Core Rule Set: random passwords pass at sign-in (closes #276)

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. The tests draw 2,000 random passwords from a fixed seed, plus
one rare password for each rule the 2,000 do not set off. Those that set
off a rule in a field no exclusion names are sent to every password
field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
`<img src=x onerror=x()>` sent as a password now pass;
`<script>alert(1)</script>` and `javascript:alert(1)` are still refused.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -1,8 +1,10 @@
 package coreruleset_test
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
+	"math/rand/v2"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -624,6 +626,289 @@ const passwordField = "password="
 //nolint:gochecknoglobals // a constant cannot be a list
 var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 
+// randomPassword returns a password of 20 characters, each one of the 95
+// printable ASCII characters, space included, drawn from random.
+func randomPassword(random *rand.Rand) string {
+	const length = 20
+
+	var printable []byte
+	for c := byte(' '); c <= '~'; c++ {
+		printable = append(printable, c)
+	}
+
+	password := make([]byte, length)
+	for i := range password {
+		password[i] = printable[random.IntN(len(printable))]
+	}
+
+	return string(password)
+}
+
+// rarePasswords are random passwords from randomPasswords' seed, found among
+// the first 1,000,000. Each sets off the rule named beside it, which the first
+// 2,000 do not set off.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var rarePasswords = []string{
+	"x)g|E0f)~.um%00G]<oA",   // 920270
+	"uC?mK\\U2fEbXA}~j7fPb",  // 920540
+	"4;yfIDKZYNtZT)(w-=%@",   // 921200
+	"`sAIfEVdBprjxR$/.?\\d",  // 930100
+	"Unt@1xza,:%j$/..;5y+",   // 930110
+	"VN.CVsu^3vbUS==4Q&Y@",   // 930120
+	"gJ<EcT)jhZ'`GC>cX~hM",   // 932125
+	" /\"j14y[%\\(iM]zmG%=^", // 932130
+	"\\f*q5v$]$IfS3JoY:*r1",  // 932160
+	"*e#!-z{Jq)Sqwx@k:b:}",   // 932230
+	"pErl>vR[Z7K^<f%_4,WZ",   // 932260
+	"){2P,GU}a3mYvjq^(p1^",   // 932280
+	"xw4UGJk!-8#ZE(`.ij.O",   // 932330
+	" XVw(2mN5R,+%~_f\"n<?",  // 933100
+	"0ZK1D>`RHb+RW${/(z}C",   // 933135
+	"Ep3!qqe 7$RT(_)@SLV6",   // 933180
+	"&:4WomDrn$\"(SE_D);Ja",  // 933210
+	"='nlIgN7ON\\\\mWt=Tr84", // 941120
+	"P]/C>Ef]F-<sV,&gs.[4",   // 941160
+	"<!--a\"9Ju}r!2=J-kZDd",  // 941180
+	"@`].*EJ?`Cw^8\\orD!(f",  // 942151
+	"StTj*t:IF(Uq_<aG0mya",   // 942230
+	"t,D-oJjnvL Dn!o::Int",   // 942320
+	"Z>\"{Z\\QDwqBQs%v}`nBu", // 942550
+	"`aV#3${J4,\\h.q' k\\${", // 944150
+}
+
+// randomPasswords returns 2,000 random passwords from a fixed seed, then
+// rarePasswords.
+func randomPasswords() []string {
+	const count, seed = 2000, 276
+
+	random := rand.New(rand.NewPCG(seed, seed)) //nolint:gosec // a fixed sample
+
+	passwords := make([]string, count, count+len(rarePasswords))
+	for i := range passwords {
+		passwords[i] = randomPassword(random)
+	}
+
+	return append(passwords, rarePasswords...)
+}
+
+// passwordBody returns a body of r's type, form data or JSON, that sends
+// each of passwords in the field name. Coraza checks each value of a field
+// on its own, and keeps every value of a JSON key sent more than once.
