Adds internal/coreruleset/nextcloud.conf, the twelfth change, loaded last since #225 has not landed. Whichever of this and #268 lands second renumbers.
Recorded from Nextcloud 35.0.2 (nextcloud@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2, SQLite): web pages signed in and out, sign-in, the Files app, admin and personal settings, public shares, nextcloudcmd 3.16.7 with chunked uploads, and the OCS API. The recorded requests pass at the defaults and while bodies are read.
What it changes:
WebDAV paths (/remote.php/dav/, /public.php/dav/, and the older webdav/ ones) allow PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT and SEARCH.
The four command and system-file rules (930120, 932120, 932250, 932260) are skipped on:
the cookie nc_username, on every path, since it names the account on every request (an account named python3 was refused everywhere);
theming value, the text editor's filePath, a new tag's name, and the XML of the Files app's SEARCH.
Comments (JSON and the PROPPATCH edit) and the text editor's autosaveContent also skip 932125 and 932230.
Disclosures:
An ordinary request on another field can still be refused.
932235 stays, so a comment with a command name right after a ;, such as powershell; python3, is refused.
LOCK and UNLOCK stay refused; nothing recorded used them.
Model: opus-5-5
Adds `internal/coreruleset/nextcloud.conf`, the twelfth change, loaded last since https://git.eeqj.de/sneak/smallwebwaf/pulls/225 has not landed. Whichever of this and https://git.eeqj.de/sneak/smallwebwaf/pulls/268 lands second renumbers.
Recorded from Nextcloud 35.0.2 (`nextcloud@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2`, SQLite): web pages signed in and out, sign-in, the Files app, admin and personal settings, public shares, `nextcloudcmd` 3.16.7 with chunked uploads, and the OCS API. The recorded requests pass at the defaults and while bodies are read.
What it changes:
- WebDAV paths (`/remote.php/dav/`, `/public.php/dav/`, and the older `webdav/` ones) allow `PROPFIND`, `PROPPATCH`, `MKCOL`, `COPY`, `MOVE`, `REPORT` and `SEARCH`.
- The four command and system-file rules (930120, 932120, 932250, 932260) are skipped on:
- the cookie `nc_username`, on every path, since it names the account on every request (an account named `python3` was refused everywhere);
- `/login`: `user`, `password`, `redirect_url`;
- `/apps/files/`: `dir`;
- public shares: `file`, `path`, `files`;
- OCS: `search`, `term`, `from`, `groupid`, `userid`, `displayName`, `groups[]`, `value`, `path`, `label`, `note`, `shareWith`, `message`;
- theming `value`, the text editor's `filePath`, a new tag's `name`, and the XML of the Files app's `SEARCH`.
- Comments (JSON and the `PROPPATCH` edit) and the text editor's `autosaveContent` also skip 932125 and 932230.
Disclosures:
- An ordinary request on another field can still be refused.
- 932235 stays, so a comment with a command name right after a `;`, such as `powershell; python3`, is refused.
- `LOCK` and `UNLOCK` stay refused; nothing recorded used them.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 05:17:19 +01:00
Adds nextcloud.conf, the twelfth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT and SEARCH. The account-name
cookie nc_username, and the fields that carry a search, a name, a file name or
a folder on the sign-in page, the Files app, public shares and the OCS API,
skip the four rules that read them as commands or system files. Comments and
the text editor's document skip the two rules for a command after a ";" too;
932235 keeps "; wget" refused. Requests recorded from Nextcloud 35.0.2, its
web pages, sync client 3.16.7 with chunked uploads and the OCS API, pass at
the defaults and while bodies are read.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds
internal/coreruleset/nextcloud.conf, the twelfth change, loaded last since #225 has not landed. Whichever of this and #268 lands second renumbers.Recorded from Nextcloud 35.0.2 (
nextcloud@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2, SQLite): web pages signed in and out, sign-in, the Files app, admin and personal settings, public shares,nextcloudcmd3.16.7 with chunked uploads, and the OCS API. The recorded requests pass at the defaults and while bodies are read.What it changes:
/remote.php/dav/,/public.php/dav/, and the olderwebdav/ones) allowPROPFIND,PROPPATCH,MKCOL,COPY,MOVE,REPORTandSEARCH.nc_username, on every path, since it names the account on every request (an account namedpython3was refused everywhere);/login:user,password,redirect_url;/apps/files/:dir;file,path,files;search,term,from,groupid,userid,displayName,groups[],value,path,label,note,shareWith,message;value, the text editor'sfilePath, a new tag'sname, and the XML of the Files app'sSEARCH.PROPPATCHedit) and the text editor'sautosaveContentalso skip 932125 and 932230.Disclosures:
;, such aspowershell; python3, is refused.LOCKandUNLOCKstay refused; nothing recorded used them.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.