sneak/smallwebwaf
1
0 Fork 0
Code Issues 14 Pull Requests 3 Actions 56 Packages Projects Releases Wiki Activity
172 Commits 24 Branches 2 Tags
b84a33fb574b817b919c99b7f984e699f6486709
Commit Graph
4 Commits
Author SHA1 Message Date
clawbot b84a33fb57 Core Rule Set: the API searches gitea and Forgejo share pass (closes #353)
check / check (push) Waiting to run
Details 
Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on the API's searches of
topics, of an organisation's teams and of emails joins 900603, which skips
930120, 932120, 932250 and 932260. The same four rules are skipped by
query on the search of unadopted repositories (900607) and by name on the
search of a repository's milestones (900608). 900605 also lets /bin/sh
through in q on the API's search of packages, since a package name can
hold a slash. The searches of repositories, users and issues already
passed.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
 2026-11-12 12:28:33 +01:00
clawbot 4ebe8be8c1 Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)
check / check (push) Waiting to run
Details 
Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. The issue and pull request searches of a
team and of a milestone join 900600 and 900601, as a repository's do. A
repository's packages page and the admin packages page join 900602, which
also skips 944130. 900605, which lets /bin/sh through in q on branches and
owner packages, now also covers the tags page and those two pages, since tag
and package names can hold a slash.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
 2026-11-12 03:00:15 +01:00
clawbot 883969a9cd Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349)
check / check (push) Failing after 2m53s
Details 
On a path of one segment made of the characters a user's or an
organisation's name may hold, q now skips 932250 too, unless the path
ends in a server-side script's extension, such as .php or .cgi. The
searches on a user's and an organisation's page are recorded from gitea
1.27.3 and Forgejo 17.0.1.

Model: opus-5-5
 2026-11-11 14:13:33 +01:00
clawbot 719691d1e8 Name log fields, metrics and the Core Rule Set package for what they are (closes #192)
check / check (push) Failing after 3m22s
Details 
The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5
 2026-11-09 08:47:26 +01:00