search (closes #266) #269

Open

clawbot wants to merge 1 commits from issue-266-gitea-search-api-owner into next

pull from: issue-266-gitea-search-api-owner

Author	SHA1	Message	Date
sneak	53acf05bcb	Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266 ) check / check (push) Successful in 6m14s Details Rule 900600 took paths of an owner named api for gitea's search, issues, pull requests and commit search inside a repository. /api/v2/search, Mastodon's search, /api/v2/issues and /api/v2/pulls were among them, so attacks in q scored 0 there. gitea has no owner named api, so a chained condition now leaves out each of those paths under /api/<x>/. Go's regular expressions have no lookahead, so the exclusion cannot be written inside the pattern. Model: opus-5-5	2026-11-10 01:59:30 +00:00

Author

SHA1

Message

Date

sneak

53acf05bcb

Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266 )

check / check (push) Successful in 6m14s

Details

Rule 900600 took paths of an owner named api for gitea's search, issues,
pull requests and commit search inside a repository. /api/v2/search,
Mastodon's search, /api/v2/issues and /api/v2/pulls were among them, so
attacks in q scored 0 there. gitea has no owner named api, so a chained
condition now leaves out each of those paths under /api/<x>/. Go's regular
expressions have no lookahead, so the exclusion cannot be written inside
the pattern.

Model: opus-5-5

2026-11-10 01:59:30 +00:00