3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	95e483e5e5	Core Rule Set: random passwords pass at sign-in (closes #276) ... A password manager's random password set off 35 Core Rule Set rules, about 1 in 40 refused. The password fields the app exclusions name now skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki wpPassword, lgpassword and password, Mastodon's sign-in, sign-up, password change, move and delete passwords, and Nextcloud's sign-in password. The tests draw 2,000 random passwords from a fixed seed, plus one rare password for each rule the 2,000 do not set off. Those that set off a rule in a field no exclusion names are sent to every password field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and `<img src=x onerror=x()>` sent as a password now pass; `<script>alert(1)</script>` and `javascript:alert(1)` are still refused. Model: opus-5-5	2026-11-10 11:28:35 +00:00
clawbot	183a6072d5	Core Rule Set: Mastodon's email field passes ordinary addresses (closes #273) ... user[email] on /auth and the paths under it skips 930120, 932120 and 932260. They refused signing up, signing in and resetting a password with addresses such as python3@example.com, powershell@example.com and jane.profile@example.com. The field keeps 932250 and every other rule. Recorded from Mastodon 4.7.5: sign-up, sign-in, password reset and an email change. Model: opus-5-5	2026-11-10 06:43:23 +01:00
clawbot	20e4b3b080	Core Rule Set: Mastodon's ordinary requests pass by default (closes #238) ... Adds mastodon.conf, the twelfth change. On Mastodon's paths, the fields that carry a search, a name, a title, an address, a password or free text skip the four rules that read them as commands or system files. They cover the API and the web app's JSON, the admin and settings pages, sign-up and sign-in, and the objects other servers deliver to an inbox. A post's text skips 932125, 932230 and 932235 too. Hashtags and sign-up usernames skip only 932120 and 932260. Uploaded file names skip 932180, a report's forward keys skip 930120 by name, and the Accept header of a link lookup skips 920600 on profile and post links. The requests recorded from Mastodon 4.7.5 pass at the defaults and while bodies are read. Model: opus-5-5	2026-11-10 05:43:18 +01:00