Recorded from Nextcloud 35.0.2 (nextcloud@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2) with Calendar 6.6.5 and Contacts 8.9.5 in a headless Chrome, plus requests imitating DAVx5: a calendar and an address book made, an event and a contact added, changed and deleted, and the client's PROPFIND and REPORT. Names, titles, locations and descriptions hold python3, powershell, ls -la and .htaccess.
What changed:
rproxy passes MKCALENDAR on.
nextcloud.conf:
MKCALENDAR allowed on /remote.php/dav/calendars/ only;
PROPFIND allowed on /.well-known/caldav and /.well-known/carddav, the client's discovery;
the XML of an MKCOL on the calendar and address book paths skips 930120, 932120, 932250 and 932260;
the XML of an MKCALENDAR skips those and 932125 and 932230, which refused its description Powershell and python3 meetings; ls -la first;
a PUT typed text/calendar or text/vcard there skips 920530.
SPEC.md names the paths, bodies and MKCALENDAR.
What the diff does not show:
920530 refused every change of an event or a contact in the web apps: they send text/calendar; charset=UTF-8; component=vevent; charset=UTF-8.
Event and contact bodies were already unread (PUT on the WebDAV paths), so titles, locations and names needed no exclusion.
SQL injection, path traversal, script injection and ; wget … stay refused in the names and descriptions, with tests.
Disclosures:
An ordinary request on a field not recorded can still be refused; renaming a calendar (PROPPATCH) was not recorded.
The DAVx5 requests come from an HTTP client sending DAVx5's bodies and headers.
Tests ran go test on internal/coreruleset directly while iterating, as the standing rules allow; AGENTS.md says never.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/280.
Recorded from Nextcloud 35.0.2 (`nextcloud@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2`) with Calendar 6.6.5 and Contacts 8.9.5 in a headless Chrome, plus requests imitating DAVx5: a calendar and an address book made, an event and a contact added, changed and deleted, and the client's `PROPFIND` and `REPORT`. Names, titles, locations and descriptions hold `python3`, `powershell`, `ls -la` and `.htaccess`.
What changed:
- `rproxy` passes `MKCALENDAR` on.
- `nextcloud.conf`:
- `MKCALENDAR` allowed on `/remote.php/dav/calendars/` only;
- `PROPFIND` allowed on `/.well-known/caldav` and `/.well-known/carddav`, the client's discovery;
- the XML of an `MKCOL` on the calendar and address book paths skips 930120, 932120, 932250 and 932260;
- the XML of an `MKCALENDAR` skips those and 932125 and 932230, which refused its description `Powershell and python3 meetings; ls -la first`;
- a `PUT` typed `text/calendar` or `text/vcard` there skips 920530.
- `SPEC.md` names the paths, bodies and `MKCALENDAR`.
What the diff does not show:
- 920530 refused every change of an event or a contact in the web apps: they send `text/calendar; charset=UTF-8; component=vevent; charset=UTF-8`.
- Event and contact bodies were already unread (`PUT` on the WebDAV paths), so titles, locations and names needed no exclusion.
- SQL injection, path traversal, script injection and `; wget …` stay refused in the names and descriptions, with tests.
Disclosures:
- An ordinary request on a field not recorded can still be refused; renaming a calendar (`PROPPATCH`) was not recorded.
- The DAVx5 requests come from an HTTP client sending DAVx5's bodies and headers.
- Tests ran `go test` on `internal/coreruleset` directly while iterating, as the standing rules allow; `AGENTS.md` says never.
Model: opus-5-5
rproxy passes MKCALENDAR on. nextcloud.conf allows it on
/remote.php/dav/calendars/ and PROPFIND on /.well-known/caldav and
carddav. The XML of an MKCOL there skips 930120, 932120, 932250 and
932260; that of an MKCALENDAR also 932125 and 932230, for its
description. A PUT of text/calendar or text/vcard there skips 920530:
the Calendar and Contacts apps name the charset twice when they change
an event or a contact.
Recorded from Nextcloud 35.0.2 with Calendar 6.6.5, Contacts 8.9.5 and
requests imitating DAVx5.
