Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sneak
|
90e936d9a0 |
No files matched your search
@@ -871,7 +871,7 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
- `retype` on `/user/sign_up`, `/user/link_account_signup`,
|
||||
`/user/settings/change_password` and `/user/settings/account`.
|
||||
- `old_password` on `/user/settings/account`.
|
||||
- `password` in the JSON body of `/api/v1/admin/users` and the paths
|
||||
- `password` in the JSON body of `/api/v1/admin/users` and each user
|
||||
under it.
|
||||
|
||||
None applies when the query has a parameter of the same name.
|
||||
@@ -1042,10 +1042,10 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
- The other passwords, for the same rules:
|
||||
- `pass[pass1]`, `pass[pass2]` and `current_pass` on `/user/register`,
|
||||
`/user/<id>/edit` and `/admin/people/create`;
|
||||
- `pass.0.value` and `pass.0.existing` in the JSON body of
|
||||
- `pass.value`, `pass.0.value` and `pass.0.existing` in the JSON body of
|
||||
`/user/register` and `/user/<id>`;
|
||||
- `data.attributes.pass.value` and `data.attributes.pass.existing` in
|
||||
the JSON:API body of `/jsonapi/user/user` and the paths under it.
|
||||
the JSON:API body of `/jsonapi/user/user` and each user under it.
|
||||
- `name` when resetting a password through Drupal's JSON format on
|
||||
`/user/password`, for the same four rules.
|
||||
- `mail` in that same reset, for 932120 and 932260 only.
|
||||
@@ -1126,7 +1126,9 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
- `text`, `appendtext` and `prependtext` on `/api.php`;
|
||||
- `source` in the JSON body of `/rest.php/`.
|
||||
- The passwords when signing in, signing up and changing a password:
|
||||
- `wpPassword`, `password` and `retype` on MediaWiki's pages;
|
||||
- `wpPassword` on MediaWiki's pages;
|
||||
- `password` and `retype` on `Special:ChangeCredentials`;
|
||||
- `retype` on `Special:CreateAccount`;
|
||||
- `lgpassword`, `password` and `retype` on `/api.php`.
|
||||
|
||||
They skip each rule that random passwords set off:
|
||||
@@ -1140,6 +1142,10 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
`<img src=x onerror=x()>` sent as a password reach MediaWiki;
|
||||
`<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
|
||||
|
||||
The path must name the special page, or be `/index.php` with a `title`
|
||||
that names it. Other apps use `password` and `retype` too, so on any
|
||||
other page those two fields keep every rule.
|
||||
|
||||
These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
|
||||
applies when the query has a parameter of the same name.
|
||||
|
||||
@@ -1452,12 +1458,25 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
`/s/<token>/authenticate/<page>`.
|
||||
- `oldpassword` and `newpassword` on `/settings/personal/changepassword`.
|
||||
- `recoveryPassword` on `/settings/users/changepassword`.
|
||||
- `oldPassword` and `newPassword` on `/apps/user_ldap/renewpassword`, which
|
||||
changes an expired password, and on
|
||||
`/apps/encryption/ajax/updatePrivateKeyPassword`.
|
||||
- `oldPassword`, `newPassword` and `confirmPassword` on
|
||||
`/apps/encryption/ajax/changeRecoveryPassword`.
|
||||
- `recoveryPassword` and `confirmPassword` on
|
||||
`/apps/encryption/ajax/adminRecovery`.
|
||||
- `password` on the OCS API's `person/check`, which checks a sign-in, and
|
||||
`core/apppassword/confirm`, which confirms the password.
|
||||
- `password` on the OCS API's `cloud/users` and the share API's
|
||||
`apps/files_sharing/api/v1/shares`, and each user or share under them.
|
||||
`apps/files_sharing/api/v1/shares`, each user or share under them, and a
|
||||
share's `send-email`.
|
||||
- `value` on the OCS API's `cloud/users/<id>` when the body's `key` is
|
||||
`password`. A body with more than one `key`, or a `key` or `value` in the
|
||||
query, gets none of this.
|
||||
|
||||
`password` on `/login/flow/apptoken` and `/login/v2/apptoken` holds a
|
||||
generated app token, so it needs no exclusion.
