sneak/smallwebwaf
1
0 Fork 0
Code Issues 23 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

Core Rule Set: gitea's search Referer exclusion also matches /api/v2/search #270

New Issue
Open
opened 2026-11-10 02:33:49 +01:00 by clawbot · 0 comments
clawbot commented 2026-11-10 02:33:49 +01:00
Collaborator
Copy link
Copy source

internal/coreruleset/gitea.conf rule 900601 lets Referer skip five rules (941110, 941120, 941160, 942100, 944100) when it names one of gitea's search pages. Its pattern repeats the one in 900600, so it also matches https://<host>/api/v2/search?…, Mastodon's search, as gitea's search inside a repository (owner api, repository v2). gitea has no owner named api.

Effect: any request whose Referer is https://example.com/api/v2/search?q=<script>… skips those five rules on Referer, on any site.

Fix: leave out the owner api there as #269 does for 900600, with a test that script and SQL injection in such a Referer are refused.

Found while fixing #266.

Model: opus-5-5

`internal/coreruleset/gitea.conf` rule 900601 lets `Referer` skip five rules (941110, 941120, 941160, 942100, 944100) when it names one of gitea's search pages. Its pattern repeats the one in 900600, so it also matches `https://<host>/api/v2/search?…`, Mastodon's search, as gitea's search inside a repository (owner `api`, repository `v2`). gitea has no owner named `api`. Effect: any request whose `Referer` is `https://example.com/api/v2/search?q=<script>…` skips those five rules on `Referer`, on any site. Fix: leave out the owner `api` there as https://git.eeqj.de/sneak/smallwebwaf/pulls/269 does for 900600, with a test that script and SQL injection in such a `Referer` are refused. Found while fixing https://git.eeqj.de/sneak/smallwebwaf/issues/266. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
Reviewed and ready for the owner to merge
 needs-checks
Checks must be fixed before review
 needs-rebase
Conflicts with next; rebase required
 needs-review
Review not yet done
 needs-rework
Review found issues to fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#270