gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest, were sent each API search that #353 lists, with python3, powershell, ls -la, .htaccess, file names and plain words. The package search also got /bin/sh and @alice/tools-cli. The requests are in testdata/gitea-requests.txt and testdata/forgejo-requests.txt.
Changes in internal/coreruleset/gitea.conf, each skipping only 930120, 932120, 932250 and 932260, the rules the recorded values set off:
900603: q on /api/v1/topics/search, /api/v1/orgs/ORG/teams/search and /api/v1/admin/emails/search.
900607 (new): query on /api/v1/admin/unadopted.
900608 (new): name on /api/v1/repos/OWNER/REPO/milestones.
900605 now also lets /bin/sh through in q on /api/v1/packages/OWNER, since a package name can hold a slash.
Not visible in the diff:
The searches of repositories, users and issues (repos/search, users/search, repos/issues/search, repos/OWNER/REPO/issues) already passed; they are recorded with no exclusion added.
Disclosure: a script sent the requests with curl, each through a logging proxy; each answered 200.
An ordinary request can still be refused on a field outside these searches.
binSh in coreruleset_test.go replaces the literal %2Fbin%2Fsh that tests repeat, which goconst asked for.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/353.
gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest, were sent each API search that https://git.eeqj.de/sneak/smallwebwaf/issues/353 lists, with `python3`, `powershell`, `ls -la`, `.htaccess`, file names and plain words. The package search also got `/bin/sh` and `@alice/tools-cli`. The requests are in `testdata/gitea-requests.txt` and `testdata/forgejo-requests.txt`.
Changes in `internal/coreruleset/gitea.conf`, each skipping only 930120, 932120, 932250 and 932260, the rules the recorded values set off:
- 900603: `q` on `/api/v1/topics/search`, `/api/v1/orgs/ORG/teams/search` and `/api/v1/admin/emails/search`.
- 900607 (new): `query` on `/api/v1/admin/unadopted`.
- 900608 (new): `name` on `/api/v1/repos/OWNER/REPO/milestones`.
900605 now also lets `/bin/sh` through in `q` on `/api/v1/packages/OWNER`, since a package name can hold a slash.
Not visible in the diff:
- The searches of repositories, users and issues (`repos/search`, `users/search`, `repos/issues/search`, `repos/OWNER/REPO/issues`) already passed; they are recorded with no exclusion added.
- Disclosure: a script sent the requests with curl, each through a logging proxy; each answered 200.
- An ordinary request can still be refused on a field outside these searches.
- `binSh` in `coreruleset_test.go` replaces the literal `%2Fbin%2Fsh` that tests repeat, which `goconst` asked for.
Model: opus-5-5
Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on the API's searches of
topics, of an organisation's teams and of emails joins 900603, which skips
930120, 932120, 932250 and 932260. The same four rules are skipped by
query on the search of unadopted repositories (900607) and by name on the
search of a repository's milestones (900608). 900605 also lets /bin/sh
through in q on the API's search of packages, since a package name can
hold a slash. The searches of repositories, users and issues already
passed.
Model: opus-5-5
The API searches that #353 lists are recorded with the hard values against gitea and Forgejo and pass, each new exclusion skipping only the rules those values set off and only on its own route, with the narrowness tests and the SPEC.md lines the issue asks for.
Judgement call: a glob such as alice/* in query of the search of unadopted repositories is still refused (942100), as it already is in q on the admin page of unadopted repositories. It is outside this issue's hard values, so it needs its own issue under #212.
Model: opus-5-5
Verdict: PASS
Head: 7caad07de3043ea7b0ff75140f8ff56fb0a63391
The API searches that https://git.eeqj.de/sneak/smallwebwaf/issues/353 lists are recorded with the hard values against gitea and Forgejo and pass, each new exclusion skipping only the rules those values set off and only on its own route, with the narrowness tests and the `SPEC.md` lines the issue asks for.
- Judgement call: a glob such as `alice/*` in `query` of the search of unadopted repositories is still refused (942100), as it already is in `q` on the admin page of unadopted repositories. It is outside this issue's hard values, so it needs its own issue under https://git.eeqj.de/sneak/smallwebwaf/issues/212.
Model: opus-5-5
clawbot
merged commit b84a33fb57 into next2026-11-12 12:28:33 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #353.
gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest, were sent each API search that #353 lists, with
python3,powershell,ls -la,.htaccess, file names and plain words. The package search also got/bin/shand@alice/tools-cli. The requests are intestdata/gitea-requests.txtandtestdata/forgejo-requests.txt.Changes in
internal/coreruleset/gitea.conf, each skipping only 930120, 932120, 932250 and 932260, the rules the recorded values set off:qon/api/v1/topics/search,/api/v1/orgs/ORG/teams/searchand/api/v1/admin/emails/search.queryon/api/v1/admin/unadopted.nameon/api/v1/repos/OWNER/REPO/milestones.900605 now also lets
/bin/shthrough inqon/api/v1/packages/OWNER, since a package name can hold a slash.Not visible in the diff:
repos/search,users/search,repos/issues/search,repos/OWNER/REPO/issues) already passed; they are recorded with no exclusion added.binShincoreruleset_test.goreplaces the literal%2Fbin%2Fshthat tests repeat, whichgoconstasked for.Model: opus-5-5
Verdict: PASS
Head:
7caad07de3The API searches that #353 lists are recorded with the hard values against gitea and Forgejo and pass, each new exclusion skipping only the rules those values set off and only on its own route, with the narrowness tests and the
SPEC.mdlines the issue asks for.alice/*inqueryof the search of unadopted repositories is still refused (942100), as it already is inqon the admin page of unadopted repositories. It is outside this issue's hard values, so it needs its own issue under #212.Model: opus-5-5