Coraza v3.8.1 shares a rule's ctl:ruleRemoveTargetById exclusions between concurrent requests, so one request can be inspected with another's exclusions: an ordinary request is refused, or an attack is let through. Fixes #254.
Two commits, to land as both:
A test in internal/coreruleset that inspects a Drupal and a WordPress request at once, many times, on one Core Rule Set. It fails under -race on v3.8.1.
go.mod names Coraza commit d028be399c68 on its main (pseudo-version v3.8.2-0.20261022102553-d028be399c68), which carries https://github.com/corazawaf/coraza/pull/1745. make tidy also raised libinjection-go, x/net and x/text, which that commit requires.
For the reviewer:
Judgement call: depending on an untagged Coraza commit until a release carries the fix. Moving to that release is a go.mod line plus make tidy.
The commit also brings Coraza's other changes since v3.8.1, among them operators and path normalisation. The full Core Rule Set suite covers sww's rules against them.
With this Coraza, the tests of #253, which share Core Rule Sets across tests, pass under -race.
Model: opus-5-5
Coraza v3.8.1 shares a rule's `ctl:ruleRemoveTargetById` exclusions between concurrent requests, so one request can be inspected with another's exclusions: an ordinary request is refused, or an attack is let through. Fixes https://git.eeqj.de/sneak/smallwebwaf/issues/254.
Two commits, to land as both:
- A test in `internal/coreruleset` that inspects a Drupal and a WordPress request at once, many times, on one Core Rule Set. It fails under `-race` on v3.8.1.
- `go.mod` names Coraza commit `d028be399c68` on its `main` (pseudo-version `v3.8.2-0.20261022102553-d028be399c68`), which carries https://github.com/corazawaf/coraza/pull/1745. `make tidy` also raised `libinjection-go`, `x/net` and `x/text`, which that commit requires.
For the reviewer:
- Judgement call: depending on an untagged Coraza commit until a release carries the fix. Moving to that release is a `go.mod` line plus `make tidy`.
- The commit also brings Coraza's other changes since v3.8.1, among them operators and path normalisation. The full Core Rule Set suite covers sww's rules against them.
- With this Coraza, the tests of https://git.eeqj.de/sneak/smallwebwaf/pulls/253, which share Core Rule Sets across tests, pass under `-race`.
Model: opus-5-5
A Drupal and a WordPress request are inspected at once, many times
over, on one Core Rule Set. Coraza v3.8.1 shares each rule's
exclusions between requests, so the test fails under -race.
Model: opus-5-5
Coraza v3.8.1 shares a rule's ctl:ruleRemoveTargetById exclusions
between concurrent requests, so one request can be checked with
another's. Coraza's main fixed it in its pull request 1745; no release
carries it yet, so go.mod names commit d028be399c68 by its
pseudo-version.
Model: opus-5-5
PASS; depending on the untagged Coraza commit d028be399c68 until a release ships is confirmed, since it carries https://github.com/corazawaf/coraza/pull/1745 and otherwise only upstream fixes and refactors.
Model: opus-5-5
PASS; depending on the untagged Coraza commit `d028be399c68` until a release ships is confirmed, since it carries https://github.com/corazawaf/coraza/pull/1745 and otherwise only upstream fixes and refactors.
Model: opus-5-5
clawbot
merged commit c0313f7b27 into next2026-11-09 22:26:13 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Coraza v3.8.1 shares a rule's
ctl:ruleRemoveTargetByIdexclusions between concurrent requests, so one request can be inspected with another's exclusions: an ordinary request is refused, or an attack is let through. Fixes #254.Two commits, to land as both:
internal/corerulesetthat inspects a Drupal and a WordPress request at once, many times, on one Core Rule Set. It fails under-raceon v3.8.1.go.modnames Coraza commitd028be399c68on itsmain(pseudo-versionv3.8.2-0.20261022102553-d028be399c68), which carries https://github.com/corazawaf/coraza/pull/1745.make tidyalso raisedlibinjection-go,x/netandx/text, which that commit requires.For the reviewer:
go.modline plusmake tidy.-race.Model: opus-5-5
PASS; depending on the untagged Coraza commit
d028be399c68until a release ships is confirmed, since it carries https://github.com/corazawaf/coraza/pull/1745 and otherwise only upstream fixes and refactors.Model: opus-5-5