Follow-up under #212, after Nextcloud's change (#275) and the WebDAV methods (#278). Nextcloud's Calendar and Contacts apps sync with phones and desktop clients over CalDAV and CardDAV under /remote.php/dav/calendars/ and /remote.php/dav/addressbooks/. rproxy still answers MKCALENDAR with 405, and nothing has recorded that traffic.
Scope, decided here: sneak named Nextcloud with "no false positives allowed" (#212). Calendar and contacts sync are ordinary Nextcloud traffic, so they are in scope. Reversing that costs one exclusion block and one method.
Definition of done, one PR into next, after both PRs above land:
rproxy passes MKCALENDAR on, as it passes the other WebDAV methods; the Core Rule Set allows it only on Nextcloud's calendar paths.
Recorded from Nextcloud at the digest named in that PR with its Calendar and Contacts apps: creating a calendar and an address book, adding, changing and deleting an event and a contact, and a sync client's PROPFIND and REPORT. Event titles, locations, descriptions and contact names hold plain words and python3, powershell, ls -la and .htaccess.
Each field or body that misfires skips only the rules its recorded values set off, on those paths; SQL injection, path traversal and script injection stay refused, with tests.
SPEC.md and the PR body name what changed; make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check passes. Label the PR needs-review.
Model: opus-5-5
Follow-up under https://git.eeqj.de/sneak/smallwebwaf/issues/212, after Nextcloud's change (https://git.eeqj.de/sneak/smallwebwaf/pulls/275) and the WebDAV methods (https://git.eeqj.de/sneak/smallwebwaf/issues/278). Nextcloud's Calendar and Contacts apps sync with phones and desktop clients over CalDAV and CardDAV under `/remote.php/dav/calendars/` and `/remote.php/dav/addressbooks/`. `rproxy` still answers `MKCALENDAR` with `405`, and nothing has recorded that traffic.
Scope, decided here: sneak named Nextcloud with "no false positives allowed" (https://git.eeqj.de/sneak/smallwebwaf/issues/212). Calendar and contacts sync are ordinary Nextcloud traffic, so they are in scope. Reversing that costs one exclusion block and one method.
**Definition of done**, one PR into `next`, after both PRs above land:
- `rproxy` passes `MKCALENDAR` on, as it passes the other WebDAV methods; the Core Rule Set allows it only on Nextcloud's calendar paths.
- Recorded from Nextcloud at the digest named in that PR with its Calendar and Contacts apps: creating a calendar and an address book, adding, changing and deleting an event and a contact, and a sync client's `PROPFIND` and `REPORT`. Event titles, locations, descriptions and contact names hold plain words and `python3`, `powershell`, `ls -la` and `.htaccess`.
- Each field or body that misfires skips only the rules its recorded values set off, on those paths; SQL injection, path traversal and script injection stay refused, with tests.
- `SPEC.md` and the PR body name what changed; `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check` passes. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 07:09:43 +01:00
Plan. Nextcloud (#275) and the WebDAV methods (#279) have landed, so this starts from current next.
Where:MKCALENDAR in internal/rproxy beside the other WebDAV methods; everything else in internal/coreruleset: nextcloud.conf, testdata/nextcloud-requests.txt and nextcloud_test.go. No new file.
Recording: Nextcloud 35.0.2 at the digest named in #275, in Docker on this host, with its Calendar and Contacts apps enabled. The web apps through a headless Chrome in a container; a CalDAV and CardDAV client's requests (PROPFIND, REPORT, PUT of an .ics and a .vcf, MKCALENDAR, DELETE) through plain HTTP clients sending what such clients send. Record titles, locations, descriptions and names with plain words and with python3, powershell, ls -la and .htaccess. Commit nothing about running it; remove every container and volume you start; stay under 3 GiB of RAM.
Exclusions: on the calendar and address book paths only, removing on each field or body only the rules its recorded values set off. An .ics or .vcf sent by PUT is a file, as uploads to the Files paths are; follow what nextcloud.conf already does for those. SQL injection, path traversal and script injection stay refused, with tests using the shared attack constants. Every rule is phase 1 unless it must read the body; a later-phase rule follows whatever next says about such rules.
Cost: the internal/coreruleset tests sit at about 40 seconds of their 90-second limit under load. Record only what the issue lists, a few of each kind.
Docs:SPEC.md's Nextcloud section and the PR body name the paths, fields and MKCALENDAR; the PR body says an ordinary request on another field can still be refused.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR needs-review.
Model: opus-5-5
**Plan.** Nextcloud (https://git.eeqj.de/sneak/smallwebwaf/pulls/275) and the WebDAV methods (https://git.eeqj.de/sneak/smallwebwaf/pulls/279) have landed, so this starts from current `next`.
- **Where:** `MKCALENDAR` in `internal/rproxy` beside the other WebDAV methods; everything else in `internal/coreruleset`: `nextcloud.conf`, `testdata/nextcloud-requests.txt` and `nextcloud_test.go`. No new file.
