Core Rule Set: Mastodon's email field passes ordinary addresses (closes #273)

user[email] on /auth and the paths under it skips 930120, 932120 and
932260. They refused signing up, signing in and resetting a password
with addresses such as python3@example.com, powershell@example.com and
jane.profile@example.com. The field keeps 932250 and every other rule.

Recorded from Mastodon 4.7.5: sign-up, sign-in, password reset and an
email change.

Model: opus-5-5

internal/coreruleset/mastodon_test.go

@@ -525,6 +525,47 @@ func TestMastodonUsernamesAndHashtagsSkipOnlyTwoRules(t *testing.T) {
 	}
 }
 
+// mastodonEmail is the email address on the sign-up, sign-in, password
+// reset and account settings forms, as the start of a form body.
+const mastodonEmail = "user[email]="
+
+func TestMastodonEmailAddressesSkipThreeRules(t *testing.T) {
+	t.Parallel()
+
+	for _, target := range []string{mastodonAccount, mastodonSignIn, "/auth/password"} {
+		sent := mastodonBodyField{http.MethodPost, target, mastodonEmail}
+
+		for _, address := range []string{
+			"python3%40example.com",
+			"powershell%40example.com",
+			"jane.profile%40example.com",
+			"notes.htaccess%40example.com",
+		} {
+			if mastodonForm(t, sent, address) >= mastodonThreshold {
+				t.Errorf("%v with %s refused", sent, address)
+			}
+		}
+
+		// The address keeps 932250 and the rules that refuse attacks.
+		for _, value := range slices.Concat(
+			[]string{"ls%20-la"}, mastodonAttacks,
+			[]string{url.QueryEscape(mastodonCommandAttack)},
+		) {
+			if mastodonForm(t, sent, value) < mastodonThreshold {
+				t.Errorf("%v with %s let through", sent, value)
+			}
+		}
+	}
+
+	// Elsewhere the address keeps every rule.
+	for _, target := range []string{"/oauth/authorize", "/authorize", "/x/auth"} {
+		sent := mastodonBodyField{http.MethodPost, target, mastodonEmail}
+		if mastodonForm(t, sent, "python3%40example.com") < mastodonThreshold {
+			t.Errorf("%v let through", sent)
+		}
+	}
+}
+
 func TestMastodonBodyFieldsStayCheckedInTheQuery(t *testing.T) {
 	t.Parallel()
 
@@ -538,6 +579,7 @@ func TestMastodonBodyFieldsStayCheckedInTheQuery(t *testing.T) {
 		{mastodonRules, "rule[text]=python3"},
 		{mastodonRoles, "user_role[name]=python3"},
 		{mastodonSignIn, mastodonPassword + "python3"},
+		{mastodonSignIn, mastodonEmail + "python3"},
 		{mastodonSignUp, "password=python3"},
 		{mastodonInbox, "json.object.content=python3"},
 	} {