off. Those that set off a rule in a field no exclusion names are sent to every password field. An SQL injection or a path traversal sent as a password now passes; a script injection is still refused. Model: opus-5-5	2026-11-10 09:27:44 +00:00
clawbot	9f98982446	Core Rule Set: WordPress's names and addresses pass on more fields (closes #245 ) check / check (push) Successful in 4m55s Details Each field skips only the rules its recorded requests set off: - page on all of wp-admin, and the JSON fields title, excerpt and name on /wp/v2/ routes: 930120, 932120, 932250 and 932260; - p, postId and slug on all of wp-admin, and the JSON slug on /wp/v2/ routes: 932120 and 932260, since WordPress writes these as slugs; - url on the block editor's link previews and embeds, and a commenter's url: 930120 and 932120. Every field keeps 932235. Add 61 requests recorded from WordPress 7.1.4 with these fields. Model: opus-5-5	2026-11-09 21:58:18 +01:00
clawbot	fd734fcc22	Core Rule Set: WordPress's ordinary requests pass by default (closes #235 ) check / check (push) Successful in 4m43s Details Add the ninth change: wordpress.conf switches off, per path and field, each rule that refused ordinary WordPress 7.1.4 requests. Three groups of fields skip four rules on system files and commands, and only the addresses of the first group also skip 932235. Add the recorded requests, a test at the defaults and reading bodies, and list WordPress in the README. Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)	2026-11-09 19:26:17 +01:00

Author

SHA1

Message

Date

clawbot

88abecf801

Core Rule Set: random passwords pass at sign-in (closes #276 )

check / check (push) Failing after 3m25s

Details

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. The tests draw 2,000 random passwords from a fixed seed, plus
one rare password for each rule the 2,000 do not set off. Those that set
off a rule in a field no exclusion names are sent to every password
field. An SQL injection or a path traversal sent as a password now
passes; a script injection is still refused.

Model: opus-5-5

2026-11-10 09:27:44 +00:00

clawbot

9f98982446

Core Rule Set: WordPress's names and addresses pass on more fields (closes #245 )

check / check (push) Successful in 4m55s

Details

Each field skips only the rules its recorded requests set off:

- page on all of wp-admin, and the JSON fields title, excerpt and name
  on /wp/v2/ routes: 930120, 932120, 932250 and 932260;
- p, postId and slug on all of wp-admin, and the JSON slug on /wp/v2/
  routes: 932120 and 932260, since WordPress writes these as slugs;
- url on the block editor's link previews and embeds, and a commenter's
  url: 930120 and 932120.

Every field keeps 932235. Add 61 requests recorded from WordPress 7.1.4
with these fields.

Model: opus-5-5

2026-11-09 21:58:18 +01:00

clawbot

fd734fcc22

Core Rule Set: WordPress's ordinary requests pass by default (closes #235 )

check / check (push) Successful in 4m43s

Details

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused ordinary WordPress 7.1.4 requests. Three groups of fields
skip four rules on system files and commands, and only the addresses of the
first group also skip 932235. Add the recorded requests, a test at the
defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5 (rework); sonnet-5-5 (copied the recorded lines)

2026-11-09 19:26:17 +01:00