clawbot d5b90a80dc Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116) ...

SWWAF_WAF_BODY_LIMIT (default off) has the Core Rule Set read form data
and multipart up to the limit, the rest streaming on, and JSON and XML
no larger than it; other bodies pass uninspected. The part read is held
and sent to the app first. A size or time limit met while it is read
ends the request before it reaches the app. Content-Encoding is refused
again on those four kinds. Rule 900300 moves to phase 2, to count form
and JSON fields past Coraza's 1000 too.

Judgement call: Content-Encoding is refused on a JSON or XML body too
large to be read, which SPEC.md allows.

Model: opus-5-5

2026-10-08 08:24:59 +00:00

..

waf_test.go

Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

2026-10-08 08:24:59 +00:00

waf.go

Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

2026-10-08 08:24:59 +00:00