Names, searches, addresses and the page to return to on more Drupal
paths skip the rules that misfire on them: 930120, 932120, 932250 and
932260, plus 932230 and 932235 on destination only. The oEmbed url
skips only 930120 and 932120. Every Drupal path may carry a language
prefix such as /fr. Requests recorded from Drupal 11.4.11 with plain
words, python3, powershell, ls -la and .htaccess are added to the
test data; tests show attacks and "; wget ..." still refused on each
new field.
Model: opus-5-5
Adds drupal.conf, the tenth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields. Drupal's
tests share the reader of recorded requests and the attack constants
with the other apps' tests.
Model: opus-5-5
sneak
clawbot