|
||||
|
||||
Some fields hold sentences a person writes:
|
||||
- `note`, a share's note, on `apps/files_sharing/api/v1/shares` of the OCS
|
||||
API and on each share under it;
|
||||
|
||||
@@ -908,31 +908,31 @@ func wantPasswordFieldsPass(t *testing.T, fields []passwordFields) {
|
||||
}
|
||||
}
|
||||
|
||||
// giteaPasswordFields are gitea's password fields, each sent to one of the
|
||||
// paths that takes it.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var giteaPasswordFields = []passwordFields{
|
||||
{"/user/login", formData, []string{passwordKey}},
|
||||
{"/user/sign_up", formData, []string{passwordKey, retypeKey}},
|
||||
{"/user/link_account_signin", formData, []string{passwordKey}},
|
||||
{"/user/link_account_signup", formData, []string{passwordKey, retypeKey}},
|
||||
{"/user/activate", formData, []string{passwordKey}},
|
||||
{"/user/recover_account", formData, []string{passwordKey}},
|
||||
{"/user/settings/change_password", formData, []string{passwordKey, retypeKey}},
|
||||
{"/user/settings/account", formData, []string{"old_password", passwordKey, retypeKey}},
|
||||
{"/user/settings/account/delete", formData, []string{passwordKey}},
|
||||
{"/-/admin/users/new", formData, []string{passwordKey}},
|
||||
{"/-/admin/users/1/edit", formData, []string{passwordKey}},
|
||||
{"/admin/users/1/edit", formData, []string{passwordKey}},
|
||||
{"/api/v1/admin/users", jsonBody, []string{passwordKey}},
|
||||
{"/api/v1/admin/users/alice", jsonBody, []string{passwordKey}},
|
||||
}
|
||||
|
||||
func TestGiteaPasswordsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
wantPasswordFieldsPass(t, giteaPasswordFields)
|
||||
// gitea's password fields, each sent to one of the paths that takes it.
|
||||
fields := []passwordFields{
|
||||
{"/user/login", formData, []string{passwordKey}},
|
||||
{"/user/sign_up", formData, []string{passwordKey, retypeKey}},
|
||||
{"/user/link_account_signin", formData, []string{passwordKey}},
|
||||
{"/user/link_account_signup", formData, []string{passwordKey, retypeKey}},
|
||||
{"/user/activate", formData, []string{passwordKey}},
|
||||
{"/user/recover_account", formData, []string{passwordKey}},
|
||||
{"/user/settings/change_password", formData, []string{passwordKey, retypeKey}},
|
||||
{
|
||||
"/user/settings/account", formData,
|
||||
[]string{"old_password", passwordKey, retypeKey},
|
||||
},
|
||||
{"/user/settings/account/delete", formData, []string{passwordKey}},
|
||||
{"/-/admin/users/new", formData, []string{passwordKey}},
|
||||
{"/-/admin/users/1/edit", formData, []string{passwordKey}},
|
||||
{"/admin/users/1/edit", formData, []string{passwordKey}},
|
||||
{"/api/v1/admin/users", jsonBody, []string{passwordKey}},
|
||||
{"/api/v1/admin/users/alice", jsonBody, []string{passwordKey}},
|
||||
}
|
||||
|
||||
wantPasswordFieldsPass(t, fields)
|
||||
}
|
||||
|
||||
func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
|
||||
@@ -948,19 +948,22 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
|
||||
{nextcloudSignIn, passwordField},
|
||||
{mediawikiAPI, passwordField},
|
||||
{mediawikiAPI, "lgpassword="},
|
||||
{mediawikiAPI, "retype="},
|
||||
{mediawikiAPI, retypeKey + "="},
|
||||
{mediawikiAccountChange, passwordField},
|
||||
{mediawikiAccountChange, "retype="},
|
||||
{mediawikiAccountChange, retypeKey + "="},
|
||||
{mediawikiSignUp, retypeKey + "="},
|
||||
{"/user/sign_up", passwordField},
|
||||
{"/user/settings/account", "old_password="},
|
||||
{wpLogin, "pass1="},
|
||||
{wpLogin, "post_password="},
|
||||
{"/wp-admin/profile.php", "pass2="},
|
||||
{"/wp-json/wp/v2/users", passwordField},
|
||||
{drupalRegister, "pass%5Bpass1%5D="},
|
||||
{"/user/1/edit", "current_pass="},
|
||||
{"/auth/challenge", "form_challenge%5Bcurrent_password%5D="},
|
||||
{"/login/confirm", passwordField},
|
||||
{"/settings/personal/changepassword", "newpassword="},
|
||||
{"/apps/encryption/ajax/adminRecovery", "confirmPassword="},
|
||||
{"/admin", "token="},
|
||||
} {
|
||||
r := request{
|
||||
|
||||
@@ -228,47 +228,47 @@ SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/user/login$" \
|
||||
# the same rules:
|
||||
# pass[pass1], pass[pass2], current_pass: the forms at /user/register,
|
||||
# /user/<id>/edit and /admin/people/create
|
||||
# json.pass.0.value, json.pass.0.existing: a client signing up or changing the
|
||||
# password in Drupal's JSON format
|
||||
# json.pass.value, json.pass.0.value, json.pass.0.existing: a client signing up
|
||||
# or changing the password in Drupal's JSON format
|
||||
# json.data.attributes.pass.value, .existing: a JSON:API client doing the same
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:user/register|user/[0-9]+(?:/edit)?|admin/people/create|jsonapi/user/user(?:/[^/]+)?)$" \
|
||||
"id:900820,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.0\.(?:value|existing)|json\.data\.attributes\.pass\.(?:value|existing))$/"
|
||||
SecRule &ARGS_GET:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:pass\[pass[12]\]|current_pass|json\.pass\.(?:value|0\.(?:value|existing))|json\.data\.attributes\.pass\.(?:value|existing))$/"
