From the review at #282 (comment): TestOrdinaryWordPressRequestsPassAndAttacksAreRefused skips the inspection that reads bodies for every recorded request with no body, including the seven that carry a Content-Type. wantRecordedRequestsPass now inspects those both ways, since the set that reads bodies can refuse them on their headers alone.
Definition of done, one PR into next, test files only:
WordPress's recorded requests go through wantRecordedRequestsPass, or through the same condition, so a request with no body but a Content-Type is inspected both ways, as every other app's is.
No other test changes; if one of the seven is refused while bodies are read, that is a bug in WordPress's exclusions, fixed in the same PR with the narrowest rule and named in the PR body.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check passes. Label the PR needs-review.
Model: opus-5-5
From the review at https://git.eeqj.de/sneak/smallwebwaf/pulls/282#issuecomment-173691: `TestOrdinaryWordPressRequestsPassAndAttacksAreRefused` skips the inspection that reads bodies for every recorded request with no body, including the seven that carry a `Content-Type`. `wantRecordedRequestsPass` now inspects those both ways, since the set that reads bodies can refuse them on their headers alone.
**Definition of done**, one PR into `next`, test files only:
- WordPress's recorded requests go through `wantRecordedRequestsPass`, or through the same condition, so a request with no body but a `Content-Type` is inspected both ways, as every other app's is.
- No other test changes; if one of the seven is refused while bodies are read, that is a bug in WordPress's exclusions, fixed in the same PR with the narrowest rule and named in the PR body.
- `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check` passes. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 09:44:42 +01:00
Plan. Test files only, in internal/coreruleset: change TestOrdinaryWordPressRequestsPassAndAttacksAreRefused so WordPress's recorded requests go through wantRecordedRequestsPass, as every other app's do; keep its attack checks as they are. If one of the seven requests with no body but a Content-Type is refused while bodies are read, fix it in wordpress.conf with the narrowest rule, inside WordPress's section if #225 has landed, and name it in the PR body. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Label the PR needs-review.
Model: opus-5-5
**Plan.** Test files only, in `internal/coreruleset`: change `TestOrdinaryWordPressRequestsPassAndAttacksAreRefused` so WordPress's recorded requests go through `wantRecordedRequestsPass`, as every other app's do; keep its attack checks as they are. If one of the seven requests with no body but a `Content-Type` is refused while bodies are read, fix it in `wordpress.conf` with the narrowest rule, inside WordPress's section if https://git.eeqj.de/sneak/smallwebwaf/pulls/225 has landed, and name it in the PR body. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Label the PR `needs-review`.
Model: opus-5-5
Paused until #287 lands: this adds inspections to a test package already at its time limit. The plan above stands.
Model: opus-5-5
Paused until https://git.eeqj.de/sneak/smallwebwaf/issues/287 lands: this adds inspections to a test package already at its time limit. The plan above stands.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From the review at #282 (comment):
TestOrdinaryWordPressRequestsPassAndAttacksAreRefusedskips the inspection that reads bodies for every recorded request with no body, including the seven that carry aContent-Type.wantRecordedRequestsPassnow inspects those both ways, since the set that reads bodies can refuse them on their headers alone.Definition of done, one PR into
next, test files only:wantRecordedRequestsPass, or through the same condition, so a request with no body but aContent-Typeis inspected both ways, as every other app's is.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make checkpasses. Label the PRneeds-review.Model: opus-5-5
Plan. Test files only, in
internal/coreruleset: changeTestOrdinaryWordPressRequestsPassAndAttacksAreRefusedso WordPress's recorded requests go throughwantRecordedRequestsPass, as every other app's do; keep its attack checks as they are. If one of the seven requests with no body but aContent-Typeis refused while bodies are read, fix it inwordpress.confwith the narrowest rule, inside WordPress's section if #225 has landed, and name it in the PR body. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Label the PRneeds-review.Model: opus-5-5
Paused until #287 lands: this adds inspections to a test package already at its time limit. The plan above stands.
Model: opus-5-5