sneak/smallwebwaf
1
0 Fork 0
Code Issues 21 Pull Requests 6 Actions 2 Packages Projects Releases Wiki Activity
114 Commits 8 Branches 2 Tags
d70fb34f40ea925573616a1805c58196507fbc8b
Commit Graph
4 Commits
Author SHA1 Message Date
clawbot d70fb34f40 Core Rule Set: Drupal's JSON password reset takes an address (closes #262)
check / check (push) Failing after 5m8s
Details 
POST /user/password?_format=json with a mail of python3@example.com or
powershell@example.com was refused while bodies are read. On that path,
the JSON field mail now skips 932120 and 932260, the two rules the
recorded addresses set off, unless the query has a json.mail parameter.
Recorded from Drupal 11.4.11.

Model: opus-5-5
 2026-11-10 03:09:17 +01:00
clawbot e29dacad63 Core Rule Set: Drupal's JSON password reset passes (closes #259)
check / check (push) Successful in 4m2s
Details 
POST /user/password?_format=json with a name of python3, powershell,
ls -la or .htaccess was refused while bodies are read. On that path,
the JSON field name now skips 930120, 932120, 932250 and 932260, the
four rules those recorded names set off, unless the query has a
json.name parameter. Recorded from Drupal 11.4.11.

Model: opus-5-5
 2026-11-10 00:58:08 +01:00
clawbot 3a37f82e34 Core Rule Set: more of Drupal's ordinary fields pass (closes #244)
check / check (push) Failing after 17m27s
Details 
Names, searches and the page to return to on more Drupal paths skip
the rules that misfire on them: 930120, 932120, 932250 and 932260,
plus 932230 and 932235 on destination only. An email address skips
930120, 932120 and 932260; the oEmbed url only 930120 and 932120.
Every Drupal path may carry a language prefix: a first segment of two
or three lowercase letters, such as /fr. Requests recorded from Drupal
11.4.11 with plain words, python3, powershell, ls -la and .htaccess are
added to the test data; tests show attacks and "; wget ..." still
refused on each new field.

Model: opus-5-5
 2026-11-09 23:09:15 +01:00
clawbot decd9b4658 Core Rule Set: Drupal's ordinary requests pass by default (closes #236)
check / check (push) Successful in 5m4s
Details 
Adds drupal.conf, the tenth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields. Drupal's
tests share the reader of recorded requests and the attack constants
with the other apps' tests.

Model: opus-5-5
 2026-11-09 19:57:53 +01:00