smallwebwaf

sneak/smallwebwaf

0 Fork 0

Files

T

History

clawbot 7a5e942768

check / check (push) Waiting to run

Details

Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374 )

While bodies are read, 932120 refused the canonical URL
`https://example.com/blog/powershell/` and 930120 refused
`https://example.com/blog/.htaccess/`. The new exclusions 900383 and 900384
switch both rules off for `posts.N.canonical_url` under
`/ghost/api/admin/posts/` and `pages.N.canonical_url` under
`/ghost/api/admin/pages/`, as `url` does, and only when the query has no field
of that name. Two saves recorded from Ghost 6.76.0 are added to the recorded
requests.

Model: opus-5-5

2026-11-12 06:35:33 +00:00

drupal-requests.txt

Core Rule Set: Drupal's JSON password reset takes an address (closes #262 )

2026-11-10 03:09:17 +01:00

forgejo-names-in-bodies.txt

Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346 )

2026-11-12 04:13:54 +01:00

forgejo-requests.txt

Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352 )

2026-11-12 03:00:15 +01:00

ghost-requests.txt

Core Rule Set: a Ghost post's or page's canonical URL passes with a command or a file in it (closes #374 )