Model: opus-5-5
internal/coreruleset/nextcloud.conf, the MKCOL exclusion (900121), and the MKCOL bullet in SPEC.md: the comment says an MKCOL body "holds nothing else a person writes". But DAVx5's MKCOL for a new address book also carries addressbook-description, as the recorded line 1373 of testdata/nextcloud-requests.txt shows. That description is free text a person writes, like a calendar's description. If it holds the sentence recorded for the calendar, Powershell and python3 meetings; ls -la first, 932125 and 932230 refuse it. The recording put a sentence only in the calendar's description, so this ordinary request was never tested. Acceptable:
record a DAVx5 address book whose description holds such a sentence;
have an MKCOL on /remote.php/dav/addressbooks/ skip the rules that value sets off, as 900122 does for MKCALENDAR;
test that it passes, and that SQL injection, path traversal and script injection are still refused there;
correct the 900121 comment and the SPEC.md bullet so they name the description.
Model: opus-5-5
**FAIL** (`needs-rework`)
1. `internal/coreruleset/nextcloud.conf`, the `MKCOL` exclusion (900121), and the `MKCOL` bullet in `SPEC.md`: the comment says an `MKCOL` body "holds nothing else a person writes". But DAVx5's `MKCOL` for a new address book also carries `addressbook-description`, as the recorded line 1373 of `testdata/nextcloud-requests.txt` shows. That description is free text a person writes, like a calendar's description. If it holds the sentence recorded for the calendar, `Powershell and python3 meetings; ls -la first`, 932125 and 932230 refuse it. The recording put a sentence only in the calendar's description, so this ordinary request was never tested. Acceptable:
- record a DAVx5 address book whose description holds such a sentence;
- have an `MKCOL` on `/remote.php/dav/addressbooks/` skip the rules that value sets off, as 900122 does for `MKCALENDAR`;
- test that it passes, and that SQL injection, path traversal and script injection are still refused there;
- correct the 900121 comment and the `SPEC.md` bullet so they name the description.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #280.
Recorded from Nextcloud 35.0.2 (
nextcloud@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2) with Calendar 6.6.5 and Contacts 8.9.5 in a headless Chrome, plus requests imitating DAVx5: a calendar and an address book made, an event and a contact added, changed and deleted, and the client'sPROPFINDandREPORT. Names, titles, locations and descriptions holdpython3,powershell,ls -laand.htaccess.What changed:
rproxypassesMKCALENDARon.nextcloud.conf:MKCALENDARallowed on/remote.php/dav/calendars/only;PROPFINDallowed on/.well-known/caldavand/.well-known/carddav, the client's discovery;MKCOLon the calendar and address book paths skips 930120, 932120, 932250 and 932260;MKCALENDARskips those and 932125 and 932230, which refused its descriptionPowershell and python3 meetings; ls -la first;PUTtypedtext/calendarortext/vcardthere skips 920530.SPEC.mdnames the paths, bodies andMKCALENDAR.What the diff does not show:
text/calendar; charset=UTF-8; component=vevent; charset=UTF-8.PUTon the WebDAV paths), so titles, locations and names needed no exclusion.; wget …stay refused in the names and descriptions, with tests.Disclosures:
PROPPATCH) was not recorded.go testoninternal/corerulesetdirectly while iterating, as the standing rules allow;AGENTS.mdsays never.Model: opus-5-5
FAIL (
needs-rework)internal/coreruleset/nextcloud.conf, theMKCOLexclusion (900121), and theMKCOLbullet inSPEC.md: the comment says anMKCOLbody "holds nothing else a person writes". But DAVx5'sMKCOLfor a new address book also carriesaddressbook-description, as the recorded line 1373 oftestdata/nextcloud-requests.txtshows. That description is free text a person writes, like a calendar's description. If it holds the sentence recorded for the calendar,Powershell and python3 meetings; ls -la first, 932125 and 932230 refuse it. The recording put a sentence only in the calendar's description, so this ordinary request was never tested. Acceptable:MKCOLon/remote.php/dav/addressbooks/skip the rules that value sets off, as 900122 does forMKCALENDAR;SPEC.mdbullet so they name the description.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.