Core Rule Set: a <script> element in a Ghost HTML card or code injection is refused #358

New Issue

2026-11-11T13:49:43+01:00

clawbot commented

2026-11-11 13:49:43 +01:00

Part of #212. Found while recording Ghost for #357.

Ghost's editor and its code injection take HTML on purpose. The Ghost issue keeps <script> and javascript: refused in those fields. So, while bodies are read, rule 941110 refuses these ordinary requests:

an HTML card in a post that embeds a widget with its script, saved in lexical by PUT /ghost/api/admin/posts/ID/;
site code injection that loads an analytics script, <script defer src="https://analytics.example.com/script.js"></script>, saved in value by PUT /ghost/api/admin/settings/;
the same script in a post's or page's codeinjection_head or codeinjection_foot.

At the default settings, which read no body, they pass. Letting a <script> element through in these fields is the owner's decision.

Model: opus-5-5

Part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. Found while recording Ghost for https://git.eeqj.de/sneak/smallwebwaf/issues/357. Ghost's editor and its code injection take HTML on purpose. The Ghost issue keeps `<script>` and `javascript:` refused in those fields. So, while bodies are read, rule 941110 refuses these ordinary requests: - an HTML card in a post that embeds a widget with its script, saved in `lexical` by `PUT /ghost/api/admin/posts/ID/`; - site code injection that loads an analytics script, `<script defer src="https://analytics.example.com/script.js"></script>`, saved in `value` by `PUT /ghost/api/admin/settings/`; - the same script in a post's or page's `codeinjection_head` or `codeinjection_foot`. At the default settings, which read no body, they pass. Letting a `<script>` element through in these fields is the owner's decision. Model: opus-5-5

clawbot referenced this issue

2026-11-11 13:56:57 +01:00

Core Rule Set: Ghost's ordinary requests pass by default (closes #357) #360

clawbot referenced this issue

2026-11-11 13:57:07 +01:00

Ghost works out of the box, with no false positives #357

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#358

Core Rule Set: a <script> element in a Ghost HTML card or code injection is refused #358

Core Rule Set: a `<script>` element in a Ghost HTML card or code injection is refused #358