5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	95e483e5e5	Core Rule Set: random passwords pass at sign-in (closes #276) ... A password manager's random password set off 35 Core Rule Set rules, about 1 in 40 refused. The password fields the app exclusions name now skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki wpPassword, lgpassword and password, Mastodon's sign-in, sign-up, password change, move and delete passwords, and Nextcloud's sign-in password. The tests draw 2,000 random passwords from a fixed seed, plus one rare password for each rule the 2,000 do not set off. Those that set off a rule in a field no exclusion names are sent to every password field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and `<img src=x onerror=x()>` sent as a password now pass; `<script>alert(1)</script>` and `javascript:alert(1)` are still refused. Model: opus-5-5	2026-11-10 11:28:35 +00:00
clawbot	d70fb34f40	Core Rule Set: Drupal's JSON password reset takes an address (closes #262) ... POST /user/password?_format=json with a mail of python3@example.com or powershell@example.com was refused while bodies are read. On that path, the JSON field mail now skips 932120 and 932260, the two rules the recorded addresses set off, unless the query has a json.mail parameter. Recorded from Drupal 11.4.11. Model: opus-5-5	2026-11-10 03:09:17 +01:00
clawbot	e29dacad63	Core Rule Set: Drupal's JSON password reset passes (closes #259) ... POST /user/password?_format=json with a name of python3, powershell, ls -la or .htaccess was refused while bodies are read. On that path, the JSON field name now skips 930120, 932120, 932250 and 932260, the four rules those recorded names set off, unless the query has a json.name parameter. Recorded from Drupal 11.4.11. Model: opus-5-5	2026-11-10 00:58:08 +01:00
clawbot	3a37f82e34	Core Rule Set: more of Drupal's ordinary fields pass (closes #244) ... Names, searches and the page to return to on more Drupal paths skip the rules that misfire on them: 930120, 932120, 932250 and 932260, plus 932230 and 932235 on destination only. An email address skips 930120, 932120 and 932260; the oEmbed url only 930120 and 932120. Every Drupal path may carry a language prefix: a first segment of two or three lowercase letters, such as /fr. Requests recorded from Drupal 11.4.11 with plain words, python3, powershell, ls -la and .htaccess are added to the test data; tests show attacks and "; wget ..." still refused on each new field. Model: opus-5-5	2026-11-09 23:09:15 +01:00
clawbot	decd9b4658	Core Rule Set: Drupal's ordinary requests pass by default (closes #236) ... Adds drupal.conf, the tenth change: on Drupal's paths, the fields that carry a search, a name, a file name or an address skip the rules that refused ordinary requests there. The recorded requests from Drupal 11.4 pass at the defaults and while bodies are read; SQL injection, path traversal and script injection stay refused on those fields. Drupal's tests share the reader of recorded requests and the attack constants with the other apps' tests. Model: opus-5-5	2026-11-09 19:57:53 +01:00