Compare commits

..
Author SHA1 Message Date
clawbot 44708d5924 rproxy test: send the body over its limit without Connection: close (closes #371)
check / check (push) Waiting to run
visit's client sends Connection: close, and Go's server then closes the
connection after the 413 without reading the rest of the body. The
visitor, still sending, could see the reset before the answer. The test
now sends the request on its own connection without that header, so Go's
server reads the rest before it closes.

Model: opus-5-5
2026-11-12 06:22:33 +00:00
clawbot aaa9719f02 Core Rule Set: Ghost posts and code injection take a script element (closes #358)
check / check (push) Waiting to run
While bodies are read, 941110 refused a `<script>` element in an HTML card
that embeds a widget, and in code injection that loads analytics. The new
exclusion 900366 switches 941110 off on the Admin API for `lexical`,
`mobiledoc` and `html` of posts and pages, their `codeinjection_head` and
`codeinjection_foot`, and settings `value`. Snippets, a newsletter's footer
and every other field and path still refuse it; `javascript:` links stay
refused everywhere.

Model: opus-5-5
2026-11-12 06:13:59 +01:00
+9 -4
View File
@@ -93,10 +93,15 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
}, },
) )
got := visit(t, newRequest(t, http.MethodPost, addr, "/", // The visitor sends no Connection: close, so Go's server reads the rest
bytes.NewReader(make([]byte, tc.size)))) // of the body before it closes the connection. Closed with the rest
if got.status != http.StatusRequestEntityTooLarge { // unread, the connection is reset while the visitor still sends.
t.Errorf("answered %+v, want 413", got) conn := dial(t, addr)
send(t, conn, post+announcedLength(tc.size)+
strings.Repeat("x", tc.size))
if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
t.Errorf("status %d, want 413", status)
} }
if asked := standIn.question(t); len(asked.body) != tc.asked { if asked := standIn.question(t); len(asked.body) != tc.asked {