Core Rule Set: a Ghost post's or page's canonical URL is refused when it names a command or a file #374

New Issue

2026-11-12T07:23:54+01:00

clawbot commented

2026-11-12 07:23:54 +01:00

Part of #212. Found in review of #369, which lets a tag's canonical_url through; this builds on it.

The canonical URL of a post or a page keeps every rule. The admin sends it as canonical_url whenever it saves a post or a page, at /ghost/api/admin/posts/ID/ and /ghost/api/admin/pages/ID/. Two rules refuse ordinary addresses in it:

932120 refuses https://example.com/blog/powershell/;
930120 refuses https://example.com/blog/.htaccess/.

To fix:

in internal/coreruleset/ghost.conf, make json.posts.N.canonical_url and json.pages.N.canonical_url skip 930120 and 932120 under /ghost/api/admin/posts/ and /ghost/api/admin/pages/, as url and a tag's canonical_url do, and only when the query has no field of that name;
record a post saved with such an address, sent to Ghost 6.76.0, in internal/coreruleset/testdata/ghost-requests.txt;
add a test, a narrowness case and a line in SPEC.md.

Model: opus-5-5

Part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. Found in review of https://git.eeqj.de/sneak/smallwebwaf/pulls/369, which lets a tag's `canonical_url` through; this builds on it. The canonical URL of a post or a page keeps every rule. The admin sends it as `canonical_url` whenever it saves a post or a page, at `/ghost/api/admin/posts/ID/` and `/ghost/api/admin/pages/ID/`. Two rules refuse ordinary addresses in it: - 932120 refuses `https://example.com/blog/powershell/`; - 930120 refuses `https://example.com/blog/.htaccess/`. To fix: - in `internal/coreruleset/ghost.conf`, make `json.posts.N.canonical_url` and `json.pages.N.canonical_url` skip 930120 and 932120 under `/ghost/api/admin/posts/` and `/ghost/api/admin/pages/`, as `url` and a tag's `canonical_url` do, and only when the query has no field of that name; - record a post saved with such an address, sent to Ghost 6.76.0, in `internal/coreruleset/testdata/ghost-requests.txt`; - add a test, a narrowness case and a line in `SPEC.md`. Model: opus-5-5

clawbot referenced this issue

2026-11-12 07:25:37 +01:00

Core Rule Set: Ghost's remaining fields pass with words that name commands (closes #359) #369

clawbot referenced this issue from a commit

2026-11-12 07:35:34 +01:00

Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374)

clawbot referenced a pull request that will close this issue

2026-11-12 07:35:50 +01:00

Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374) #376

clawbot commented

2026-11-12 07:35:59 +01:00

#376, branch issue-374-ghost-canonical-url: the canonical URL of a post or a page skips 930120 and 932120, each only on its own path under /ghost/api/admin/posts/ or /ghost/api/admin/pages/. A post save and a page save sent to Ghost 6.76.0 are recorded.

Cut from next alone, since #369 is still open; SPEC.md and ghost_test.go conflict textually with it, and whichever lands second resolves.

Model: opus-5-5

https://git.eeqj.de/sneak/smallwebwaf/pulls/376, branch `issue-374-ghost-canonical-url`: the canonical URL of a post or a page skips 930120 and 932120, each only on its own path under `/ghost/api/admin/posts/` or `/ghost/api/admin/pages/`. A post save and a page save sent to Ghost 6.76.0 are recorded. - Cut from `next` alone, since https://git.eeqj.de/sneak/smallwebwaf/pulls/369 is still open; `SPEC.md` and `ghost_test.go` conflict textually with it, and whichever lands second resolves. Model: opus-5-5

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#374