next is red at 9aa5b30: make check fails in lint with four goconst findings. #261 and #251 each passed alone; together they repeat two attack strings a third time.
internal/coreruleset/drupal_test.go lines 134 and 181, and mediawiki_test.go line 207: `1' OR '1'='1`, for which the constant injection already exists in coreruleset_test.go.
drupal_test.go lines 135 and 182, and mediawiki_test.go line 208: `<script>alert(1)</script>`, which has no constant.
Definition of done, one PR into next, test files only:
The three SQL strings use injection.
One new constant beside injection in coreruleset_test.go holds <script>alert(1)</script>, named for what it is; the three script strings use it.
No request or expected outcome changes; no linter setting changes.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check passes; a flock timeout also exits 1, so read the output. Label the PR needs-review.
Nothing else merges into next until this lands.
Model: opus-5-5
`next` is red at `9aa5b30`: `make check` fails in lint with four `goconst` findings. https://git.eeqj.de/sneak/smallwebwaf/pulls/261 and https://git.eeqj.de/sneak/smallwebwaf/pulls/251 each passed alone; together they repeat two attack strings a third time.
- `internal/coreruleset/drupal_test.go` lines 134 and 181, and `mediawiki_test.go` line 207: `` `1' OR '1'='1` ``, for which the constant `injection` already exists in `coreruleset_test.go`.
- `drupal_test.go` lines 135 and 182, and `mediawiki_test.go` line 208: `` `<script>alert(1)</script>` ``, which has no constant.
**Definition of done**, one PR into `next`, test files only:
- The three SQL strings use `injection`.
- One new constant beside `injection` in `coreruleset_test.go` holds `<script>alert(1)</script>`, named for what it is; the three script strings use it.
- No request or expected outcome changes; no linter setting changes.
- `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check` passes; a `flock` timeout also exits 1, so read the output. Label the PR `needs-review`.
Nothing else merges into `next` until this lands.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 01:00:44 +01:00
Fixed in #264. The new constant is scriptTag, because scriptInjection already names the URL-escaped form.
Model: opus-5-5
Fixed in https://git.eeqj.de/sneak/smallwebwaf/pulls/264. The new constant is `scriptTag`, because `scriptInjection` already names the URL-escaped form.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
nextis red at9aa5b30:make checkfails in lint with fourgoconstfindings. #261 and #251 each passed alone; together they repeat two attack strings a third time.internal/coreruleset/drupal_test.golines 134 and 181, andmediawiki_test.goline 207:`1' OR '1'='1`, for which the constantinjectionalready exists incoreruleset_test.go.drupal_test.golines 135 and 182, andmediawiki_test.goline 208:`<script>alert(1)</script>`, which has no constant.Definition of done, one PR into
next, test files only:injection.injectionincoreruleset_test.goholds<script>alert(1)</script>, named for what it is; the three script strings use it.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make checkpasses; aflocktimeout also exits 1, so read the output. Label the PRneeds-review.Nothing else merges into
nextuntil this lands.Model: opus-5-5
Fixed in #264. The new constant is
scriptTag, becausescriptInjectionalready names the URL-escaped form.Model: opus-5-5