+func passwordBody(t *testing.T, r request, name string, passwords ...string) string {
+	t.Helper()
+
+	if r.headers[0] != jsonBody {
+		return formBody(name, passwords...)
+	}
+
+	values := make([]string, len(passwords))
+
+	for i, password := range passwords {
+		pair, err := json.Marshal(map[string]string{name: password})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		values[i] = strings.Trim(string(pair), "{}")
+	}
+
+	return "{" + strings.Join(values, ",") + "}"
+}
+
+// formBody returns a form data body that sends each of values in the field
+// name.
+func formBody(name string, values ...string) string {
+	fields := make([]string, len(values))
+	for i, value := range values {
+		fields[i] = url.QueryEscape(name) + "=" + url.QueryEscape(value)
+	}
+
+	return strings.Join(fields, "&")
+}
+
+// setsOffARule reports whether body, form data sent to / as a browser
+// sends it, sets off a rule in crs.
+func setsOffARule(crs *coreruleset.CoreRuleSet, body string) bool {
+	req := httptest.NewRequestWithContext(context.Background(), http.MethodPost,
+		"http://git.example/", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Content-Length", strconv.Itoa(len(body)))
+	req.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:131.0) "+
+		"Gecko/20100101 Firefox/131.0")
+	req.Header.Set("Accept", "text/html")
+
+	// The body is read from memory, which cannot fail.
+	result, _, _ := crs.Inspect(req, netip.MustParseAddr("203.0.113.9"), req.Body)
+
+	return len(result.RuleIDs) > 0
+}
+
+// findMisfiringPasswords returns those of randomPasswords that set off a
+// rule in the form data field password on /, which no exclusion names, while
+// bodies are read. It runs once, for every test that asks. Each body sends
+// ten passwords, and a body that sets off a rule is sent again one password
+// at a time.
+//
+//nolint:gochecknoglobals // the tests share it
+var findMisfiringPasswords = sync.OnceValues(func() ([]string, error) {
+	const workers, perBody = 16, 10
+
+	crs, err := loaderFor(coreruleset.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+	})()
+	if err != nil {
+		return nil, err
+	}
+
+	passwords := randomPasswords()
+	misfires := make([]bool, len(passwords))
+
+	var inspecting sync.WaitGroup
+
+	for worker := range workers {
+		inspecting.Go(func() {
+			for first := worker * perBody; first < len(passwords); first += workers * perBody {
+				last := min(first+perBody, len(passwords))
+				if !setsOffARule(crs, formBody("password", passwords[first:last]...)) {
+					continue
+				}
+
+				for i := first; i < last; i++ {
+					misfires[i] = setsOffARule(crs, formBody("password", passwords[i]))
+				}
+			}
+		})
+	}
+
+	inspecting.Wait()
+
+	var misfiring []string
+
+	for i, password := range passwords {
+		if misfires[i] {
+			misfiring = append(misfiring, password)
+		}
+	}
+
+	return misfiring, nil
+})
+
+// misfiringPasswords returns those of randomPasswords that set off a rule in
+// a field no exclusion names. The rules that misfire on a password read its
+// value, not the name of its field. So the other random passwords set off no
+// rule in any field.
+func misfiringPasswords(t *testing.T) []string {
+	t.Helper()
+
+	misfiring, err := findMisfiringPasswords()
+	if err != nil {
+		t.Fatalf("load the Core Rule Set: %v", err)
+	}
+
+	for _, rare := range rarePasswords {
+		if !slices.Contains(misfiring, rare) {
+			t.Fatalf("%q sets off no rule in a field no exclusion names", rare)
+		}
+	}
+
+	return misfiring
+}
+
+// wantRandomPasswordsPass checks that none of randomPasswords, sent in the
+// field name of r's body, is refused while bodies are read. r's Content-Type
+// is form data or JSON. Only the passwords misfiringPasswords returns set off
+// a rule in some field, so only they are sent, all in one body. If it is
+// refused, each is sent again on its own, to name those refused.
