clawbot 27f0007b54 Path rules and trap paths match the path decoded once too (closes #85) ...

A path rule matched only the path as the client sent it, so /%2eenv got
past the default env-file rule while an app that decodes the path
serves /.env. A path rule now matches the path as sent or decoded once,
as a uri rule already did, and so does a path in SWWAF_TRAP_PATHS:
/%77p-login.php matches /wp-login.php. The query is cut off before the
path is decoded, and the path is decoded only once, so /%252eenv is not
/.env. A ban's notes keep the path as sent. SPEC.md and README.md say
so.

Model: opus-5-5

2026-10-14 18:20:31 +02:00

..

config_test.go

Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

2026-10-08 12:59:13 +02:00

config.go

Path rules and trap paths match the path decoded once too (closes #85)

2026-10-14 18:20:31 +02:00