Closes #357. Recorded Ghost 6.76.0, ghost@sha256:dab62e61ad76eaca5e76d70cb2a7ccdab9ac0b0db94a67a48e229e81c38fec1a.
ghost.conf, the sixteenth change, by field:
query filter on the Admin and Content APIs: 932120;
query search (members) on the Admin API: 930120, 932120, 932250, 932260;
query url of embed lookups: 930120, 932120;
plain text in JSON (titles, names, slugs, tags, labels, excerpts, descriptions, notes, meta fields; a member's name at /members/api/): 930120, 932120, 932125, 932230, 932250, 932260, 932380;
a member's email: 930120, 932120, 932260;
passwords: the shared list;
the field name json.users.N.profile_image: 930120.
HTML fields:
lexical, mobiledoc, html of posts and pages, snippets, newsletter footer_content: the command rules, 934100, 942190, and the script-injection rules 941100, 941120, 941160, 941180, 941390;
code injection and settings value: the plain-text rules plus 921130, 941100, 941160, 941270;
<script> (941110) and javascript: (941170, 941210) stay refused in both.
fields not recorded, and filter values joining command names with &: #359;
an ordinary request on any other field.
Judgement calls:
All plain-text fields share one rule set, since any recorded value fits any of them.
Keeping 941110 refuses articles that embed a widget's script.
Settings share the field name value, so a title skips the code-injection rules too.
Deviation: Ghost ran in development mode (SQLite) with staff device verification on, as production has it.
The SWW_APPS PR registers ghost.conf when it lands.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/357. Recorded Ghost 6.76.0, `ghost@sha256:dab62e61ad76eaca5e76d70cb2a7ccdab9ac0b0db94a67a48e229e81c38fec1a`.
`ghost.conf`, the sixteenth change, by field:
- query `filter` on the Admin and Content APIs: 932120;
- query `search` (members) on the Admin API: 930120, 932120, 932250, 932260;
- query `url` of embed lookups: 930120, 932120;
- plain text in JSON (titles, names, slugs, tags, labels, excerpts, descriptions, notes, meta fields; a member's `name` at `/members/api/`): 930120, 932120, 932125, 932230, 932250, 932260, 932380;
- a member's `email`: 930120, 932120, 932260;
- passwords: the shared list;
- the field name `json.users.N.profile_image`: 930120.
HTML fields:
- `lexical`, `mobiledoc`, `html` of posts and pages, snippets, newsletter `footer_content`: the command rules, 934100, 942190, and the script-injection rules 941100, 941120, 941160, 941180, 941390;
- code injection and settings `value`: the plain-text rules plus 921130, 941100, 941160, 941270;
- `<script>` (941110) and `javascript:` (941170, 941210) stay refused in both.
Still refused:
- `<script>` in an HTML card or code injection: https://git.eeqj.de/sneak/smallwebwaf/issues/358;
- fields not recorded, and `filter` values joining command names with `&`: https://git.eeqj.de/sneak/smallwebwaf/issues/359;
- an ordinary request on any other field.
Judgement calls:
- All plain-text fields share one rule set, since any recorded value fits any of them.
- Keeping 941110 refuses articles that embed a widget's script.
- Settings share the field name `value`, so a title skips the code-injection rules too.
Deviation: Ghost ran in development mode (SQLite) with staff device verification on, as production has it.
The `SWW_APPS` PR registers `ghost.conf` when it lands.
Model: opus-5-5
Ghost 6.76.0's ordinary traffic, recorded in `testdata/ghost-requests.txt`,
passes at the default settings and while bodies are read. It covers public
pages, members' sign-up and sign-in, the admin, the editor saving and
publishing posts and pages with code blocks and HTML cards, tags, settings,
staff invitations, uploads, newsletter settings, and both APIs. The new
`ghost.conf`, the sixteenth change, lets through `filter`, the member
`search` and the embed `url` in the query, and plain text, addresses,
articles, code injection and passwords in JSON bodies. A `<script>` element
and a `javascript:` link stay refused in articles and code injection.
`README.md` lists Ghost; `SPEC.md` lists the change.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #357. Recorded Ghost 6.76.0,
ghost@sha256:dab62e61ad76eaca5e76d70cb2a7ccdab9ac0b0db94a67a48e229e81c38fec1a.ghost.conf, the sixteenth change, by field:filteron the Admin and Content APIs: 932120;search(members) on the Admin API: 930120, 932120, 932250, 932260;urlof embed lookups: 930120, 932120;nameat/members/api/): 930120, 932120, 932125, 932230, 932250, 932260, 932380;email: 930120, 932120, 932260;json.users.N.profile_image: 930120.HTML fields:
lexical,mobiledoc,htmlof posts and pages, snippets, newsletterfooter_content: the command rules, 934100, 942190, and the script-injection rules 941100, 941120, 941160, 941180, 941390;value: the plain-text rules plus 921130, 941100, 941160, 941270;<script>(941110) andjavascript:(941170, 941210) stay refused in both.Still refused:
<script>in an HTML card or code injection: #358;filtervalues joining command names with&: #359;Judgement calls:
value, so a title skips the code-injection rules too.Deviation: Ghost ran in development mode (SQLite) with staff device verification on, as production has it.
The
SWW_APPSPR registersghost.confwhen it lands.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.