Core Rule Set: adopting a repository named python3-app is refused while bodies are read #365

New Issue

2026-11-11T17:25:26+01:00

clawbot commented

2026-11-11 17:25:26 +01:00

Found in the review at #364 (comment). While SWW_WAF_BODY_LIMIT is set, the Core Rule Set refuses the admin form that adopts an unadopted repository when the repository's name holds a command name. At the default settings no body is read, so the form passes.

The form posts to /-/admin/repos/unadopted on gitea 1.27.3 and to /admin/repos/unadopted on Forgejo 17.0.1. Its body is form data such as id=alice%2Fpython3-app&action=adopt&q=&page=1, where id names the repository. On both paths:

alice/python3-app is refused by 932260;
alice/powershell-scripts is refused by 932120;
alice/legacy-site passes.

#364 lets q through in the same body, but not id.

Model: opus-5-5

Found in the review at https://git.eeqj.de/sneak/smallwebwaf/pulls/364#issuecomment-179438. While `SWW_WAF_BODY_LIMIT` is set, the Core Rule Set refuses the admin form that adopts an unadopted repository when the repository's name holds a command name. At the default settings no body is read, so the form passes. The form posts to `/-/admin/repos/unadopted` on gitea 1.27.3 and to `/admin/repos/unadopted` on Forgejo 17.0.1. Its body is form data such as `id=alice%2Fpython3-app&action=adopt&q=&page=1`, where `id` names the repository. On both paths: - `alice/python3-app` is refused by 932260; - `alice/powershell-scripts` is refused by 932120; - `alice/legacy-site` passes. https://git.eeqj.de/sneak/smallwebwaf/pulls/364 lets `q` through in the same body, but not `id`. Model: opus-5-5

clawbot referenced this issue

2026-11-11 17:25:43 +01:00

Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352) #364

clawbot referenced this issue from a commit

2026-11-12 01:57:39 +01:00

Core Rule Set: a repository's name passes in the adopt form's id (closes #365)

clawbot referenced a pull request that will close this issue

2026-11-12 02:00:42 +01:00

Core Rule Set: a repository's name passes in the adopt form's id (closes #365) #367

clawbot commented

2026-11-12 02:00:47 +01:00

#367, branch issue-365-adopt-form-repository-names: on both admin paths of unadopted repositories, id skips 930120, 932120 and 932260, so alice/python3-app, alice/powershell-scripts and alice/.profile pass in the adopt and delete forms.

Model: opus-5-5

https://git.eeqj.de/sneak/smallwebwaf/pulls/367, branch `issue-365-adopt-form-repository-names`: on both admin paths of unadopted repositories, `id` skips 930120, 932120 and 932260, so `alice/python3-app`, `alice/powershell-scripts` and `alice/.profile` pass in the adopt and delete forms. Model: opus-5-5

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#365

Core Rule Set: adopting a repository named python3-app is refused while bodies are read #365

Core Rule Set: adopting a repository named `python3-app` is refused while bodies are read #365