Part of #212. Found while recording Forgejo for #342, in #347.
At the default settings, the Core Rule Set refuses ls -la in the repository filter on a user's or organisation's page, on gitea and Forgejo. Rule 932250 (Unix commands) matches it in q:
a user's page: GET /alice?tab=repositories&q=ls%20-la;
an organisation's page: GET /acme?q=ls%20-la&sort=recentupdate.
These pages have a path of one segment, as other apps' pages such as /index.php do. On every such path, internal/coreruleset/gitea.conf lets q skip 930120, 932120 and 932260 but not 932250, so that /index.php?q=ls -la stays refused. An organisation's page sends no tab parameter.
The Forgejo recording from #347, internal/coreruleset/testdata/forgejo-requests.txt, holds the other searches on these pages, but not these two.
Model: opus-5-5
Part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. Found while recording Forgejo for https://git.eeqj.de/sneak/smallwebwaf/issues/342, in https://git.eeqj.de/sneak/smallwebwaf/pulls/347.
At the default settings, the Core Rule Set refuses `ls -la` in the repository filter on a user's or organisation's page, on gitea and Forgejo. Rule 932250 (Unix commands) matches it in `q`:
- a user's page: `GET /alice?tab=repositories&q=ls%20-la`;
- an organisation's page: `GET /acme?q=ls%20-la&sort=recentupdate`.
These pages have a path of one segment, as other apps' pages such as `/index.php` do. On every such path, `internal/coreruleset/gitea.conf` lets `q` skip 930120, 932120 and 932260 but not 932250, so that `/index.php?q=ls -la` stays refused. An organisation's page sends no `tab` parameter.
The Forgejo recording from https://git.eeqj.de/sneak/smallwebwaf/pulls/347, `internal/coreruleset/testdata/forgejo-requests.txt`, holds the other searches on these pages, but not these two.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 09:35:45 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #212. Found while recording Forgejo for #342, in #347.
At the default settings, the Core Rule Set refuses
ls -lain the repository filter on a user's or organisation's page, on gitea and Forgejo. Rule 932250 (Unix commands) matches it inq:GET /alice?tab=repositories&q=ls%20-la;GET /acme?q=ls%20-la&sort=recentupdate.These pages have a path of one segment, as other apps' pages such as
/index.phpdo. On every such path,internal/coreruleset/gitea.confletsqskip 930120, 932120 and 932260 but not 932250, so that/index.php?q=ls -lastays refused. An organisation's page sends notabparameter.The Forgejo recording from #347,
internal/coreruleset/testdata/forgejo-requests.txt, holds the other searches on these pages, but not these two.Model: opus-5-5