Found by the review at #275 (comment): at Nextcloud's /login, about 1 in 40 random 20-character passwords drawn from all printable characters is refused while bodies are read (942100, 942190, 932130 and others). The reviewer reports that every app's password field does the same. A password manager's generated password is ordinary traffic under #212, where sneak's words are "no false positives allowed".
Definition of done, one PR into next:
For every password field the app changes on next name (sign-in, sign-up, password change and reset, two-factor confirmation), a test sends at least 2,000 random 20-character passwords of printable characters, from a fixed seed, and none is refused.
Each such field skips only the rules that test sets off, on that app's paths, recorded in that app's .conf with a one-line comment.
A test shows ' OR '1'='1, ../../etc/passwd and <script>alert(1)</script> sent as a whole password still refused, where a rule other than those skipped still catches them. Where none does, the PR body names the field and the attack that now passes.
The PR body lists, per app and field, the rules skipped. SPEC.md names them in each app's section.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check passes. Label the PR needs-review.
Start after the Vaultwarden and Nextcloud changes land (#274, #275), so their password fields are covered too.
Model: opus-5-5
Found by the review at https://git.eeqj.de/sneak/smallwebwaf/pulls/275#issuecomment-173508: at Nextcloud's `/login`, about 1 in 40 random 20-character passwords drawn from all printable characters is refused while bodies are read (942100, 942190, 932130 and others). The reviewer reports that every app's password field does the same. A password manager's generated password is ordinary traffic under https://git.eeqj.de/sneak/smallwebwaf/issues/212, where sneak's words are "no false positives allowed".
**Definition of done**, one PR into `next`:
- For every password field the app changes on `next` name (sign-in, sign-up, password change and reset, two-factor confirmation), a test sends at least 2,000 random 20-character passwords of printable characters, from a fixed seed, and none is refused.
- Each such field skips only the rules that test sets off, on that app's paths, recorded in that app's `.conf` with a one-line comment.
- A test shows `' OR '1'='1`, `../../etc/passwd` and `<script>alert(1)</script>` sent as a whole password still refused, where a rule other than those skipped still catches them. Where none does, the PR body names the field and the attack that now passes.
- The PR body lists, per app and field, the rules skipped. `SPEC.md` names them in each app's section.
- `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check` passes. Label the PR `needs-review`.
Start after the Vaultwarden and Nextcloud changes land (https://git.eeqj.de/sneak/smallwebwaf/pulls/274, https://git.eeqj.de/sneak/smallwebwaf/pulls/275), so their password fields are covered too.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 05:44:32 +01:00
Plan. Vaultwarden and Nextcloud have landed, so this starts from current next. The definition of done above holds; in addition:
Where:internal/coreruleset: each app's .conf and _test.go, and one shared test helper in coreruleset_test.go that makes the random passwords from a fixed seed, so every app's test uses it. No new package.
Which fields: every password field an app's change on next already names, and any other password field on those apps' sign-in, sign-up, password change and reset paths found in their source. List them per app in the PR body.
Cost: the internal/coreruleset tests sit at about a third of their 90-second limit under load. Keep the random-password tests cheap: inspect only while bodies are read, as parallel subtests, and use the smallest count that still shows every misfiring rule; say the count chosen in the PR body. If the package's time rises noticeably, say so in the PR body.
Attacks: where a skipped rule was the only one catching an attack sent as a whole password, name the field and the attack in the PR body as the definition of done says; do not keep a rule that refuses random passwords.
If #225 has landed, keep each rule inside its app's section.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan.** Vaultwarden and Nextcloud have landed, so this starts from current `next`. The definition of done above holds; in addition:
- **Where:** `internal/coreruleset`: each app's `.conf` and `_test.go`, and one shared test helper in `coreruleset_test.go` that makes the random passwords from a fixed seed, so every app's test uses it. No new package.
- **Which fields:** every password field an app's change on `next` already names, and any other password field on those apps' sign-in, sign-up, password change and reset paths found in their source. List them per app in the PR body.
- **Cost:** the `internal/coreruleset` tests sit at about a third of their 90-second limit under load. Keep the random-password tests cheap: inspect only while bodies are read, as parallel subtests, and use the smallest count that still shows every misfiring rule; say the count chosen in the PR body. If the package's time rises noticeably, say so in the PR body.
- **Attacks:** where a skipped rule was the only one catching an attack sent as a whole password, name the field and the attack in the PR body as the definition of done says; do not keep a rule that refuses random passwords.
- If https://git.eeqj.de/sneak/smallwebwaf/pulls/225 has landed, keep each rule inside its app's section.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found by the review at #275 (comment): at Nextcloud's
/login, about 1 in 40 random 20-character passwords drawn from all printable characters is refused while bodies are read (942100, 942190, 932130 and others). The reviewer reports that every app's password field does the same. A password manager's generated password is ordinary traffic under #212, where sneak's words are "no false positives allowed".Definition of done, one PR into
next:nextname (sign-in, sign-up, password change and reset, two-factor confirmation), a test sends at least 2,000 random 20-character passwords of printable characters, from a fixed seed, and none is refused..confwith a one-line comment.' OR '1'='1,../../etc/passwdand<script>alert(1)</script>sent as a whole password still refused, where a rule other than those skipped still catches them. Where none does, the PR body names the field and the attack that now passes.SPEC.mdnames them in each app's section.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make checkpasses. Label the PRneeds-review.Start after the Vaultwarden and Nextcloud changes land (#274, #275), so their password fields are covered too.
Model: opus-5-5
Plan. Vaultwarden and Nextcloud have landed, so this starts from current
next. The definition of done above holds; in addition:internal/coreruleset: each app's.confand_test.go, and one shared test helper incoreruleset_test.gothat makes the random passwords from a fixed seed, so every app's test uses it. No new package.nextalready names, and any other password field on those apps' sign-in, sign-up, password change and reset paths found in their source. List them per app in the PR body.internal/corerulesettests sit at about a third of their 90-second limit under load. Keep the random-password tests cheap: inspect only while bodies are read, as parallel subtests, and use the smallest count that still shows every misfiring rule; say the count chosen in the PR body. If the package's time rises noticeably, say so in the PR body.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5