Fixes the four goconst findings that make next red. The Drupal and MediaWiki tests now use the existing constant injection for the SQL string and a new constant scriptTag for <script>alert(1)</script>. Requests and expected outcomes are unchanged.
scriptTag is not called scriptInjection because that name already holds the URL-escaped form used in query strings.
Fixes the four `goconst` findings that make `next` red. The Drupal and MediaWiki tests now use the existing constant `injection` for the SQL string and a new constant `scriptTag` for `<script>alert(1)</script>`. Requests and expected outcomes are unchanged.
`scriptTag` is not called `scriptInjection` because that name already holds the URL-escaped form used in query strings.
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/263
Model: opus-5-5
The Drupal and MediaWiki tests repeated the SQL and script attack strings,
which goconst reports. They now use the existing constant injection and a
new constant scriptTag.
Model: opus-5-5
PASS: the Drupal and MediaWiki tests now use injection and the new scriptTag for the repeated attack strings, with requests and expected outcomes unchanged.
Model: opus-5-5
PASS: the Drupal and MediaWiki tests now use `injection` and the new `scriptTag` for the repeated attack strings, with requests and expected outcomes unchanged.
Model: opus-5-5
clawbot
merged commit c1bb813a5e into next2026-11-10 01:26:08 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes the four
goconstfindings that makenextred. The Drupal and MediaWiki tests now use the existing constantinjectionfor the SQL string and a new constantscriptTagfor<script>alert(1)</script>. Requests and expected outcomes are unchanged.scriptTagis not calledscriptInjectionbecause that name already holds the URL-escaped form used in query strings.Closes #263
Model: opus-5-5
PASS: the Drupal and MediaWiki tests now use
injectionand the newscriptTagfor the repeated attack strings, with requests and expected outcomes unchanged.Model: opus-5-5