From the reviews of #208 (#208 (comment)), which puts Gitea's false-positive fixes into the defaults as you ordered.
The issue: an exclusion is tied to a path, not to an app. Gitea's search fix lets q skip some injection rules on /api/v1/search and similar paths. Any other app behind smallwebwaf that serves the same path gets that weaker check too. A script or SQL injection in its q then gets through at the defaults. The same will hold for each app added under #212.
Options:
All apps' fixes on by default, and a setting to narrow them (recommended): SWWAF_APPS lists the apps a site actually serves, such as gitea,nextcloud. Unset, every supported app's fixes apply, so it still works out of the box. Set, only the named apps' fixes apply, and every other path keeps the full check.
Always on: every supported app's fixes apply on every site, with no setting. This is the simplest, at the weaker check described above.
Off until named: a site gets an app's fixes only when it names the app. This is the strongest check, but not out of the box.
Question: which one?
Model: opus-5-5
From the reviews of https://git.eeqj.de/sneak/smallwebwaf/pulls/208 (https://git.eeqj.de/sneak/smallwebwaf/pulls/208#issuecomment-170242), which puts Gitea's false-positive fixes into the defaults as you ordered.
**The issue:** an exclusion is tied to a path, not to an app. Gitea's search fix lets `q` skip some injection rules on `/api/v1/search` and similar paths. Any other app behind smallwebwaf that serves the same path gets that weaker check too. A script or SQL injection in its `q` then gets through at the defaults. The same will hold for each app added under https://git.eeqj.de/sneak/smallwebwaf/issues/212.
**Options:**
- **All apps' fixes on by default, and a setting to narrow them** (recommended): `SWWAF_APPS` lists the apps a site actually serves, such as `gitea,nextcloud`. Unset, every supported app's fixes apply, so it still works out of the box. Set, only the named apps' fixes apply, and every other path keeps the full check.
- **Always on:** every supported app's fixes apply on every site, with no setting. This is the simplest, at the weaker check described above.
- **Off until named:** a site gets an app's fixes only when it names the app. This is the strongest check, but not out of the box.
**Question:** which one?
Model: opus-5-5
sneak
was assigned by clawbot2026-11-07 04:36:24 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From the reviews of #208 (#208 (comment)), which puts Gitea's false-positive fixes into the defaults as you ordered.
The issue: an exclusion is tied to a path, not to an app. Gitea's search fix lets
qskip some injection rules on/api/v1/searchand similar paths. Any other app behind smallwebwaf that serves the same path gets that weaker check too. A script or SQL injection in itsqthen gets through at the defaults. The same will hold for each app added under #212.Options:
SWWAF_APPSlists the apps a site actually serves, such asgitea,nextcloud. Unset, every supported app's fixes apply, so it still works out of the box. Set, only the named apps' fixes apply, and every other path keeps the full check.Question: which one?
Model: opus-5-5