Adds WordPress as the second app whose ordinary traffic the Core Rule Set lets through, per #212. internal/waf/wordpress.conf is the ninth change. testdata/wordpress-requests.txt holds requests recorded from WordPress 7.1.4 (image digest sha256:9001ea7dafd2bc3f05d068e6413b0edd2a116eeed4dfe9e08b6bd718dee4960a), driven by a headless Chrome and an API client.
At the default settings only one exclusion matters: X-HTTP-Method-Override under /wp-json/, which the block editor sends on every save. The others name body fields and apply only while SWW_WAF_BODY_LIMIT is set. The recorded requests are tested both ways.
Still refused while bodies are read: code in any field the recording did not refuse, such as a post title, or a signed-out comment.
Disclosures:
The recording keeps six static assets of each kind, because the full set exceeded the test time limit.
A signed-in comment was not recorded; the step failed in the driver. Signed-out comments and replies from the admin list were.
WordPress answered the application-password API calls 401. Rule outcomes do not depend on the answer, so the requests are kept.
?rest_route= addresses were not exercised, since WordPress picked /wp-json/ at install.
waf.go's load order will conflict with #225; whichever lands second adapts.
Model: opus-5-5
Adds WordPress as the second app whose ordinary traffic the Core Rule Set lets through, per https://git.eeqj.de/sneak/smallwebwaf/issues/212. `internal/waf/wordpress.conf` is the ninth change. `testdata/wordpress-requests.txt` holds requests recorded from WordPress 7.1.4 (image digest `sha256:9001ea7dafd2bc3f05d068e6413b0edd2a116eeed4dfe9e08b6bd718dee4960a`), driven by a headless Chrome and an API client.
At the default settings only one exclusion matters: `X-HTTP-Method-Override` under `/wp-json/`, which the block editor sends on every save. The others name body fields and apply only while `SWW_WAF_BODY_LIMIT` is set. The recorded requests are tested both ways.
Still refused while bodies are read: code in any field the recording did not refuse, such as a post title, or a signed-out comment.
Disclosures:
- The recording keeps six static assets of each kind, because the full set exceeded the test time limit.
- A signed-in comment was not recorded; the step failed in the driver. Signed-out comments and replies from the admin list were.
- WordPress answered the application-password API calls `401`. Rule outcomes do not depend on the answer, so the requests are kept.
- `?rest_route=` addresses were not exercised, since WordPress picked `/wp-json/` at install.
- `waf.go`'s load order will conflict with https://git.eeqj.de/sneak/smallwebwaf/pulls/225; whichever lands second adapts.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 07:07:34 +01:00
Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused recorded WordPress 7.1.4 traffic. Add the recorded requests,
a test at the defaults and reading bodies, and list WordPress in the README.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds WordPress as the second app whose ordinary traffic the Core Rule Set lets through, per #212.
internal/waf/wordpress.confis the ninth change.testdata/wordpress-requests.txtholds requests recorded from WordPress 7.1.4 (image digestsha256:9001ea7dafd2bc3f05d068e6413b0edd2a116eeed4dfe9e08b6bd718dee4960a), driven by a headless Chrome and an API client.At the default settings only one exclusion matters:
X-HTTP-Method-Overrideunder/wp-json/, which the block editor sends on every save. The others name body fields and apply only whileSWW_WAF_BODY_LIMITis set. The recorded requests are tested both ways.Still refused while bodies are read: code in any field the recording did not refuse, such as a post title, or a signed-out comment.
Disclosures:
401. Rule outcomes do not depend on the answer, so the requests are kept.?rest_route=addresses were not exercised, since WordPress picked/wp-json/at install.waf.go's load order will conflict with #225; whichever lands second adapts.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.