+func wantRandomPasswordsPass(t *testing.T, r request, name string) {
+	t.Helper()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := readingBodies(t)
+	misfiring := misfiringPasswords(t)
+
+	body := passwordBody(t, r, name, misfiring...)
+	if len(body) > bodyLimit {
+		t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
+	}
+
+	if got, _ := inspectBody(t, crs, r, body); got.Score < threshold {
+		return
+	}
+
+	for _, password := range misfiring {
+		body := passwordBody(t, r, name, password)
+		if got, _ := inspectBody(t, crs, r, body); got.Score >= threshold {
+			t.Errorf("%s %s %s %q refused: %+v", r.method, r.target, name,
+				password, got)
+		}
+	}
+}
+
+// wantPasswordAttacksPass checks that an SQL injection, a path traversal, a
+// shell command and a script in an event handler, each sent as the whole
+// password in the field name of r's body, pass while bodies are read.
+func wantPasswordAttacksPass(t *testing.T, r request, name string) {
+	t.Helper()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	for _, attack := range []string{
+		"' OR '1'='1", pathTraversal, "; cat /etc/passwd",
+		"<img src=x onerror=x()>",
+	} {
+		body := passwordBody(t, r, name, attack)
+		if got, _ := inspectBody(t, readingBodies(t), r, body); got.Score >= threshold {
+			t.Errorf("%s %s %s %q refused: %+v", r.method, r.target, name,
+				attack, got)
+		}
+	}
+}
+
+// wantPasswordAttacksRefused checks that a script tag and a javascript: link,
+// each sent as the whole password in the field name of r's body, are refused
+// while bodies are read.
+func wantPasswordAttacksRefused(t *testing.T, r request, name string) {
+	t.Helper()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	for _, attack := range []string{scriptTag, "javascript:alert(1)"} {
+		body := passwordBody(t, r, name, attack)
+		if got, _ := inspectBody(t, readingBodies(t), r, body); got.Score < threshold {
+			t.Errorf("%s %s %s %q let through: %+v", r.method, r.target, name,
+				attack, got)
+		}
+	}
+}
+
+func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := readingBodies(t)
+
+	// These fields skip the rules only when the query has no field of the
+	// same name. An SQL injection in the query is refused.
+	for _, sent := range []struct{ path, field string }{
+		{nextcloudSignIn, passwordField},
+		{mediawikiAPI, passwordField},
+		{mediawikiAPI, "lgpassword="},
+	} {
+		r := request{
+			http.MethodPost, sent.path + "?" + sent.field + "'%20OR%20'1'='1",
+			[]string{formData},
+		}
+
+		got, _ := inspectBody(t, crs, r, sent.field+"example")
+		if got.Score < threshold {
+			t.Errorf("POST %s let through: %+v", r.target, got)
+		}
+	}
+}
+
 // wantRecordedRequestsPass checks that none of the recorded ordinary
 // requests in the file name in testdata is refused, at the defaults and
 // while bodies are read. A request with neither a body nor a Content-Type
@@ -1348,6 +1633,16 @@ func TestWordPressBodyNamesAndAddressesAreExcludedOnlyThere(t *testing.T) {
 	wantBody(t, crs, comment, "url=ls+-la", matched(932250), "url=ls+-la")
 }
 
+func TestWordPressPasswordsPass(t *testing.T) {
+	t.Parallel()
+
+	signIn := request{http.MethodPost, wpLogin, []string{formData}}
+
+	wantRandomPasswordsPass(t, signIn, "pwd")
+	wantPasswordAttacksPass(t, signIn, "pwd")
+	wantPasswordAttacksRefused(t, signIn, "pwd")
+}
+
 func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
@@ -1405,6 +1700,9 @@ const injection = "1' OR '1'='1"
 // scriptTag is a script injection, not escaped.
 const scriptTag = "<script>alert(1)</script>"
 
+// pathTraversal is a path traversal, not escaped.
+const pathTraversal = "../../etc/passwd"
+
 // readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {