Files
smallwebwaf/internal/coreruleset
clawbot 7a5e942768
check / check (push) Waiting to run
Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374)
While bodies are read, 932120 refused the canonical URL
`https://example.com/blog/powershell/` and 930120 refused
`https://example.com/blog/.htaccess/`. The new exclusions 900383 and 900384
switch both rules off for `posts.N.canonical_url` under
`/ghost/api/admin/posts/` and `pages.N.canonical_url` under
`/ghost/api/admin/pages/`, as `url` does, and only when the query has no field
of that name. Two saves recorded from Ghost 6.76.0 are added to the recorded
requests.

Model: opus-5-5
2026-11-12 06:35:33 +00:00
..