Core Rule Set: random passwords pass on the remaining password fields (closes #288)

Each app's sign-in, sign-up, password change and reset fields that had no
exclusion now skip the 35 rules random passwords set off, on that app's
paths and only when the query has no field of that name. Added gitea,
Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST
password, Drupal's forms and JSON, MediaWiki retype and password on the
pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset,
change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's
clients send a hash, which needs no exclusion.

Model: opus-5-5

internal/coreruleset/vaultwarden_test.go

@@ -1,7 +1,9 @@
 package coreruleset_test
 
 import (
+	"encoding/base64"
 	"encoding/json"
+	"math/rand/v2"
 	"net/http"
 	"net/url"
 	"slices"
@@ -277,6 +279,73 @@ func vaultwardenUpload(name string) string {
 		"\"\r\nContent-Type: application/octet-stream\r\n\r\nx\r\n" + end
 }
 
+func TestVaultwardenAdminTokenPasses(t *testing.T) {
+	t.Parallel()
+
+	wantPasswordFieldsPass(t, []passwordFields{
+		{"/admin", formData, []string{"token"}},
+	})
+}
+
+// masterPasswordHashes returns count random 32-byte hashes in base64, the
+// form in which the apps send a master password.
+func masterPasswordHashes(count int) []string {
+	const size, seed = 32, 288
+
+	random := rand.New(rand.NewPCG(seed, seed)) //nolint:gosec // a fixed sample
+
+	hashes := make([]string, count)
+
+	for i := range hashes {
+		hash := make([]byte, size)
+		for j := range hash {
+			hash[j] = byte(random.IntN(1 << 8)) //nolint:gosec // below 256
+		}
+
+		hashes[i] = base64.StdEncoding.EncodeToString(hash)
+	}
+
+	return hashes
+}
+
+// The apps hash the master password before they send it, so these fields
+// hold only base64 and set off no rule, with no exclusion.
+func TestVaultwardenMasterPasswordHashesPass(t *testing.T) {
+	t.Parallel()
+
+	const perBody = 20
+
+	crs := readingBodies(t)
+	hashes := masterPasswordHashes(perBody)
+
+	for _, sent := range []struct {
+		r     request
+		names []string
+	}{
+		{
+			request{http.MethodPost, "/identity/connect/token", []string{formData}},
+			[]string{passwordKey},
+		},
+		{
+			request{http.MethodPost, vaultwardenPassword, []string{jsonBody}},
+			[]string{"masterPasswordHash", "newMasterPasswordHash"},
+		},
+		{
+			request{http.MethodPost, "/api/accounts/delete", []string{jsonBody}},
+			[]string{"masterPasswordHash"},
+		},
+	} {
+		body := passwordBody(t, sent.r, sent.names, hashes...)
+		if len(body) > bodyLimit {
+			t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
+		}
+
+		if got, _ := inspectBody(t, crs, sent.r, body); len(got.RuleIDs) != 0 {
+			t.Errorf("POST %s %v set off rules: %+v", sent.r.target, sent.names, got)
+		}
+	}
+}
+
 func TestVaultwardenEncryptedFileNamesPassOnlyOnUploads(t *testing.T) {
 	t.Parallel()