- **Recording:** Nextcloud 35.0.2 at the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/275, in Docker on this host, with its Calendar and Contacts apps enabled. The web apps through a headless Chrome in a container; a CalDAV and CardDAV client's requests (`PROPFIND`, `REPORT`, `PUT` of an `.ics` and a `.vcf`, `MKCALENDAR`, `DELETE`) through plain HTTP clients sending what such clients send. Record titles, locations, descriptions and names with plain words and with `python3`, `powershell`, `ls -la` and `.htaccess`. Commit nothing about running it; remove every container and volume you start; stay under 3 GiB of RAM.
- **Exclusions:** on the calendar and address book paths only, removing on each field or body only the rules its recorded values set off. An `.ics` or `.vcf` sent by `PUT` is a file, as uploads to the Files paths are; follow what `nextcloud.conf` already does for those. SQL injection, path traversal and script injection stay refused, with tests using the shared attack constants. Every rule is phase 1 unless it must read the body; a later-phase rule follows whatever `next` says about such rules.
- **Cost:** the `internal/coreruleset` tests sit at about 40 seconds of their 90-second limit under load. Record only what the issue lists, a few of each kind.
- **Docs:** `SPEC.md`'s Nextcloud section and the PR body name the paths, fields and `MKCALENDAR`; the PR body says an ordinary request on another field can still be refused.
`make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PR `needs-review`.
Model: opus-5-5
Built in #285: MKCALENDAR passed on and allowed on the calendar paths; PROPFIND allowed on /.well-known/caldav and /.well-known/carddav; the names in MKCOL and MKCALENDAR bodies and a calendar's description skip the rules they set off.
Found in the recording, beyond the plan: the Calendar and Contacts apps name the charset twice in Content-Type when they change an event or a contact, which 920530 refused. A PUT typed text/calendar or text/vcard on those paths now skips it.
Not recorded: renaming a calendar or address book (PROPPATCH).
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/285: `MKCALENDAR` passed on and allowed on the calendar paths; `PROPFIND` allowed on `/.well-known/caldav` and `/.well-known/carddav`; the names in `MKCOL` and `MKCALENDAR` bodies and a calendar's description skip the rules they set off.
Found in the recording, beyond the plan: the Calendar and Contacts apps name the charset twice in `Content-Type` when they change an event or a contact, which 920530 refused. A `PUT` typed `text/calendar` or `text/vcard` on those paths now skips it.
Not recorded: renaming a calendar or address book (`PROPPATCH`).
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up under #212, after Nextcloud's change (#275) and the WebDAV methods (#278). Nextcloud's Calendar and Contacts apps sync with phones and desktop clients over CalDAV and CardDAV under
/remote.php/dav/calendars/and/remote.php/dav/addressbooks/.rproxystill answersMKCALENDARwith405, and nothing has recorded that traffic.Scope, decided here: sneak named Nextcloud with "no false positives allowed" (#212). Calendar and contacts sync are ordinary Nextcloud traffic, so they are in scope. Reversing that costs one exclusion block and one method.
Definition of done, one PR into
next, after both PRs above land:rproxypassesMKCALENDARon, as it passes the other WebDAV methods; the Core Rule Set allows it only on Nextcloud's calendar paths.PROPFINDandREPORT. Event titles, locations, descriptions and contact names hold plain words andpython3,powershell,ls -laand.htaccess.SPEC.mdand the PR body name what changed;make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make checkpasses. Label the PRneeds-review.Model: opus-5-5
Plan. Nextcloud (#275) and the WebDAV methods (#279) have landed, so this starts from current
next.MKCALENDARininternal/rproxybeside the other WebDAV methods; everything else ininternal/coreruleset:nextcloud.conf,testdata/nextcloud-requests.txtandnextcloud_test.go. No new file.PROPFIND,REPORT,PUTof an.icsand a.vcf,MKCALENDAR,DELETE) through plain HTTP clients sending what such clients send. Record titles, locations, descriptions and names with plain words and withpython3,powershell,ls -laand.htaccess. Commit nothing about running it; remove every container and volume you start; stay under 3 GiB of RAM..icsor.vcfsent byPUTis a file, as uploads to the Files paths are; follow whatnextcloud.confalready does for those. SQL injection, path traversal and script injection stay refused, with tests using the shared attack constants. Every rule is phase 1 unless it must read the body; a later-phase rule follows whatevernextsays about such rules.internal/corerulesettests sit at about 40 seconds of their 90-second limit under load. Record only what the issue lists, a few of each kind.SPEC.md's Nextcloud section and the PR body name the paths, fields andMKCALENDAR; the PR body says an ordinary request on another field can still be refused.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand, no scripted edits, and start no subagent on another model. Label the PRneeds-review.Model: opus-5-5
Built in #285:
MKCALENDARpassed on and allowed on the calendar paths;PROPFINDallowed on/.well-known/caldavand/.well-known/carddav; the names inMKCOLandMKCALENDARbodies and a calendar's description skip the rules they set off.Found in the recording, beyond the plan: the Calendar and Contacts apps name the charset twice in
Content-Typewhen they change an event or a contact, which 920530 refused. APUTtypedtext/calendarortext/vcardon those paths now skips it.Not recorded: renaming a calendar or address book (
PROPPATCH).Model: opus-5-5