Core Rule Set: random passwords pass on the remaining password fields (closes #288)
check / check (push) Failing after 6m24s
check / check (push) Failing after 6m24s
Each app's sign-in, sign-up, password change and reset fields that had no exclusion now skip the 35 rules random passwords set off, on that app's paths and only when the query has no field of that name. Added gitea, Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST password, Drupal's forms and JSON, MediaWiki retype and password, Mastodon's challenge, and Nextcloud's confirm, reset, change, share and OCS fields. Vaultwarden's clients send a hash, which needs no exclusion. Model: opus-5-5
This commit is contained in:
sneak committed
1 parent
3268ec95c1
commit
0aec33b017
15 files changed
+853
-141
No files matched your search
@@ -108,85 +108,92 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php(?:$|/.)|^/wiki/" \
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^wp(?:summary|uploaddescription|name|password|oldtitle|newtitlemain|reason)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^wp(?:summary|uploaddescription|name|password|oldtitle|newtitlemain|reason)$/"
|
||||
|
||||
# wpPassword, lgpassword and password skip each rule random passwords set off.
|
||||
# The passwords skip each rule random passwords set off, on MediaWiki's pages:
|
||||
# wpPassword: signing in and signing up
|
||||
# password: changing the password at Special:ChangeCredentials
|
||||
# retype: signing up and changing the password
|
||||
# and on /api.php:
|
||||
# lgpassword: signing in with action=login
|
||||
# password, retype: action=clientlogin, createaccount and
|
||||
# changeauthenticationdata
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php(?:$|/.)|^/wiki/" \
|
||||
"id:900917,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_FILENAME|ARGS_GET_NAMES "@rx ^/(?:w/)?index\.php/.|^/wiki/|^title$" "chain"
|
||||
SecRule &ARGS_GET:wpPassword "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:wpPassword"
|
||||
SecRule &ARGS_GET:/^(?:wppassword|password|retype)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:wppassword|password|retype)$/"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:w/)?api\.php$" \
|
||||
"id:900918,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:lgpassword|password)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:lgpassword|password)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:lgpassword|password)$/"
|
||||
SecRule &ARGS_GET:/^(?:lgpassword|password|retype)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:lgpassword|password|retype)$/"
|
||||
|
||||
# Wikitext: the edit form sends it in wpTextbox1, the API in text, appendtext
|
||||
# or prependtext, and the REST API in the JSON field source. Each of these
|
||||
|
||||
Reference in new issue
Block a user