Read the request filtering, rate limiting and proxy code for correctness, and file each defect found. This unit opens no PR. Each defect becomes its own issue, and each fix is a later unit of its own.
Scope
internal/proxy, internal/ratelimit, internal/bans, internal/rules and internal/waf, checked against SPEC.md and the README. Look for:
the client address worked out wrongly from the TCP peer, X-Forwarded-For and SWWAF_TRUSTED_PROXIES;
the order of checks differing from SPEC.md "Data flow for one request";
counting errors at window and bucket edges, or at the exact limit;
ban lengths and escalation, and when a ban becomes permanent;
allow-listed or exempt clients and paths checked or counted when they should not be, or the reverse;
observe mode refusing anything;
a request or answer changed on its way through, including hop-by-hop headers, Host and the forwarded headers;
body size limits and timeouts not holding, or a limit giving the wrong status;
data races, locks held across network calls, and a panic on malformed input;
memory that grows without bound under hostile traffic.
Rules
A finding is a defect only when you can show it: with a test that fails, written locally and not pushed, or with an exact repro. Style, naming and refactors for taste are not findings.
File each defect as its own issue. Say where it is (file and function), what goes wrong and with what input, what SPEC.md or the README says should happen, and a severity (critical, major or minor). Critical means a request is refused that should pass, or passes that should be refused, or the process crashes or loses its state. Before filing, check the tracker for an open issue that already covers it.
Definition of done
The whole scope has been read. One comment on this issue links each issue filed, one line each, or says that none was found.
Model: opus-5-5
Read the request filtering, rate limiting and proxy code for correctness, and file each defect found. This unit opens no PR. Each defect becomes its own issue, and each fix is a later unit of its own.
## Scope
`internal/proxy`, `internal/ratelimit`, `internal/bans`, `internal/rules` and `internal/waf`, checked against `SPEC.md` and the README. Look for:
- the client address worked out wrongly from the TCP peer, `X-Forwarded-For` and `SWWAF_TRUSTED_PROXIES`;
- the order of checks differing from `SPEC.md` "Data flow for one request";
- counting errors at window and bucket edges, or at the exact limit;
- ban lengths and escalation, and when a ban becomes permanent;
- allow-listed or exempt clients and paths checked or counted when they should not be, or the reverse;
- `observe` mode refusing anything;
- a request or answer changed on its way through, including hop-by-hop headers, `Host` and the forwarded headers;
- body size limits and timeouts not holding, or a limit giving the wrong status;
- data races, locks held across network calls, and a panic on malformed input;
- memory that grows without bound under hostile traffic.
## Rules
- A finding is a defect only when you can show it: with a test that fails, written locally and not pushed, or with an exact repro. Style, naming and refactors for taste are not findings.
- File each defect as its own issue. Say where it is (file and function), what goes wrong and with what input, what `SPEC.md` or the README says should happen, and a severity (critical, major or minor). Critical means a request is refused that should pass, or passes that should be refused, or the process crashes or loses its state. Before filing, check the tracker for an open issue that already covers it.
## Definition of done
The whole scope has been read. One comment on this issue links each issue filed, one line each, or says that none was found.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 17:26:43 +02:00
The whole scope was read: internal/proxy, internal/ratelimit, internal/bans, internal/rules and internal/waf, against SPEC.md and the README. Each defect below has a failing test, kept local.
#130 (major): a client that stops sending its body after the app has answered is never timed out.
#126 (minor): a path holding a character Go escapes reaches the app re-encoded, %2F turned into /.
#127 (minor): an answer without a Content-Type can reach the client with one Go guessed.
#131 (minor): an upgrade the app accepts under another protocol name is answered 200 with an empty body.
#129 (minor): requests waiting for a client's first lookup are counted at their arrival time, and one can wipe another's minute count.
#128 (minor): a ban's earlier_bans undercounts once a ban after an admin's ban is dropped.
No critical defect was found.
Model: opus-5-5
The whole scope was read: `internal/proxy`, `internal/ratelimit`, `internal/bans`, `internal/rules` and `internal/waf`, against `SPEC.md` and the README. Each defect below has a failing test, kept local.
- https://git.eeqj.de/sneak/smallwebwaf/issues/130 (major): a client that stops sending its body after the app has answered is never timed out.
- https://git.eeqj.de/sneak/smallwebwaf/issues/126 (minor): a path holding a character Go escapes reaches the app re-encoded, `%2F` turned into `/`.
- https://git.eeqj.de/sneak/smallwebwaf/issues/127 (minor): an answer without a `Content-Type` can reach the client with one Go guessed.
- https://git.eeqj.de/sneak/smallwebwaf/issues/131 (minor): an upgrade the app accepts under another protocol name is answered 200 with an empty body.
- https://git.eeqj.de/sneak/smallwebwaf/issues/129 (minor): requests waiting for a client's first lookup are counted at their arrival time, and one can wipe another's minute count.
- https://git.eeqj.de/sneak/smallwebwaf/issues/128 (minor): a ban's `earlier_bans` undercounts once a ban after an admin's ban is dropped.
No critical defect was found.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Read the request filtering, rate limiting and proxy code for correctness, and file each defect found. This unit opens no PR. Each defect becomes its own issue, and each fix is a later unit of its own.
Scope
internal/proxy,internal/ratelimit,internal/bans,internal/rulesandinternal/waf, checked againstSPEC.mdand the README. Look for:X-Forwarded-ForandSWWAF_TRUSTED_PROXIES;SPEC.md"Data flow for one request";observemode refusing anything;Hostand the forwarded headers;Rules
SPEC.mdor the README says should happen, and a severity (critical, major or minor). Critical means a request is refused that should pass, or passes that should be refused, or the process crashes or loses its state. Before filing, check the tracker for an open issue that already covers it.Definition of done
The whole scope has been read. One comment on this issue links each issue filed, one line each, or says that none was found.
Model: opus-5-5
The whole scope was read:
internal/proxy,internal/ratelimit,internal/bans,internal/rulesandinternal/waf, againstSPEC.mdand the README. Each defect below has a failing test, kept local.%2Fturned into/.Content-Typecan reach the client with one Go guessed.earlier_bansundercounts once a ban after an admin's ban is dropped.No critical defect was found.
Model: opus-5-5