Core Rule Set: random passwords pass at sign-in (closes #276)

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. The tests draw 2,000 random passwords from a fixed seed, plus
one rare password for each rule the 2,000 do not set off. Those that set
off a rule in a field no exclusion names are sent to every password
field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
`<img src=x onerror=x()>` sent as a password now pass;
`<script>alert(1)</script>` and `javascript:alert(1)` are still refused.

Model: opus-5-5

SPEC.md

@@ -919,7 +919,20 @@ The changes hold in front of every app, and no setting undoes them:
         - `content` of a reply to a comment sent to `admin-ajax.php`.
         - `newcontent` of a plugin's or a theme's file saved from its editor,
           which is PHP.
-        - `pwd` when signing in, for the list of system files (930120).
+        - `pwd`, the password when signing in, for each rule that random
+          passwords set off:
+
+            920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130,
+            932160, 932230, 932250, 932260, 932270, 932280, 932330, 932340,
+            932370, 932380, 933100, 933135, 933180, 933210, 941100, 941120,
+            941160, 941180, 942100, 942151, 942190, 942230, 942290, 942320,
+            942540, 942550, 944150.
+
+            `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
+            `<img src=x onerror=x()>` sent as the password reach WordPress;
+            `<script>alert(1)</script>` and `javascript:alert(1)` are still
+            refused.
+
         - `title`, `excerpt` and `name` in a JSON body sent to any REST API
           route under `/wp/v2/`, for the rules on system files and commands
           (930120, 932120, 932250, 932260).
@@ -987,6 +1000,18 @@ The changes hold in front of every app, and no setting undoes them:
     - The body and comment body on the node and comment forms and through
       JSON:API, which hold HTML and any code it shows.
     - `name` and `pass` when signing in (930120, 932120, 932250, 932260).
+    - `pass`, the password when signing in, in form data or JSON, for each rule
+      that random passwords set off:
+
+        920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
+        932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
+        933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
+        942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
+
+        `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
+        `<img src=x onerror=x()>` sent as the password reach Drupal;
+        `<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
+
     - `name` when resetting a password through Drupal's JSON format on
       `/user/password`, for the same four rules.
     - `mail` in that same reset, for 932120 and 932260 only.
@@ -1066,6 +1091,20 @@ The changes hold in front of every app, and no setting undoes them:
         - `wpTextbox1` on MediaWiki's pages;
         - `text`, `appendtext` and `prependtext` on `/api.php`;
         - `source` in the JSON body of `/rest.php/`.
+    - The passwords when signing in:
+        - `wpPassword` on MediaWiki's pages;
+        - `lgpassword` and `password` on `/api.php`.
+
+        They skip each rule that random passwords set off:
+
+        920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
+        932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
+        933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
+        942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
+
+        `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
+        `<img src=x onerror=x()>` sent as a password reach MediaWiki;
+        `<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
 
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies when the query has a parameter of the same name.
@@ -1192,6 +1231,27 @@ The changes hold in front of every app, and no setting undoes them:
     Each name contains `.forward`, a file in a home folder. So 930120 refused
     every report the web app sent. The keys' values keep every rule.
 
+    The passwords in a body:
+    - on `/auth`, `/settings/migration` and `/settings/delete`, and the paths
+      under them:
+        - `user[password]`, `user[password_confirmation]` and
+          `user[current_password]`;
+        - `account_migration[current_password]` and
+          `form_redirect[current_password]`;
+        - `form_delete_confirmation[password]`;
+    - `password` on `/api/v1/accounts`, in form data or JSON.
+
+    They skip each rule that random passwords set off:
+
+    920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
+    932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
+    933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
+    942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
+
+    `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
+    `<img src=x onerror=x()>` sent as a password reach Mastodon;
+    `<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
+
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies when the query has a parameter of the same name.
 
@@ -1324,6 +1384,19 @@ The changes hold in front of every app, and no setting undoes them:
       saves.
     - `name` on `/remote.php/dav/systemtags/`, a new tag.
 
+    `password` in the body of `/login`, the password when signing in, skips each
+    rule that random passwords set off:
+
+    920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
+    932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
+    933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
+    942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
+
+    It applies only when the query has no `password` parameter. `' OR '1'='1`,
+    `../../etc/passwd`, `; cat /etc/passwd` and `<img src=x onerror=x()>` sent
+    as the password reach Nextcloud; `<script>alert(1)</script>` and
+    `javascript:alert(1)` are still refused.
+
     Some fields hold sentences a person writes:
     - `note`, a share's note, on `apps/files_sharing/api/v1/shares` of the OCS
       API and on each share under it;