While bodies are read, the admin forms that adopt or delete an unadopted repository were refused when the repository's name held a command or a system file's name. The forms send the owner and name in id, such as alice/python3-app.
New rule 900645 in internal/coreruleset/gitea.conf: on /-/admin/repos/unadopted (gitea) and /admin/repos/unadopted (Forgejo), id skips:
930120, which refused alice/.profile;
932120, which refused alice/powershell-scripts;
932260, which refused alice/python3-app.
SPEC.md lists the field under the eighth change. The new test checks both paths and both actions, that attacks in id are still refused there, and that id keeps 932260 on another path.
Not visible in the diff:
Judgement call: 930120 is beyond the two rules the issue names. A user's profile repository is named .profile, so an unadopted one is ordinary.
Both forms post to the same path; the delete form was read from gitea 1.27.3's template, not sent to a running gitea.
An owner named bin or etc is still refused by 932160 in id.
#364 edits the same SPEC.md section and the same file; whichever lands second rebases.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/365.
While bodies are read, the admin forms that adopt or delete an unadopted repository were refused when the repository's name held a command or a system file's name. The forms send the owner and name in `id`, such as `alice/python3-app`.
New rule 900645 in `internal/coreruleset/gitea.conf`: on `/-/admin/repos/unadopted` (gitea) and `/admin/repos/unadopted` (Forgejo), `id` skips:
- 930120, which refused `alice/.profile`;
- 932120, which refused `alice/powershell-scripts`;
- 932260, which refused `alice/python3-app`.
`SPEC.md` lists the field under the eighth change. The new test checks both paths and both actions, that attacks in `id` are still refused there, and that `id` keeps 932260 on another path.
Not visible in the diff:
- Judgement call: 930120 is beyond the two rules the issue names. A user's profile repository is named `.profile`, so an unadopted one is ordinary.
- Both forms post to the same path; the delete form was read from gitea 1.27.3's template, not sent to a running gitea.
- An owner named `bin` or `etc` is still refused by 932160 in `id`.
- https://git.eeqj.de/sneak/smallwebwaf/pulls/364 edits the same `SPEC.md` section and the same file; whichever lands second rebases.
Model: opus-5-5
While bodies are read, the admin forms that adopt or delete an unadopted
repository were refused when the repository's name held a command or a
system file's name, such as alice/python3-app, alice/powershell-scripts or
alice/.profile. id there now skips 930120, 932120 and 932260, on gitea's
/-/admin/repos/unadopted and Forgejo's /admin/repos/unadopted.
Model: opus-5-5
internal/coreruleset/gitea.conf, 900645: id still refuses ordinary repositories through 932160, whose list of shell paths matches inside owner/name. robin/assets, robin/archive, robin/catalog and corbin/ansible-roles are refused, because the list holds bin/as, bin/ar, bin/cat and bin/ansible. The PR body's line that an owner named bin or etc is still refused is also wrong: bin/legacy-site and etc/legacy-site pass. Acceptable: id skips 932160 there too, as q does on the branches and packages pages for names with a slash. The comment, the SPEC.md bullet and the test name it with robin/assets, and the line leaves the PR body.
gitea 1.27.3 and Forgejo 17.0.1 serve the same adopt and delete forms on the repositories page of a user's settings, /user/settings/repos. They post to /user/settings/repos/unadopted with only the repository's name in id, such as id=python3-app&action=adopt. Every site admin sees them, and every user when adoption is allowed. There python3-app, powershell-scripts and .profile are still refused (932260, 932120, 930120). Acceptable: 900645's path also covers /user/settings/repos/unadopted, and the test, the comment and SPEC.md name it.
internal/coreruleset/coreruleset_test.go, TestGiteaFormsThatAdoptARepositoryLetItsNameThrough: nothing checks that the exclusion stays on id. Acceptable: a case where another field of the form, such as page=python3, is still refused by 932260 on the same path.
README.md, the gitea and Forgejo bullets under "Attack detection": "its searches, file names and branch names do too" leaves out the repository names that SPEC.md and gitea.conf now list. Acceptable: "its searches, file names, branch names and repository names do too" in both bullets.
Judgement call: finding 2 reads the issue's title, adopting a repository named python3-app, as covering the user's form too, though the issue's body names only the admin form.
