Files
smallwebwaf/internal
sneak d442848cf8
check / check (push) Failing after 5m5s
Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)
Adds nextcloud.conf, the thirteenth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK. The
account-name cookie nc_username, and the fields that carry a search, a name, a
file name or a folder on the sign-in page, the Files app, public shares and the
OCS API, skip the four rules that read them as commands or system files.
Comments, a share's note, a status and a document's text also skip the rules
that refused ordinary sentences, and the document the two that refused a shell
code block, so "; wget" reaches Nextcloud there. Requests recorded from
Nextcloud 35.0.2, its web pages, sync client 3.16.7 and the OCS API pass at the
defaults and while bodies are read.

Model: opus-5-5
2026-11-10 05:17:09 +00:00
..