Rule 900600 in internal/coreruleset/gitea.conf took /api/v2/search, Mastodon's search, for gitea's search inside a repository (owner api, repository v2). So q skipped about 25 rules there, and SQL injection, script injection and ; wget … in q scored 0 at the defaults.
gitea has no owner named api. The rule now chains a second condition that leaves out /api/<x>/search. Its pattern and its list of skipped rules are unchanged; the list only moved into the chained rule, which is where ctl actions run once the whole chain matches.
The test of gitea's recorded requests now also checks that those three attacks in q are refused on /api/v2/search. Recorded repository searches still pass.
Not obvious from the diff:
The issue suggested (?!api/). Coraza uses Go's regular expressions, which have no lookahead, so that pattern does not load.
SPEC.md does not name the repository search path, so it is unchanged.
The Referer exclusion (900601) uses the same pattern, so a page opened from /api/v2/search?… skips five rules on Referer. It is out of this issue's scope: #270
Rule 900600 in `internal/coreruleset/gitea.conf` took `/api/v2/search`, Mastodon's search, for gitea's search inside a repository (owner `api`, repository `v2`). So `q` skipped about 25 rules there, and SQL injection, script injection and `; wget …` in `q` scored 0 at the defaults.
gitea has no owner named `api`. The rule now chains a second condition that leaves out `/api/<x>/search`. Its pattern and its list of skipped rules are unchanged; the list only moved into the chained rule, which is where `ctl` actions run once the whole chain matches.
The test of gitea's recorded requests now also checks that those three attacks in `q` are refused on `/api/v2/search`. Recorded repository searches still pass.
Not obvious from the diff:
- The issue suggested `(?!api/)`. Coraza uses Go's regular expressions, which have no lookahead, so that pattern does not load.
- `SPEC.md` does not name the repository search path, so it is unchanged.
- The Referer exclusion (900601) uses the same pattern, so a page opened from `/api/v2/search?…` skips five rules on `Referer`. It is out of this issue's scope: https://git.eeqj.de/sneak/smallwebwaf/issues/270
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/266
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 02:33:40 +01:00
Rule 900600 matched /api/v2/search, Mastodon's search, as gitea's search
inside a repository, so attacks in q scored 0 there. gitea has no owner
named api, so a chained condition now leaves out /api/<x>/search. Go's
regular expressions have no lookahead, so the exclusion cannot be written
inside the pattern.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Rule 900600 in
internal/coreruleset/gitea.conftook/api/v2/search, Mastodon's search, for gitea's search inside a repository (ownerapi, repositoryv2). Soqskipped about 25 rules there, and SQL injection, script injection and; wget …inqscored 0 at the defaults.gitea has no owner named
api. The rule now chains a second condition that leaves out/api/<x>/search. Its pattern and its list of skipped rules are unchanged; the list only moved into the chained rule, which is wherectlactions run once the whole chain matches.The test of gitea's recorded requests now also checks that those three attacks in
qare refused on/api/v2/search. Recorded repository searches still pass.Not obvious from the diff:
(?!api/). Coraza uses Go's regular expressions, which have no lookahead, so that pattern does not load.SPEC.mddoes not name the repository search path, so it is unchanged./api/v2/search?…skips five rules onReferer. It is out of this issue's scope: #270Closes #266
Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.