clawbot 7acc6ae153 A path holding a character Go escapes reaches the app as the client sent it (closes #126) ...

ReverseProxy sends the path URL.EscapedPath gives, which decodes and
escapes again a path holding a character such as |, turning %2F into /.
The path as sent now goes in URL.Opaque, which Go sends as it is; the
rate limit and WAF exempt paths and the log line's path use the same
path. A path starting with // is left as before: Go would send it in
Opaque as a scheme and host.

Model: opus-5-5

2026-10-20 16:09:46 +02:00

..

alerts

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

anomaly

Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

2026-10-08 02:14:12 +02:00

bans

A ban's earlier_bans counts a ban dropped after an admin's ban (closes #128)

2026-10-20 12:59:52 +02:00

config

Path rules and trap paths match the path decoded once too (closes #85)

2026-10-14 18:20:31 +02:00

lookup

Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

2026-10-08 02:14:12 +02:00

metrics

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

proxy

A path holding a character Go escapes reaches the app as the client sent it (closes #126)

2026-10-20 16:09:46 +02:00

ratelimit

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

remotelog

Send every log line to a syslog server as well (closes #28)

2026-10-06 22:02:36 +02:00

reputation

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

requestlog

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

rules

Path rules and trap paths match the path decoded once too (closes #85)

2026-10-14 18:20:31 +02:00

smallwebwaf

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

state

Trap paths, and the error burst banning a client refused too often (closes #115)

2026-10-08 06:44:55 +02:00

waf

Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

2026-10-08 12:59:13 +02:00