sneak/smallwebwaf
1
0 Fork 0
Code Issues 27 Pull Requests 7 Actions 78 Packages Projects Releases Wiki Activity

Core Rule Set: Ghost fields not yet recorded with the hard values #359

New Issue
Open
opened 2026-11-11 13:49:43 +01:00 by clawbot · 0 comments
clawbot commented 2026-11-11 13:49:43 +01:00
Collaborator
Copy link
Copy source

Part of #212. Found while recording Ghost for #357.

internal/coreruleset/ghost.conf lets through the Ghost fields recorded for that issue. These fields were not recorded with the hard values (python3, powershell, ls -la, .htaccess) and keep every rule, so an ordinary value in them can be refused:

  • members' comments: html in the body and filter in the query of /members/api/comments/;
  • staff users: name, bio, location and website in PUT /ghost/api/admin/users/ID/, and the address of a staff invitation;
  • names and descriptions of tiers, offers and recommendations;
  • a tag's code injection and meta fields, and a post's feature_image_caption and feature_image_alt;
  • the members' CSV import;
  • the query fields of the analytics pages, such as pathname and source, and email_segment when a post is sent as a newsletter;
  • ActivityPub under /.ghost/activitypub/.

One recorded field is still refused with some values: filter, when a value joins command names with &. The admin's post picker sends title:~'powershell & python3' when a person types that title, and 932235 and 932260 refuse it.

Model: opus-5-5

Part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. Found while recording Ghost for https://git.eeqj.de/sneak/smallwebwaf/issues/357. `internal/coreruleset/ghost.conf` lets through the Ghost fields recorded for that issue. These fields were not recorded with the hard values (`python3`, `powershell`, `ls -la`, `.htaccess`) and keep every rule, so an ordinary value in them can be refused: - members' comments: `html` in the body and `filter` in the query of `/members/api/comments/`; - staff users: `name`, `bio`, `location` and `website` in `PUT /ghost/api/admin/users/ID/`, and the address of a staff invitation; - names and descriptions of tiers, offers and recommendations; - a tag's code injection and meta fields, and a post's `feature_image_caption` and `feature_image_alt`; - the members' CSV import; - the query fields of the analytics pages, such as `pathname` and `source`, and `email_segment` when a post is sent as a newsletter; - ActivityPub under `/.ghost/activitypub/`. One recorded field is still refused with some values: `filter`, when a value joins command names with `&`. The admin's post picker sends `title:~'powershell & python3'` when a person types that title, and 932235 and 932260 refuse it. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
Reviewed and ready for the owner to merge
 needs-checks
Checks must be fixed before review
 needs-rebase
Conflicts with next; rebase required
 needs-review
Review not yet done
 needs-rework
Review found issues to fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#359