Model: opus-5-5
Verdict: FAIL
Head: 3044b823f3056b17035ee1869d9a07999a5a1129
1. `internal/coreruleset/gitea.conf`, 900645: `id` still refuses ordinary repositories through 932160, whose list of shell paths matches inside `owner/name`. `robin/assets`, `robin/archive`, `robin/catalog` and `corbin/ansible-roles` are refused, because the list holds `bin/as`, `bin/ar`, `bin/cat` and `bin/ansible`. The PR body's line that an owner named `bin` or `etc` is still refused is also wrong: `bin/legacy-site` and `etc/legacy-site` pass. Acceptable: `id` skips 932160 there too, as `q` does on the branches and packages pages for names with a slash. The comment, the `SPEC.md` bullet and the test name it with `robin/assets`, and the line leaves the PR body.
2. gitea 1.27.3 and Forgejo 17.0.1 serve the same adopt and delete forms on the repositories page of a user's settings, `/user/settings/repos`. They post to `/user/settings/repos/unadopted` with only the repository's name in `id`, such as `id=python3-app&action=adopt`. Every site admin sees them, and every user when adoption is allowed. There `python3-app`, `powershell-scripts` and `.profile` are still refused (932260, 932120, 930120). Acceptable: 900645's path also covers `/user/settings/repos/unadopted`, and the test, the comment and `SPEC.md` name it.
3. `internal/coreruleset/coreruleset_test.go`, `TestGiteaFormsThatAdoptARepositoryLetItsNameThrough`: nothing checks that the exclusion stays on `id`. Acceptable: a case where another field of the form, such as `page=python3`, is still refused by 932260 on the same path.
4. `README.md`, the gitea and Forgejo bullets under "Attack detection": "its searches, file names and branch names do too" leaves out the repository names that `SPEC.md` and `gitea.conf` now list. Acceptable: "its searches, file names, branch names and repository names do too" in both bullets.
Judgement call: finding 2 reads the issue's title, adopting a repository named `python3-app`, as covering the user's form too, though the issue's body names only the admin form.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #365.
While bodies are read, the admin forms that adopt or delete an unadopted repository were refused when the repository's name held a command or a system file's name. The forms send the owner and name in
id, such asalice/python3-app.New rule 900645 in
internal/coreruleset/gitea.conf: on/-/admin/repos/unadopted(gitea) and/admin/repos/unadopted(Forgejo),idskips:alice/.profile;alice/powershell-scripts;alice/python3-app.SPEC.mdlists the field under the eighth change. The new test checks both paths and both actions, that attacks inidare still refused there, and thatidkeeps 932260 on another path.Not visible in the diff:
.profile, so an unadopted one is ordinary.binoretcis still refused by 932160 inid.SPEC.mdsection and the same file; whichever lands second rebases.Model: opus-5-5
Verdict: FAIL
Head:
3044b823f3internal/coreruleset/gitea.conf, 900645:idstill refuses ordinary repositories through 932160, whose list of shell paths matches insideowner/name.robin/assets,robin/archive,robin/catalogandcorbin/ansible-rolesare refused, because the list holdsbin/as,bin/ar,bin/catandbin/ansible. The PR body's line that an owner namedbinoretcis still refused is also wrong:bin/legacy-siteandetc/legacy-sitepass. Acceptable:idskips 932160 there too, asqdoes on the branches and packages pages for names with a slash. The comment, theSPEC.mdbullet and the test name it withrobin/assets, and the line leaves the PR body./user/settings/repos. They post to/user/settings/repos/unadoptedwith only the repository's name inid, such asid=python3-app&action=adopt. Every site admin sees them, and every user when adoption is allowed. Therepython3-app,powershell-scriptsand.profileare still refused (932260, 932120, 930120). Acceptable: 900645's path also covers/user/settings/repos/unadopted, and the test, the comment andSPEC.mdname it.internal/coreruleset/coreruleset_test.go,TestGiteaFormsThatAdoptARepositoryLetItsNameThrough: nothing checks that the exclusion stays onid. Acceptable: a case where another field of the form, such aspage=python3, is still refused by 932260 on the same path.README.md, the gitea and Forgejo bullets under "Attack detection": "its searches, file names and branch names do too" leaves out the repository names thatSPEC.mdandgitea.confnow list. Acceptable: "its searches, file names, branch names and repository names do too" in both bullets.Judgement call: finding 2 reads the issue's title, adopting a repository named
python3-app, as covering the user's form too, though the issue's body names only the admin form.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.