4 Commits

Include renames

Author	SHA1	Message	Date
sneak	7f8a59de04	Format Go with gofmt, then golines -m 77 (closes #215) ... script/fmt now runs golines -m 77 after gofmt, repeating golines until it changes nothing, since one pass can leave a line the next splits. script/fmt-check fails when either would change a file. script/bootstrap installs golines v0.13.0 with go install, pinned to its commit, and checks the installed version with go version -m. The tree is reformatted. The longer lines this makes are fixed by hand: nolint directives moved onto their own line above the statement, one string split, and 20 functions over funlen's 80 lines shortened or split, RunWAF and limitPercentages among them. Model: opus-5-5	2026-11-11 15:14:58 +00:00
clawbot	db0912b335	Core Rule Set: random passwords pass on the remaining password fields (closes #288) ... Each app's sign-in, sign-up, password change and reset fields that had no exclusion now skip the 35 rules random passwords set off, on that app's paths and only when the query has no field of that name. Added gitea, Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST password, Drupal's forms and JSON, MediaWiki retype and password on the pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset, change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's clients send a hash, which needs no exclusion. Model: opus-5-5	2026-11-10 19:57:58 +01:00
clawbot	f8d769fc17	Core Rule Set tests: check the recorded requests without the race detector (closes #290) ... The tests that check the apps' recorded requests move to internal/coreruleset/recorded_test.go, behind the recorded build tag. The test phase runs only those tests in a second go test, without -race. The lint phase reads the same file, with the same tag. The Gitea and WordPress tests are split in two. Their recorded-request loops become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass; their attack checks stay in the race pass as TestGiteaAttacksAreRefused and TestWordPressAttacksAreRefused. Model: opus-5-5	2026-11-10 15:26:11 +01:00
clawbot	2d83961900	Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239) ... Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to 900153. On Vaultwarden's account, organization and admin paths, names and password hints skip 930120, 932120, 932250 and 932260, and so does a security key's name. Email addresses skip 930120, 932120 and 932260 there, on the two-factor email paths and when signing in with another device. So does the address of the admin page's test email. The data breach report's address does too. The encrypted names of uploaded attachments and file sends skip 920120. Requests recorded from Vaultwarden 1.37.5 through the web vault, the Bitwarden command line client and the admin page pass at the defaults and while bodies are read. Model: opus-5-5	2026-11-10 07:26:13 +01:00