smallwebwaf

158 Commits 15 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	ca07411721	Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346 ) check / check (push) Waiting to run Details While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules that refused them, on their own paths: - the web editor's tree_path, commit_summary and content; - every field that names a branch, for Windows commands and command names: new_branch_name, old_branch_name, old_ref_name, from, to, head, base, branch and new_branch; - message of a file changed through the API, for system files and Windows commands. None applies when the query has a parameter of the same name. The requests were recorded from gitea 1.27.3 and Forgejo 17.0.1. Model: opus-5-5	2026-11-11 14:56:36 +00:00
clawbot	f9bec5146b	Core Rule Set: Forgejo's searches at a branch or tag, of releases and of job logs pass (closes #350 ) check / check (push) Waiting to run Details `testdata/forgejo-requests.txt` records these Forgejo 17.0.1 searches with the hard values, file names and plain words, and the code search with code and a page opened from each search. `forgejo.conf` lets them through: - the code search at a branch or tag, where the home page's search box sends its search without a code indexer: `q` skips what it skips on gitea's code search, and `Referer` what it skips after gitea's searches; - the release search, page and API: `q` skips 930120, 932120, 932160, 932250 and 932260, since it matches tag names; - the job log search in the API: the same, without 932160. In `gitea.conf`, `q` on a repository's branches page and an owner's packages page also skips 932160, so `/bin/sh` passes there. `SPEC.md` lists both. Model: opus-5-5	2026-11-11 15:44:31 +01:00
clawbot	b6aa2cbc4b	Core Rule Set: Forgejo's ordinary requests pass by default (closes #342 ) check / check (push) Waiting to run Details Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes. - Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded. Model: opus-5-5	2026-11-11 12:12:50 +01:00

Author

SHA1

Message

Date

clawbot

ca07411721

Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346 )

check / check (push) Waiting to run

Details

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- the web editor's tree_path, commit_summary and content;
- every field that names a branch, for Windows commands and command
  names: new_branch_name, old_branch_name, old_ref_name, from, to, head,
  base, branch and new_branch;
- message of a file changed through the API, for system files and
  Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

2026-11-11 14:56:36 +00:00

clawbot

f9bec5146b

Core Rule Set: Forgejo's searches at a branch or tag, of releases and of job logs pass (closes #350 )

check / check (push) Waiting to run

Details

`testdata/forgejo-requests.txt` records these Forgejo 17.0.1 searches with the hard values, file names and plain words, and the code search with code and a page opened from each search. `forgejo.conf` lets them through:

- the code search at a branch or tag, where the home page's search box sends its search without a code indexer: `q` skips what it skips on gitea's code search, and `Referer` what it skips after gitea's searches;
- the release search, page and API: `q` skips 930120, 932120, 932160, 932250 and 932260, since it matches tag names;
- the job log search in the API: the same, without 932160.

In `gitea.conf`, `q` on a repository's branches page and an owner's packages page also skips 932160, so `/bin/sh` passes there. `SPEC.md` lists both.

Model: opus-5-5

2026-11-11 15:44:31 +01:00

clawbot

b6aa2cbc4b

Core Rule Set: Forgejo's ordinary requests pass by default (closes #342 )

check / check (push) Waiting to run

Details

Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes.

- Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded.

Model: opus-5-5

2026-11-11 12:12:50 +01:00