Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374) #376

Open

clawbot wants to merge 1 commits from issue-374-ghost-canonical-url into next

pull from: issue-374-ghost-canonical-url

Author	SHA1	Message	Date
clawbot	562430ebbf	Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374 ) check / check (push) Waiting to run Details While bodies are read, 932120 refused the canonical URL `https://example.com/blog/powershell/` and 930120 refused `https://example.com/blog/.htaccess/`. The new exclusions 900383 and 900384 switch both rules off for `posts.N.canonical_url` under `/ghost/api/admin/posts/` and `pages.N.canonical_url` under `/ghost/api/admin/pages/`, as `url` does, and only when the query has no field of that name. The recorded requests gain the saves the Ghost 6.76.0 admin sends when those addresses are set in a post's and a page's settings. Model: opus-5-5	2026-11-12 07:11:38 +00:00

Author

SHA1

Message

Date

clawbot

562430ebbf

Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374 )

check / check (push) Waiting to run

Details

While bodies are read, 932120 refused the canonical URL
`https://example.com/blog/powershell/` and 930120 refused
`https://example.com/blog/.htaccess/`. The new exclusions 900383 and 900384
switch both rules off for `posts.N.canonical_url` under
`/ghost/api/admin/posts/` and `pages.N.canonical_url` under
`/ghost/api/admin/pages/`, as `url` does, and only when the query has no field
of that name. The recorded requests gain the saves the Ghost 6.76.0 admin
sends when those addresses are set in a post's and a page's settings.

Model: opus-5-5

2026-11-12 07:11:38 +00:00