3 Commits

Include renames

Author	SHA1	Message	Date
sneak	b2e84e034f	Core Rule Set tests: load each set of settings once (closes #252) ... Tests now share one Core Rule Set for each set of settings, loaded once through sync.OnceValues in shared(). Exclusions-file tests and TestCorazaWritesNoFile still load their own: loading is what they check. Loading was not most of the time: the WordPress and Drupal recorded requests, inspected one after another, were. Each recorded request now runs as its own parallel subtest, with the same request and outcome. Model: opus-5-5	2026-11-09 22:32:53 +00:00
clawbot	3a37f82e34	Core Rule Set: more of Drupal's ordinary fields pass (closes #244) ... Names, searches and the page to return to on more Drupal paths skip the rules that misfire on them: 930120, 932120, 932250 and 932260, plus 932230 and 932235 on destination only. An email address skips 930120, 932120 and 932260; the oEmbed url only 930120 and 932120. Every Drupal path may carry a language prefix: a first segment of two or three lowercase letters, such as /fr. Requests recorded from Drupal 11.4.11 with plain words, python3, powershell, ls -la and .htaccess are added to the test data; tests show attacks and "; wget ..." still refused on each new field. Model: opus-5-5	2026-11-09 23:09:15 +01:00
clawbot	decd9b4658	Core Rule Set: Drupal's ordinary requests pass by default (closes #236) ... Adds drupal.conf, the tenth change: on Drupal's paths, the fields that carry a search, a name, a file name or an address skip the rules that refused ordinary requests there. The recorded requests from Drupal 11.4 pass at the defaults and while bodies are read; SQL injection, path traversal and script injection stay refused on those fields. Drupal's tests share the reader of recorded requests and the attack constants with the other apps' tests. Model: opus-5-5	2026-11-09 19:57:53 +01:00