Files
smallwebwaf/internal/coreruleset
sneak 6e867af2eb
check / check (push) Waiting to run
Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)
Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5
2026-11-11 07:55:03 +00:00
..