Core Rule Set: random passwords pass on the remaining password fields (closes #288)

Each app's sign-in, sign-up, password change and reset fields that had no
exclusion now skip the 35 rules random passwords set off, on that app's
paths and only when the query has no field of that name. Added gitea,
Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST
password, Drupal's forms and JSON, MediaWiki retype and password on the
pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset,
change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's
clients send a hash, which needs no exclusion.

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -25,6 +25,12 @@ const mediawikiUpload = "/wiki/Special:Upload"
 // mediawikiSignIn is the address MediaWiki's sign-in form posts to.
 const mediawikiSignIn = "/index.php?title=Special:UserLogin"
 
+// mediawikiAccountChange is the page that changes a password.
+const mediawikiAccountChange = "/wiki/Special:ChangeCredentials"
+
+// mediawikiSignUp is the page that creates an account.
+const mediawikiSignUp = "/wiki/Special:CreateAccount"
+
 // mediawikiMove is the address MediaWiki's form for moving a page posts to.
 const mediawikiMove = "/index.php?title=Special:MovePage&action=submit"
 
@@ -236,6 +242,60 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 }
 
+func TestMediaWikiSignUpAndPasswordChangeFieldsPass(t *testing.T) {
+	t.Parallel()
+
+	// The form that changes a password posts to this subpage.
+	const subpage = "/MediaWiki%5CAuth%5CPasswordAuthenticationRequest"
+
+	change := []string{passwordKey, retypeKey}
+	retype := []string{retypeKey}
+
+	wantPasswordFieldsPass(t, []passwordFields{
+		{mediawikiSignUp, formData, retype},
+		{"/index.php/Special:CreateAccount", formData, retype},
+		{"/index.php?title=Special:CreateAccount&returnto=Main_Page", formData, retype},
+		{"/wiki/Special:UserLogin", formData, retype},
+		{mediawikiSignIn, formData, retype},
+		{mediawikiAccountChange, formData, change},
+		{mediawikiAccountChange + subpage, formData, change},
+		{"/index.php/Special:ChangeCredentials", formData, change},
+		{"/index.php?title=Special:ChangeCredentials" + subpage, formData, change},
+		{"/w/index.php?title=Special:ChangeCredentials", formData, change},
+		{mediawikiAPI, formData, retype},
+	})
+}
+
+// Other apps use the names password and retype too. So these fields keep every
+// rule on any page that does not take them, whatever title the query names.
+func TestMediaWikiPasswordFieldsStayCheckedOffTheirPages(t *testing.T) {
+	t.Parallel()
+
+	const appPath = "/index.php/apps/mail/api/accounts"
+
+	crs := readingBodies(t)
+
+	for _, sent := range []struct{ target, name string }{
+		{appPath, passwordKey},
+		{appPath, retypeKey},
+		{appPath + "?title=Special:ChangeCredentials", passwordKey},
+		{appPath + "?title=Special:CreateAccount", retypeKey},
+		{"/index.php?title=Main_Page", passwordKey},
+		{"/index.php/Main_Page", retypeKey},
+		{"/wiki/Main_Page", passwordKey},
+		{"/wiki/Special:ChangeCredentialsExample", passwordKey},
+		{mediawikiSignUp, passwordKey},
+		{"/index.php?title=Special:CreateAccount", passwordKey},
+	} {
+		r := request{http.MethodPost, sent.target, []string{formData}}
+
+		body := formBody(sent.name, "' OR '1'='1")
+		if got, _ := inspectBody(t, crs, r, body); got.Score < mediawikiThreshold {
+			t.Errorf("POST %s %s let through: %+v", sent.target, sent.name, got)
+		}
+	}
+}
+
 func TestMediaWikiPasswordsPass(t *testing.T) {
 	t.Parallel()