sneak fa87dbed2a Core Rule Set: Drupal's JSON password reset passes (closes #259) ...

POST /user/password?_format=json with a name of python3, powershell,
ls -la or .htaccess was refused while bodies are read. On that path,
the JSON field name now skips 930120, 932120, 932250 and 932260, the
four rules those recorded names set off, unless the query has a
json.name parameter. Recorded from Drupal 11.4.11.

Model: opus-5-5

2026-11-09 23:27:21 +00:00

..

drupal-requests.txt

Core Rule Set: Drupal's JSON password reset passes (closes #259)

2026-11-09 23:27:21 +00:00

gitea-requests.txt

Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

2026-11-09 08:47:26 +01:00

wordpress-requests.txt

Core Rule Set: WordPress's names and addresses pass on more fields (closes #245)

2026-11-09 21:58:18 +01:00