4 Commits

Include renames

Author	SHA1	Message	Date
sneak	90e936d9a0	Core Rule Set: random passwords pass on the remaining password fields (closes #288) ... Each app's sign-in, sign-up, password change and reset fields that had no exclusion now skip the 35 rules random passwords set off, on that app's paths and only when the query has no field of that name. Added gitea, Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST password, Drupal's forms and JSON, MediaWiki retype and password on the pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset, change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's clients send a hash, which needs no exclusion. Model: opus-5-5	2026-11-10 16:40:22 +00:00
clawbot	3268ec95c1	Core Rule Set: random passwords pass at sign-in (closes #276) ... A password manager's random password set off 35 Core Rule Set rules, about 1 in 40 refused. The password fields the app exclusions name now skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki wpPassword, lgpassword and password, Mastodon's sign-in, sign-up, password change, move and delete passwords, and Nextcloud's sign-in password. The tests draw 2,000 random passwords from a fixed seed, plus one rare password for each rule the 2,000 do not set off. Those that set off a rule in a field no exclusion names are sent to every password field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and `<img src=x onerror=x()>` sent as a password now pass; `<script>alert(1)</script>` and `javascript:alert(1)` are still refused. Model: opus-5-5	2026-11-10 15:57:59 +01:00
clawbot	183a6072d5	Core Rule Set: Mastodon's email field passes ordinary addresses (closes #273) ... user[email] on /auth and the paths under it skips 930120, 932120 and 932260. They refused signing up, signing in and resetting a password with addresses such as python3@example.com, powershell@example.com and jane.profile@example.com. The field keeps 932250 and every other rule. Recorded from Mastodon 4.7.5: sign-up, sign-in, password reset and an email change. Model: opus-5-5	2026-11-10 06:43:23 +01:00
clawbot	20e4b3b080	Core Rule Set: Mastodon's ordinary requests pass by default (closes #238) ... Adds mastodon.conf, the twelfth change. On Mastodon's paths, the fields that carry a search, a name, a title, an address, a password or free text skip the four rules that read them as commands or system files. They cover the API and the web app's JSON, the admin and settings pages, sign-up and sign-in, and the objects other servers deliver to an inbox. A post's text skips 932125, 932230 and 932235 too. Hashtags and sign-up usernames skip only 932120 and 932260. Uploaded file names skip 932180, a report's forward keys skip 930120 by name, and the Accept header of a link lookup skips 920600 on profile and post links. The requests recorded from Mastodon 4.7.5 pass at the defaults and while bodies are read. Model: opus-5-5	2026-11-10 05:43:18 +01:00