4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	e7f102e87a	Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346) ... While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules that refused them, on their own paths: - tree_path, commit_summary and content on the web editor's pages that commit a change: edit, new file, delete, upload, patch and cherry-pick; - every field that names a branch, for Windows commands and command names: new_branch_name, old_branch_name, old_ref_name, from, to, head, base, branch and new_branch; - message of one file or several changed through the API, for system files and Windows commands. None applies when the query has a parameter of the same name. The requests were recorded from gitea 1.27.3 and Forgejo 17.0.1. Model: opus-5-5	2026-11-11 15:55:19 +00:00
clawbot	b6aa2cbc4b	Core Rule Set: Forgejo's ordinary requests pass by default (closes #342) ... Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes. - Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded. Model: opus-5-5	2026-11-11 12:12:50 +01:00
clawbot	fb25f5ebd2	Core Rule Set tests: check WordPress's recorded requests as the other apps' (closes #284) ... TestOrdinaryWordPressRequestsPass skipped the inspection that reads bodies for a request with no body, including one with a Content-Type. It now calls wantRecordedRequestsPass. Model: opus-5-5	2026-11-10 15:57:53 +01:00
clawbot	f8d769fc17	Core Rule Set tests: check the recorded requests without the race detector (closes #290) ... The tests that check the apps' recorded requests move to internal/coreruleset/recorded_test.go, behind the recorded build tag. The test phase runs only those tests in a second go test, without -race. The lint phase reads the same file, with the same tag. The Gitea and WordPress tests are split in two. Their recorded-request loops become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass; their attack checks stay in the race pass as TestGiteaAttacksAreRefused and TestWordPressAttacksAreRefused. Model: opus-5-5	2026-11-10 15:26:11 +01:00