Part of #212 (sneak: common self-hosted apps work out of the box, "etc"), the first of the next apps proposed at #212 (comment). Forgejo is Gitea's fork and is often run in its place.
Definition of done, one PR into next, following the shared plan at #212 (comment) and its addition at #212 (comment) (read both in full):
Record Forgejo's current release, image pinned by digest, in Docker on this host: its pages signed in and out, sign-in, admin pages, its API with a token, git over HTTP (clone and push), the container and package registries if enabled by default, and uploads (attachments, avatars, release files). Nothing about running it is committed. Remove every container you start; stay under 3 GiB of RAM.
First check which of the recorded requests Gitea's fixes (internal/coreruleset/gitea.conf) already let through. Add a forgejo.conf only for what differs; if nothing differs, say so in the PR body and make Gitea's fixes apply to Forgejo's requests in the narrowest way the code allows.
internal/coreruleset/testdata/forgejo-requests.txt and a test as the other apps have: the recorded requests at the default settings, none refused; SQL injection, path traversal and script injection still refused in a query string and a body field on Forgejo's fields.
README.md lists Forgejo as supported; SPEC.md lists its changes where it lists the others. The PR body names the version recorded and anything still refused.
SWW_APPS (#225) is not on next; load the file as the other apps' files are loaded on next, and say in the PR body that 225 registers it when it lands.
Package: internal/coreruleset, whose doc says it runs the Core Rule Set with sww's changes. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Title ending (closes #N) with this issue's number. Label the PR needs-review.
Model: opus-5-5
Part of https://git.eeqj.de/sneak/smallwebwaf/issues/212 (sneak: common self-hosted apps work out of the box, "etc"), the first of the next apps proposed at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-176996. Forgejo is Gitea's fork and is often run in its place.
**Definition of done**, one PR into `next`, following the shared plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023 (read both in full):
- Record Forgejo's current release, image pinned by digest, in Docker on this host: its pages signed in and out, sign-in, admin pages, its API with a token, `git` over HTTP (clone and push), the container and package registries if enabled by default, and uploads (attachments, avatars, release files). Nothing about running it is committed. Remove every container you start; stay under 3 GiB of RAM.
- First check which of the recorded requests Gitea's fixes (`internal/coreruleset/gitea.conf`) already let through. Add a `forgejo.conf` only for what differs; if nothing differs, say so in the PR body and make Gitea's fixes apply to Forgejo's requests in the narrowest way the code allows.
- `internal/coreruleset/testdata/forgejo-requests.txt` and a test as the other apps have: the recorded requests at the default settings, none refused; SQL injection, path traversal and script injection still refused in a query string and a body field on Forgejo's fields.
- `README.md` lists Forgejo as supported; `SPEC.md` lists its changes where it lists the others. The PR body names the version recorded and anything still refused.
- `SWW_APPS` (https://git.eeqj.de/sneak/smallwebwaf/pulls/225) is not on `next`; load the file as the other apps' files are loaded on `next`, and say in the PR body that 225 registers it when it lands.
Package: `internal/coreruleset`, whose doc says it runs the Core Rule Set with sww's changes. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Title ending ` (closes #N)` with this issue's number. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 08:11:54 +01:00
Built in #347, recorded on Forgejo 17.0.1. Two things differ from gitea: the flash message cookie is named flash, and Forgejo has a wiki search. The recording also showed two gaps in gitea's name-search fixes. Still refused: ls -la in the repository filter on a user's or organisation's page, and file and branch names in bodies while bodies are read (#346).
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/347, recorded on Forgejo 17.0.1. Two things differ from gitea: the flash message cookie is named `flash`, and Forgejo has a wiki search. The recording also showed two gaps in gitea's name-search fixes. Still refused: `ls -la` in the repository filter on a user's or organisation's page, and file and branch names in bodies while bodies are read (https://git.eeqj.de/sneak/smallwebwaf/issues/346).
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #212 (sneak: common self-hosted apps work out of the box, "etc"), the first of the next apps proposed at #212 (comment). Forgejo is Gitea's fork and is often run in its place.
Definition of done, one PR into
next, following the shared plan at #212 (comment) and its addition at #212 (comment) (read both in full):gitover HTTP (clone and push), the container and package registries if enabled by default, and uploads (attachments, avatars, release files). Nothing about running it is committed. Remove every container you start; stay under 3 GiB of RAM.internal/coreruleset/gitea.conf) already let through. Add aforgejo.confonly for what differs; if nothing differs, say so in the PR body and make Gitea's fixes apply to Forgejo's requests in the narrowest way the code allows.internal/coreruleset/testdata/forgejo-requests.txtand a test as the other apps have: the recorded requests at the default settings, none refused; SQL injection, path traversal and script injection still refused in a query string and a body field on Forgejo's fields.README.mdlists Forgejo as supported;SPEC.mdlists its changes where it lists the others. The PR body names the version recorded and anything still refused.SWW_APPS(#225) is not onnext; load the file as the other apps' files are loaded onnext, and say in the PR body that 225 registers it when it lands.Package:
internal/coreruleset, whose doc says it runs the Core Rule Set with sww's changes. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Title ending(closes #N)with this issue's number. Label the PRneeds-review.Model: opus-5-5
Built in #347, recorded on Forgejo 17.0.1. Two things differ from gitea: the flash message cookie is named
flash, and Forgejo has a wiki search. The recording also showed two gaps in gitea's name-search fixes. Still refused:ls -lain the repository filter on a user's or organisation's page, and file and branch names in bodies while bodies are read (#346).Model: opus-5-5