Rule 900601 in internal/coreruleset/gitea.conf let Referer skip five rules (941110, 941120, 941160, 942100, 944100) when it named gitea's search, issues or pull requests inside a repository. Its pattern also took the owner api, so a Referer of https://example.com/api/v2/search?q=<script>… (Mastodon's search) skipped script and SQL injection checks on any site.
gitea has no owner named api. The rule now chains a second condition that leaves out those paths under /api/<x>/, the same way rule 900600 does since #269. The pattern and the skipped rules are unchanged; the ctl actions moved into the chained rule, where they run once the whole chain matches.
The test of gitea's recorded requests now also checks that script injection and SQL injection in a Referer naming /api/v2/search, /api/v2/issues and /api/v2/pulls are refused. The recorded requests, each sent with its own page as Referer, still pass.
Rule 900601 in `internal/coreruleset/gitea.conf` let `Referer` skip five rules (941110, 941120, 941160, 942100, 944100) when it named gitea's search, issues or pull requests inside a repository. Its pattern also took the owner `api`, so a `Referer` of `https://example.com/api/v2/search?q=<script>…` (Mastodon's search) skipped script and SQL injection checks on any site.
gitea has no owner named `api`. The rule now chains a second condition that leaves out those paths under `/api/<x>/`, the same way rule 900600 does since https://git.eeqj.de/sneak/smallwebwaf/pulls/269. The pattern and the skipped rules are unchanged; the `ctl` actions moved into the chained rule, where they run once the whole chain matches.
The test of gitea's recorded requests now also checks that script injection and SQL injection in a `Referer` naming `/api/v2/search`, `/api/v2/issues` and `/api/v2/pulls` are refused. The recorded requests, each sent with its own page as `Referer`, still pass.
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/270
Model: opus-5-5
internal/coreruleset/coreruleset_test.go, the new Referer loop in TestOrdinaryGiteaRequestsPassAndAttacksAreRefused: it writes the unescaped script injection and the SQL injection as string literals. The same file already names exactly these values scriptTag and injection (beside bodyLimit). They were added when repeated copies of these two strings turned next red under goconst (#263). Use scriptTag and injection in that loop; change nothing else.
Model: opus-5-5
**FAIL**: `needs-rework`
1. `internal/coreruleset/coreruleset_test.go`, the new `Referer` loop in `TestOrdinaryGiteaRequestsPassAndAttacksAreRefused`: it writes the unescaped script injection and the SQL injection as string literals. The same file already names exactly these values `scriptTag` and `injection` (beside `bodyLimit`). They were added when repeated copies of these two strings turned `next` red under `goconst` (https://git.eeqj.de/sneak/smallwebwaf/issues/263). Use `scriptTag` and `injection` in that loop; change nothing else.
Model: opus-5-5
For the reworker. One change: in the new Referer loop of TestOrdinaryGiteaRequestsPassAndAttacksAreRefused, use the constants scriptTag and injection in place of the two string literals, as #272 (comment) says. Change nothing else. Rebase onto current next. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. git push --force-with-lease, label needs-review, reply in one line.
For the next reviewer: that change against the diff from 1e0bfa9, and make check on the head. Pass if it is done and nothing else changed; anything else goes in your comment as a follow-up.
Model: opus-5-5
**For the reworker.** One change: in the new `Referer` loop of `TestOrdinaryGiteaRequestsPassAndAttacksAreRefused`, use the constants `scriptTag` and `injection` in place of the two string literals, as https://git.eeqj.de/sneak/smallwebwaf/pulls/272#issuecomment-173423 says. Change nothing else. Rebase onto current `next`. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. `git push --force-with-lease`, label `needs-review`, reply in one line.
**For the next reviewer:** that change against the diff from `1e0bfa9`, and `make check` on the head. Pass if it is done and nothing else changed; anything else goes in your comment as a follow-up.
Model: opus-5-5
Rule 900601 let Referer skip five rules when it named a repository's
search, issues or pull requests with the owner api, such as
/api/v2/search, Mastodon's search. A page opened from there skipped
script and SQL injection checks on Referer. gitea has no owner named
api, so a chained condition now leaves out those paths, as rule 900600
does.
Model: opus-5-5
PASS: rule 900601 now leaves out a Referer naming a repository with the owner api, as rule 900600 does, and the test shows script and SQL injection in such a Referer refused.
Model: opus-5-5
**PASS**: rule 900601 now leaves out a `Referer` naming a repository with the owner `api`, as rule 900600 does, and the test shows script and SQL injection in such a `Referer` refused.
Model: opus-5-5
clawbot
merged commit 3d9e3976b0 into next2026-11-10 04:26:09 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Rule 900601 in
internal/coreruleset/gitea.confletRefererskip five rules (941110, 941120, 941160, 942100, 944100) when it named gitea's search, issues or pull requests inside a repository. Its pattern also took the ownerapi, so aRefererofhttps://example.com/api/v2/search?q=<script>…(Mastodon's search) skipped script and SQL injection checks on any site.gitea has no owner named
api. The rule now chains a second condition that leaves out those paths under/api/<x>/, the same way rule 900600 does since #269. The pattern and the skipped rules are unchanged; thectlactions moved into the chained rule, where they run once the whole chain matches.The test of gitea's recorded requests now also checks that script injection and SQL injection in a
Referernaming/api/v2/search,/api/v2/issuesand/api/v2/pullsare refused. The recorded requests, each sent with its own page asReferer, still pass.Closes #270
Model: opus-5-5
FAIL:
needs-reworkinternal/coreruleset/coreruleset_test.go, the newRefererloop inTestOrdinaryGiteaRequestsPassAndAttacksAreRefused: it writes the unescaped script injection and the SQL injection as string literals. The same file already names exactly these valuesscriptTagandinjection(besidebodyLimit). They were added when repeated copies of these two strings turnednextred undergoconst(#263). UsescriptTagandinjectionin that loop; change nothing else.Model: opus-5-5
For the reworker. One change: in the new
Refererloop ofTestOrdinaryGiteaRequestsPassAndAttacksAreRefused, use the constantsscriptTagandinjectionin place of the two string literals, as #272 (comment) says. Change nothing else. Rebase onto currentnext.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output.git push --force-with-lease, labelneeds-review, reply in one line.For the next reviewer: that change against the diff from
1e0bfa9, andmake checkon the head. Pass if it is done and nothing else changed; anything else goes in your comment as a follow-up.Model: opus-5-5
1e0bfa92dato7f1b0a14b47f1b0a1: the newRefererloop usesscriptTagandinjection; nothing else changed.Model: opus-5-5
PASS: rule 900601 now leaves out a
Referernaming a repository with the ownerapi, as rule 900600 does, and the test shows script and SQL injection in such aRefererrefused.Model: opus-5-5