A recorded request with a body or a Content-Type header is now inspected only while bodies are read, in every app's recorded-request test, WordPress included. Any other request is still inspected at the defaults. No request or test value is removed.
Why passing while bodies are read implies passing at the defaults, from coreruleset.go:
The set that reads bodies is the defaults' directives with bodyDirectives added. Nothing is removed.
bodyDirectives switch on body reading, pick the JSON or XML parser, put Content-Encoding back on the refused headers, and add 5 for a body that fails to parse. Each can only add matches.
At the defaults, every variable filled from the body is empty. Every exclusion that skips rules tests the path, method, headers, query or settings, which are the same in both sets.
The one exception, MediaWiki's 900916, reads the body. It drops ARGS:wpTitles only when the query has no wpTitles, so that field is empty at the defaults anyway.
TestReadingBodiesOnlyAddsMatches checks this on every 40th recorded request with a body per app, as recorded and with an SQL injection in its query.
Disclosures:
Unmet: the package's CPU under -race fell by about 5%, not by half. The removed inspections were about a sixth of the recorded-request work. What remains is needed: requests with no body at the defaults, and requests with a body while bodies are read.
Not done: inspecting identical recorded requests once. Only 6 of about 4,000 repeat, so it would save nothing.
Model: opus-5-5
Implements https://git.eeqj.de/sneak/smallwebwaf/issues/287.
A recorded request with a body or a `Content-Type` header is now inspected only while bodies are read, in every app's recorded-request test, WordPress included. Any other request is still inspected at the defaults. No request or test value is removed.
Why passing while bodies are read implies passing at the defaults, from `coreruleset.go`:
- The set that reads bodies is the defaults' directives with `bodyDirectives` added. Nothing is removed.
- `bodyDirectives` switch on body reading, pick the JSON or XML parser, put `Content-Encoding` back on the refused headers, and add 5 for a body that fails to parse. Each can only add matches.
- At the defaults, every variable filled from the body is empty. Every exclusion that skips rules tests the path, method, headers, query or settings, which are the same in both sets.
- The one exception, MediaWiki's 900916, reads the body. It drops `ARGS:wpTitles` only when the query has no `wpTitles`, so that field is empty at the defaults anyway.
`TestReadingBodiesOnlyAddsMatches` checks this on every 40th recorded request with a body per app, as recorded and with an SQL injection in its query.
Disclosures:
- Unmet: the package's CPU under `-race` fell by about 5%, not by half. The removed inspections were about a sixth of the recorded-request work. What remains is needed: requests with no body at the defaults, and requests with a body while bodies are read.
- Not done: inspecting identical recorded requests once. Only 6 of about 4,000 repeat, so it would save nothing.
Model: opus-5-5
A recorded request with a body or a Content-Type header is now inspected
only by the Core Rule Set that reads bodies, in the WordPress test as in
the other apps' tests. Reading bodies only adds rule matches, so passing
there means passing at the defaults. TestReadingBodiesOnlyAddsMatches
checks that on every 40th recorded request with a body of each app, as
recorded and with an SQL injection added to its query.
Model: opus-5-5
For the reviewer: the disclosed shortfall (about 5%, not half) is accepted; the rest moves to #290, as decided at the newest comment of #287. Review this change for correctness: that passing while bodies are read implies passing at the defaults for every request it stops inspecting at the defaults, and that TestReadingBodiesOnlyAddsMatches checks that claim.
Model: opus-5-5
**For the reviewer:** the disclosed shortfall (about 5%, not half) is accepted; the rest moves to https://git.eeqj.de/sneak/smallwebwaf/issues/290, as decided at the newest comment of https://git.eeqj.de/sneak/smallwebwaf/issues/287. Review this change for correctness: that passing while bodies are read implies passing at the defaults for every request it stops inspecting at the defaults, and that `TestReadingBodiesOnlyAddsMatches` checks that claim.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #287.
A recorded request with a body or a
Content-Typeheader is now inspected only while bodies are read, in every app's recorded-request test, WordPress included. Any other request is still inspected at the defaults. No request or test value is removed.Why passing while bodies are read implies passing at the defaults, from
coreruleset.go:bodyDirectivesadded. Nothing is removed.bodyDirectivesswitch on body reading, pick the JSON or XML parser, putContent-Encodingback on the refused headers, and add 5 for a body that fails to parse. Each can only add matches.ARGS:wpTitlesonly when the query has nowpTitles, so that field is empty at the defaults anyway.TestReadingBodiesOnlyAddsMatcheschecks this on every 40th recorded request with a body per app, as recorded and with an SQL injection in its query.Disclosures:
-racefell by about 5%, not by half. The removed inspections were about a sixth of the recorded-request work. What remains is needed: requests with no body at the defaults, and requests with a body while bodies are read.Model: opus-5-5
For the reviewer: the disclosed shortfall (about 5%, not half) is accepted; the rest moves to #290, as decided at the newest comment of #287. Review this change for correctness: that passing while bodies are read implies passing at the defaults for every request it stops inspecting at the defaults, and that
TestReadingBodiesOnlyAddsMatcheschecks that claim.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.