From the review at #265 (comment): the opening comment of internal/coreruleset/mediawiki.conf says each exclusion for a field holding a title removes all four of 930120, 932120, 932250 and 932260. wpTitles skips 932260 only when it holds none of ;, |, &, backtick or {, so the comment is false for it.
Definition of done, one PR into next:
The opening comment is true of every rule in the file: it names wpTitles as the exception, in one sentence.
No rule or test changes.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check passes. Label the PR needs-review.
Start after #225 lands or is rebased, since it edits the same comment.
Model: opus-5-5
From the review at https://git.eeqj.de/sneak/smallwebwaf/pulls/265#issuecomment-173366: the opening comment of `internal/coreruleset/mediawiki.conf` says each exclusion for a field holding a title removes all four of 930120, 932120, 932250 and 932260. `wpTitles` skips 932260 only when it holds none of `;`, `|`, `&`, backtick or `{`, so the comment is false for it.
**Definition of done**, one PR into `next`:
- The opening comment is true of every rule in the file: it names `wpTitles` as the exception, in one sentence.
- No rule or test changes.
- `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check` passes. Label the PR `needs-review`.
Start after https://git.eeqj.de/sneak/smallwebwaf/pulls/225 lands or is rebased, since it edits the same comment.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 03:10:13 +01:00
Addition to the definition of done, from the review at #225 (comment): once that PR lands, the doc comment of parseApps in internal/config/config.go gives an example parseApps accepts, such as cloud.example.com:gitea,wordpress, in place of one naming nextcloud, which is not a supported app. Comment only, like the rest of this issue.
Model: opus-5-5
**Addition to the definition of done**, from the review at https://git.eeqj.de/sneak/smallwebwaf/pulls/225#issuecomment-173440: once that PR lands, the doc comment of `parseApps` in `internal/config/config.go` gives an example `parseApps` accepts, such as `cloud.example.com:gitea,wordpress`, in place of one naming `nextcloud`, which is not a supported app. Comment only, like the rest of this issue.
Model: opus-5-5
don't get too down in the weeds on the per-app stuff before we have a working version that passes traffic as a 1.0 beta. we can start tuning the rules more later, it can start permissive (it's replacing nothing, which means that currently all traffic is passing, so anything is an improvement...)
don't get too down in the weeds on the per-app stuff before we have a working version that passes traffic as a 1.0 beta. we can start tuning the rules more later, it can start permissive (it's replacing nothing, which means that currently *all* traffic is passing, so *anything* is an improvement...)
Reading of sneak's comment above: stop going deep on per-app rule tuning. First comes a working version that passes traffic, as a 1.0 beta. Rule tuning can come later. The defaults can start permissive: today nothing stands in front of the apps, so any protection is an improvement.
What changes:
No new per-app units start. This issue (a comment fix in mediawiki.conf) is closed unbuilt.
#305 (MediaWiki on wikis in other languages) is built and in its last narrow review; it lands only if that review passes, with no further rework rounds. Per-app follow-ups found by reviews are not filed.
Work turns to what a 1.0 beta that passes traffic needs: the rename of the discriminator to waf (#227), early sanity checks (#308), the storage spec (#217) and UTC everywhere.
"Start permissive" is taken as the guide where a default has to be chosen. No existing default is changed on this comment alone.
Model: opus-5-5
**Reading of sneak's comment above:** stop going deep on per-app rule tuning. First comes a working version that passes traffic, as a 1.0 beta. Rule tuning can come later. The defaults can start permissive: today nothing stands in front of the apps, so any protection is an improvement.
**What changes:**
- No new per-app units start. This issue (a comment fix in `mediawiki.conf`) is closed unbuilt.
- https://git.eeqj.de/sneak/smallwebwaf/pulls/305 (MediaWiki on wikis in other languages) is built and in its last narrow review; it lands only if that review passes, with no further rework rounds. Per-app follow-ups found by reviews are not filed.
- Work turns to what a 1.0 beta that passes traffic needs: the rename of the discriminator to `waf` (https://git.eeqj.de/sneak/smallwebwaf/issues/227), early sanity checks (https://git.eeqj.de/sneak/smallwebwaf/issues/308), the storage spec (https://git.eeqj.de/sneak/smallwebwaf/issues/217) and UTC everywhere.
- "Start permissive" is taken as the guide where a default has to be chosen. No existing default is changed on this comment alone.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From the review at #265 (comment): the opening comment of
internal/coreruleset/mediawiki.confsays each exclusion for a field holding a title removes all four of 930120, 932120, 932250 and 932260.wpTitlesskips 932260 only when it holds none of;,|,&, backtick or{, so the comment is false for it.Definition of done, one PR into
next:wpTitlesas the exception, in one sentence.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make checkpasses. Label the PRneeds-review.Start after #225 lands or is rebased, since it edits the same comment.
Model: opus-5-5
Addition to the definition of done, from the review at #225 (comment): once that PR lands, the doc comment of
parseAppsininternal/config/config.gogives an exampleparseAppsaccepts, such ascloud.example.com:gitea,wordpress, in place of one namingnextcloud, which is not a supported app. Comment only, like the rest of this issue.Model: opus-5-5
don't get too down in the weeds on the per-app stuff before we have a working version that passes traffic as a 1.0 beta. we can start tuning the rules more later, it can start permissive (it's replacing nothing, which means that currently all traffic is passing, so anything is an improvement...)
Reading of sneak's comment above: stop going deep on per-app rule tuning. First comes a working version that passes traffic, as a 1.0 beta. Rule tuning can come later. The defaults can start permissive: today nothing stands in front of the apps, so any protection is an improvement.
What changes:
mediawiki.conf) is closed unbuilt.waf(#227), early sanity checks (#308), the storage spec (#217) and UTC everywhere.Model: opus-5-5