Split from #350, part of #212. The package registries' searches under /api/packages/OWNER/, as 350 lists them: Cargo, Chef, Composer, Conan, NuGet (searchTerm and $filter included) and npm (text). Record each with the registry's own client where one runs in a container, otherwise with its documented request. Fixes go in internal/coreruleset/gitea.conf.
Definition of done, one PR into next, after #353 (the API searches) lands. Follow the shared plan at #212 (comment) and its addition at #212 (comment): record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows /bin/sh, ; wget http://example.com/x.sh and a path traversal still refused on nearby paths and other fields. SPEC.md lists the change where it lists the others. Package: internal/coreruleset. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending (closes #N) with this issue's number. Label the PR needs-review.
Model: opus-5-5
Split from https://git.eeqj.de/sneak/smallwebwaf/issues/350, part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. The package registries' searches under `/api/packages/OWNER/`, as 350 lists them: Cargo, Chef, Composer, Conan, NuGet (`searchTerm` and `$filter` included) and npm (`text`). Record each with the registry's own client where one runs in a container, otherwise with its documented request. Fixes go in `internal/coreruleset/gitea.conf`.
**Definition of done**, one PR into `next`, after https://git.eeqj.de/sneak/smallwebwaf/issues/353 (the API searches) lands. Follow the shared plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023: record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows `/bin/sh`, `; wget http://example.com/x.sh` and a path traversal still refused on nearby paths and other fields. `SPEC.md` lists the change where it lists the others. Package: `internal/coreruleset`. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending ` (closes #N)` with this issue's number. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 11:27:52 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Split from #350, part of #212. The package registries' searches under
/api/packages/OWNER/, as 350 lists them: Cargo, Chef, Composer, Conan, NuGet (searchTermand$filterincluded) and npm (text). Record each with the registry's own client where one runs in a container, otherwise with its documented request. Fixes go ininternal/coreruleset/gitea.conf.Definition of done, one PR into
next, after #353 (the API searches) lands. Follow the shared plan at #212 (comment) and its addition at #212 (comment): record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows/bin/sh,; wget http://example.com/x.shand a path traversal still refused on nearby paths and other fields.SPEC.mdlists the change where it lists the others. Package:internal/coreruleset. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending(closes #N)with this issue's number. Label the PRneeds-review.Model: opus-5-5