Part of #212 (sneak: common self-hosted apps work out of the box), the second of the next apps proposed at #212 (comment). Ghost is a blog whose editor posts whole articles, HTML included, to its admin API.
Definition of done, one PR into next, following the shared plan at #212 (comment) and its addition at #212 (comment) (read both in full, and #347 as the latest example):
Record Ghost's current release, image pinned by digest, in Docker on this host: its public pages, members' sign-up and sign-in, the admin (Ghost's own path, /ghost/) signed in, the editor saving and publishing posts and pages with headings, links, images, code blocks and embedded HTML, tags, settings, staff invitations, image and theme uploads, the Content API with its key and the Admin API with a token, and the newsletter settings. Nothing about running it is committed. Remove every container you start; stay under 3 GiB of RAM.
From Ghost's source, list every query field that carries a search, a filter, a slug or a name, and every body field that carries an article; record each with the hard values.
internal/coreruleset/ghost.conf holds Ghost's fixes, each as narrow as the plan says; testdata/ghost-requests.txt and a test as the other apps have, plus a narrowness test; SQL injection, path traversal and script injection still refused in a query string and a body field on Ghost's paths.
Ghost's editor posts HTML on purpose. Where a field must carry HTML, say in the PR body which script-injection rules it skips and that <script> and javascript: stay refused, as for the password fields; if a rule cannot be kept without refusing an ordinary article, name it as a judgement call.
README.md lists Ghost; SPEC.md lists its changes where it lists the others. The PR body names the version recorded and anything still refused, each tracked in an issue under #212.
SWW_APPS (#225) is not on next; load ghost.conf as the other apps' files are loaded on next, and use rule ids no rule on next or in an open PR uses.
Package: internal/coreruleset. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Title ending (closes #N) with this issue's number. Label the PR needs-review.
Model: opus-5-5
Part of https://git.eeqj.de/sneak/smallwebwaf/issues/212 (sneak: common self-hosted apps work out of the box), the second of the next apps proposed at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-176996. Ghost is a blog whose editor posts whole articles, HTML included, to its admin API.
**Definition of done**, one PR into `next`, following the shared plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023 (read both in full, and https://git.eeqj.de/sneak/smallwebwaf/pulls/347 as the latest example):
- Record Ghost's current release, image pinned by digest, in Docker on this host: its public pages, members' sign-up and sign-in, the admin (Ghost's own path, `/ghost/`) signed in, the editor saving and publishing posts and pages with headings, links, images, code blocks and embedded HTML, tags, settings, staff invitations, image and theme uploads, the Content API with its key and the Admin API with a token, and the newsletter settings. Nothing about running it is committed. Remove every container you start; stay under 3 GiB of RAM.
- From Ghost's source, list every query field that carries a search, a filter, a slug or a name, and every body field that carries an article; record each with the hard values.
- `internal/coreruleset/ghost.conf` holds Ghost's fixes, each as narrow as the plan says; `testdata/ghost-requests.txt` and a test as the other apps have, plus a narrowness test; SQL injection, path traversal and script injection still refused in a query string and a body field on Ghost's paths.
- Ghost's editor posts HTML on purpose. Where a field must carry HTML, say in the PR body which script-injection rules it skips and that `<script>` and `javascript:` stay refused, as for the password fields; if a rule cannot be kept without refusing an ordinary article, name it as a judgement call.
- `README.md` lists Ghost; `SPEC.md` lists its changes where it lists the others. The PR body names the version recorded and anything still refused, each tracked in an issue under https://git.eeqj.de/sneak/smallwebwaf/issues/212.
- `SWW_APPS` (https://git.eeqj.de/sneak/smallwebwaf/pulls/225) is not on `next`; load `ghost.conf` as the other apps' files are loaded on `next`, and use rule ids no rule on `next` or in an open PR uses.
Package: `internal/coreruleset`. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Title ending ` (closes #N)` with this issue's number. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 12:48:16 +01:00
Rule ids. Three other open PRs add Core Rule Set rules, and two of them clashed on ids. Ghost's rules take a block of their own: 901000 to 901099. Check with a search that next and the open PRs (#225, #355, #356) use none of them before you push; if one is taken, say so in the PR body and take the next free block of a hundred.
Model: opus-5-5
**Rule ids.** Three other open PRs add Core Rule Set rules, and two of them clashed on ids. Ghost's rules take a block of their own: `901000` to `901099`. Check with a search that `next` and the open PRs (https://git.eeqj.de/sneak/smallwebwaf/pulls/225, https://git.eeqj.de/sneak/smallwebwaf/pulls/355, https://git.eeqj.de/sneak/smallwebwaf/pulls/356) use none of them before you push; if one is taken, say so in the PR body and take the next free block of a hundred.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/360: Ghost 6.76.0 recorded, its fixes in `internal/coreruleset/ghost.conf`. Still refused, tracked under https://git.eeqj.de/sneak/smallwebwaf/issues/212:
- `<script>` in an HTML card or code injection: https://git.eeqj.de/sneak/smallwebwaf/issues/358;
- fields not recorded with the hard values: https://git.eeqj.de/sneak/smallwebwaf/issues/359.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #212 (sneak: common self-hosted apps work out of the box), the second of the next apps proposed at #212 (comment). Ghost is a blog whose editor posts whole articles, HTML included, to its admin API.
Definition of done, one PR into
next, following the shared plan at #212 (comment) and its addition at #212 (comment) (read both in full, and #347 as the latest example):/ghost/) signed in, the editor saving and publishing posts and pages with headings, links, images, code blocks and embedded HTML, tags, settings, staff invitations, image and theme uploads, the Content API with its key and the Admin API with a token, and the newsletter settings. Nothing about running it is committed. Remove every container you start; stay under 3 GiB of RAM.internal/coreruleset/ghost.confholds Ghost's fixes, each as narrow as the plan says;testdata/ghost-requests.txtand a test as the other apps have, plus a narrowness test; SQL injection, path traversal and script injection still refused in a query string and a body field on Ghost's paths.<script>andjavascript:stay refused, as for the password fields; if a rule cannot be kept without refusing an ordinary article, name it as a judgement call.README.mdlists Ghost;SPEC.mdlists its changes where it lists the others. The PR body names the version recorded and anything still refused, each tracked in an issue under #212.SWW_APPS(#225) is not onnext; loadghost.confas the other apps' files are loaded onnext, and use rule ids no rule onnextor in an open PR uses.Package:
internal/coreruleset. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Title ending(closes #N)with this issue's number. Label the PRneeds-review.Model: opus-5-5
Rule ids. Three other open PRs add Core Rule Set rules, and two of them clashed on ids. Ghost's rules take a block of their own:
901000to901099. Check with a search thatnextand the open PRs (#225, #355, #356) use none of them before you push; if one is taken, say so in the PR body and take the next free block of a hundred.Model: opus-5-5
Built in #360: Ghost 6.76.0 recorded, its fixes in
internal/coreruleset/ghost.conf. Still refused, tracked under #212:<script>in an HTML card or code injection: #358;Model: opus-5-5