Follow-up to #243, under #212. The review at #243 (comment) found these ordinary Drupal requests still refused when a field holds a value such as python3, powershell, ls -la or .htaccess. Start after that PR lands.
Definition of done:
At the defaults, in the query, these pass:
name on /user/password;
q on /ckeditor5/{editor}/entity-link-suggestions and /block-category/autocomplete;
url on /media/oembed;
destination on /big_pipe/no-js, /node/N/revisions/M/revert, /node/N/revisions/M/delete and /block/add/{type}.
The named fields also pass on a path with a language prefix, such as /fr/admin/content?title=python3.
While bodies are read, these pass:
name on sign-in, sign-up and password reset;
name[0][value] on the taxonomy term forms;
JSON:API name and revision_log.
Each is built by the plan at #212 (comment) and its addition at #212 (comment), one rule at a time on that field and those paths, with a recorded request and the attacks still refused.
make check passes.
Model: opus-5-5
Follow-up to https://git.eeqj.de/sneak/smallwebwaf/pulls/243, under https://git.eeqj.de/sneak/smallwebwaf/issues/212. The review at https://git.eeqj.de/sneak/smallwebwaf/pulls/243#issuecomment-172101 found these ordinary Drupal requests still refused when a field holds a value such as `python3`, `powershell`, `ls -la` or `.htaccess`. Start after that PR lands.
**Definition of done:**
- At the defaults, in the query, these pass:
- `name` on `/user/password`;
- `q` on `/ckeditor5/{editor}/entity-link-suggestions` and `/block-category/autocomplete`;
- `url` on `/media/oembed`;
- `destination` on `/big_pipe/no-js`, `/node/N/revisions/M/revert`, `/node/N/revisions/M/delete` and `/block/add/{type}`.
- The named fields also pass on a path with a language prefix, such as `/fr/admin/content?title=python3`.
- While bodies are read, these pass:
- `name` on sign-in, sign-up and password reset;
- `name[0][value]` on the taxonomy term forms;
- JSON:API `name` and `revision_log`.
- Each is built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023, one rule at a time on that field and those paths, with a recorded request and the attacks still refused.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 10:45:35 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #243, under #212. The review at #243 (comment) found these ordinary Drupal requests still refused when a field holds a value such as
python3,powershell,ls -laor.htaccess. Start after that PR lands.Definition of done:
nameon/user/password;qon/ckeditor5/{editor}/entity-link-suggestionsand/block-category/autocomplete;urlon/media/oembed;destinationon/big_pipe/no-js,/node/N/revisions/M/revert,/node/N/revisions/M/deleteand/block/add/{type}./fr/admin/content?title=python3.nameon sign-in, sign-up and password reset;name[0][value]on the taxonomy term forms;nameandrevision_log.make checkpasses.Model: opus-5-5