clawbot 7acc6ae153 A path holding a character Go escapes reaches the app as the client sent it (closes #126) ...

ReverseProxy sends the path URL.EscapedPath gives, which decodes and
escapes again a path holding a character such as |, turning %2F into /.
The path as sent now goes in URL.Opaque, which Go sends as it is; the
rate limit and WAF exempt paths and the log line's path use the same
path. A path starting with // is left as before: Go would send it in
Opaque as a scheme and host.

Model: opus-5-5

2026-10-20 16:09:46 +02:00

..

admin_test.go

Ban notes name the reputation sources that listed the client (closes #109)

2026-10-08 03:08:01 +02:00

admin.go

Trap paths, and the error burst banning a client refused too often (closes #115)

2026-10-08 06:44:55 +02:00

alerts_test.go

Ban notes name the reputation sources that listed the client (closes #109)

2026-10-08 03:08:01 +02:00

anomaly_internal_test.go

Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

2026-10-07 16:12:19 +02:00

anomaly_test.go

Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

2026-10-07 16:12:19 +02:00

bans_test.go

Tests that need a lookup answer give it an hour (closes #119)

2026-10-08 08:14:45 +02:00

bans.go

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

biased_test.go

Blocklists and an AS percentage file fetched by URL (closes #29)

2026-10-07 19:09:41 +02:00

biased.go

AbuseIPDB scores for clients that committed an offence, within a daily budget (closes #105)

2026-10-07 22:47:06 +02:00

bodies.go

An upgrade the app accepts under another protocol name is answered 502 (closes #131)

2026-10-20 15:36:30 +02:00

bytelimits_test.go

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

client_test.go

Log the rest of the request log's fields (closes #79)

2026-10-06 17:26:21 +02:00

client.go

Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

2026-10-08 02:14:12 +02:00

coreruleset_test.go

Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

2026-10-08 12:59:13 +02:00

coreruleset.go

A path holding a character Go escapes reaches the app as the client sent it (closes #126)

2026-10-20 16:09:46 +02:00

countries_test.go

Tests that need a lookup answer give it an hour (closes #119)

2026-10-08 08:14:45 +02:00

countries.go

AS number and country looked up for every client (closes #95)

2026-10-07 08:46:01 +02:00

crowdsec_test.go

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

errorburst_test.go

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

health_test.go

Log the rest of the request log's fields (closes #79)

2026-10-06 17:26:21 +02:00

history_test.go

Tests that need a lookup answer give it an hour (closes #119)

2026-10-08 08:14:45 +02:00

limits_test.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00

lookup_test.go

A request that waited for its lookup is counted when it goes on (closes #129)

2026-10-14 19:41:54 +02:00

lookup.go

Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

2026-10-08 02:14:12 +02:00

metrics_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

observe_test.go

Tests that need a lookup answer give it an hour (closes #119)

2026-10-08 08:14:45 +02:00

passthrough_test.go

A path holding a character Go escapes reaches the app as the client sent it (closes #126)

2026-10-20 16:09:46 +02:00

proxy_test.go

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

proxy.go

Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

2026-10-08 12:59:13 +02:00

ratelimits_test.go

A path holding a character Go escapes reaches the app as the client sent it (closes #126)

2026-10-20 16:09:46 +02:00

reputation_test.go

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

reputation.go

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

request.go

A path holding a character Go escapes reaches the app as the client sent it (closes #126)

2026-10-20 16:09:46 +02:00

requestlog_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

rulefiles_test.go

Trap paths, and the error burst banning a client refused too often (closes #115)

2026-10-08 06:44:55 +02:00

rules.go

Path rules and trap paths match the path decoded once too (closes #85)

2026-10-14 18:20:31 +02:00

staticlists_test.go

Tests that need a lookup answer give it an hour (closes #119)

2026-10-08 08:14:45 +02:00

timeouts_test.go

A client that stops sending with little of its body left after the app has answered is timed out (closes #136)

2026-10-20 15:09:16 +02:00

trappaths_test.go

Path rules and trap paths match the path decoded once too (closes #85)

2026-10-14 18:20:31 +02:00