Found while recording Forgejo for #342. While SWW_WAF_BODY_LIMIT is set, the Core Rule Set refuses ordinary gitea and Forgejo requests that carry a file or branch name in a form or JSON body. At the default settings no body is read, so they pass.
Refused requests, each with the field, the value and the rule (paths for a repository alice/tools):
the web editor's save, new file and delete (/alice/tools/_edit/..., _new/..., _delete/...): tree_path or commit_summary holding docker-compose.yml, docs/python3-setup.md, .htaccess or scripts/install-script.sh (930120, 932120, 932235, 932260);
creating a branch on the web (/alice/tools/branches/_new/branch/main) and renaming one (/alice/tools/settings/rename_branch): new_branch_name, from and to holding docker-build or feat/docker-support (932260);
the API's new branch (POST /api/v1/repos/alice/tools/branches), new_branch_name holding python3-docs, and new pull request (POST .../pulls), head holding feat/docker-support (932260);
the API's new file (POST .../contents/scripts/powershell-build.ps1), message holding PowerShell (932120).
The recorded requests are in internal/coreruleset/testdata/forgejo-requests.txt. TestGiteaBodiesTheCoreRuleSetRefuses already shows two such gitea bodies.
Model: opus-5-5
Found while recording Forgejo for https://git.eeqj.de/sneak/smallwebwaf/issues/342. While `SWW_WAF_BODY_LIMIT` is set, the Core Rule Set refuses ordinary gitea and Forgejo requests that carry a file or branch name in a form or JSON body. At the default settings no body is read, so they pass.
Refused requests, each with the field, the value and the rule (paths for a repository `alice/tools`):
- the web editor's save, new file and delete (`/alice/tools/_edit/...`, `_new/...`, `_delete/...`): `tree_path` or `commit_summary` holding `docker-compose.yml`, `docs/python3-setup.md`, `.htaccess` or `scripts/install-script.sh` (930120, 932120, 932235, 932260);
- creating a branch on the web (`/alice/tools/branches/_new/branch/main`) and renaming one (`/alice/tools/settings/rename_branch`): `new_branch_name`, `from` and `to` holding `docker-build` or `feat/docker-support` (932260);
- the API's new branch (`POST /api/v1/repos/alice/tools/branches`), `new_branch_name` holding `python3-docs`, and new pull request (`POST .../pulls`), `head` holding `feat/docker-support` (932260);
- the API's new file (`POST .../contents/scripts/powershell-build.ps1`), `message` holding `PowerShell` (932120).
The recorded requests are in `internal/coreruleset/testdata/forgejo-requests.txt`. `TestGiteaBodiesTheCoreRuleSetRefuses` already shows two such gitea bodies.
Model: opus-5-5
Plan. Starts after #347 (Forgejo) lands, since both change gitea.conf and forgejo.conf. One PR into next under the shared plan at #212 (comment) and its addition: each body field above (tree_path, commit_summary, new_branch_name, from, to, head, message) skips only the rules listed for it, only on the paths listed, for gitea and Forgejo. A test sends the recorded bodies with SWW_WAF_BODY_LIMIT set and none is refused, and ; wget http://example.com/x.sh and a path traversal are still refused in each of those fields. SPEC.md lists the change where it lists the others. Package: internal/coreruleset. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Title ending (closes #346). Label the PR needs-review.
Model: opus-5-5
**Plan.** Starts after https://git.eeqj.de/sneak/smallwebwaf/pulls/347 (Forgejo) lands, since both change `gitea.conf` and `forgejo.conf`. One PR into `next` under the shared plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition: each body field above (`tree_path`, `commit_summary`, `new_branch_name`, `from`, `to`, `head`, `message`) skips only the rules listed for it, only on the paths listed, for gitea and Forgejo. A test sends the recorded bodies with `SWW_WAF_BODY_LIMIT` set and none is refused, and `; wget http://example.com/x.sh` and a path traversal are still refused in each of those fields. `SPEC.md` lists the change where it lists the others. Package: `internal/coreruleset`. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Title ending ` (closes #346)`. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 09:28:18 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found while recording Forgejo for #342. While
SWW_WAF_BODY_LIMITis set, the Core Rule Set refuses ordinary gitea and Forgejo requests that carry a file or branch name in a form or JSON body. At the default settings no body is read, so they pass.Refused requests, each with the field, the value and the rule (paths for a repository
alice/tools):/alice/tools/_edit/...,_new/...,_delete/...):tree_pathorcommit_summaryholdingdocker-compose.yml,docs/python3-setup.md,.htaccessorscripts/install-script.sh(930120, 932120, 932235, 932260);/alice/tools/branches/_new/branch/main) and renaming one (/alice/tools/settings/rename_branch):new_branch_name,fromandtoholdingdocker-buildorfeat/docker-support(932260);POST /api/v1/repos/alice/tools/branches),new_branch_nameholdingpython3-docs, and new pull request (POST .../pulls),headholdingfeat/docker-support(932260);POST .../contents/scripts/powershell-build.ps1),messageholdingPowerShell(932120).The recorded requests are in
internal/coreruleset/testdata/forgejo-requests.txt.TestGiteaBodiesTheCoreRuleSetRefusesalready shows two such gitea bodies.Model: opus-5-5
Plan. Starts after #347 (Forgejo) lands, since both change
gitea.confandforgejo.conf. One PR intonextunder the shared plan at #212 (comment) and its addition: each body field above (tree_path,commit_summary,new_branch_name,from,to,head,message) skips only the rules listed for it, only on the paths listed, for gitea and Forgejo. A test sends the recorded bodies withSWW_WAF_BODY_LIMITset and none is refused, and; wget http://example.com/x.shand a path traversal are still refused in each of those fields.SPEC.mdlists the change where it lists the others. Package:internal/coreruleset. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Title ending(closes #346). Label the PRneeds-review.Model: opus-5-5