|
||||
|
||||
# A person's name and email address, when signing up, when editing an
|
||||
# account and when commenting without an account. A name of python3 refused
|
||||
|
||||
@@ -201,6 +201,7 @@ func TestDrupalPasswordFieldsPass(t *testing.T) {
|
||||
{"/user/1/edit", formData, []string{"current_pass", pass[0], pass[1]}},
|
||||
{"/admin/people/create", formData, pass},
|
||||
{drupalJSONRegister, jsonBody, []string{value}},
|
||||
{drupalJSONRegister, jsonBody, []string{"pass.value"}},
|
||||
{"/user/1?_format=json", jsonBody, []string{value, "pass.0.existing"}},
|
||||
{
|
||||
"/jsonapi/user/user/86e2fbf4-0c01-4e2d-9c05-9a56e07f3e53", jsonBody,
|
||||
|
||||
@@ -299,7 +299,7 @@ SecRule REQUEST_FILENAME \
|
||||
# old_password: changing the password
|
||||
# json.password: creating or editing a user through the admin API
|
||||
SecRule REQUEST_FILENAME "@rx ^/user/(?:login|sign_up|link_account_signin|link_account_signup|activate|recover_account|settings/(?:change_password|account(?:/delete)?))$|^/(?:-/)?admin/users/(?:new|[0-9]+/edit)$|^/api/v1/admin/users(?:/[^/]+)?$" \
|
||||
"id:900641,phase:1,pass,nolog,chain"
|
||||
"id:900650,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:password|retype|old_password|json\.password)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:password|retype|old_password|json\.password)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:password|retype|old_password|json\.password)$/,\
|
||||
|
||||
@@ -108,10 +108,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php(?:$|/.)|^/wiki/" \
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^wp(?:summary|uploaddescription|name|password|oldtitle|newtitlemain|reason)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^wp(?:summary|uploaddescription|name|password|oldtitle|newtitlemain|reason)$/"
|
||||
|
||||
# The passwords skip each rule random passwords set off, on MediaWiki's pages:
|
||||
# These passwords skip each rule random passwords set off, on MediaWiki's pages:
|
||||
# wpPassword: signing in and signing up
|
||||
# password: changing the password at Special:ChangeCredentials
|
||||
# retype: signing up and changing the password
|
||||
# and on /api.php:
|
||||
# lgpassword: signing in with action=login
|
||||
# password, retype: action=clientlogin, createaccount and
|
||||
@@ -119,42 +117,42 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php(?:$|/.)|^/wiki/" \
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php(?:$|/.)|^/wiki/" \
|
||||
"id:900917,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_FILENAME|ARGS_GET_NAMES "@rx ^/(?:w/)?index\.php/.|^/wiki/|^title$" "chain"
|
||||
SecRule &ARGS_GET:/^(?:wppassword|password|retype)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:wppassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:wppassword|password|retype)$/"
|
||||
SecRule &ARGS_GET:wpPassword "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:wpPassword,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:wpPassword"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:w/)?api\.php$" \
|
||||
"id:900918,phase:1,pass,nolog,chain"
|
||||
@@ -195,6 +193,94 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?api\.php$" \
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:lgpassword|password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:lgpassword|password|retype)$/"
|
||||
|
||||
# Other apps use the names password and retype too, and these exclusions apply
|
||||
# in front of every app. So these two fields skip the same rules only on the
|
||||
# pages that take them:
|
||||
# password, retype: changing the password at Special:ChangeCredentials
|
||||
# retype: signing up at Special:CreateAccount
|
||||
# The path names the page, or the path is /index.php and title names it. A title
|
||||
# on any other path does not count, so another app's paths under /index.php/
|
||||
# keep every rule.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/Special:ChangeCredentials(?:/|$)" \
|
||||
"id:900919,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?Special:ChangeCredentials(?:/|$)" "chain"
|
||||
SecRule &ARGS_GET:/^(?:password|retype)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:password|retype)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:password|retype)$/"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/Special:CreateAccount(?:/|$)" \
|
||||
"id:900920,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?Special:CreateAccount(?:/|$)" "chain"
|
||||
SecRule &ARGS_GET:retype "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:retype,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:retype"
|
||||
|
||||
# Wikitext: the edit form sends it in wpTextbox1, the API in text, appendtext
|
||||
# or prependtext, and the REST API in the JSON field source. Each of these
|
||||
# rules refused saving or previewing a page whose wikitext held a template, a
|
||||
|
||||
@@ -28,6 +28,9 @@ const mediawikiSignIn = "/index.php?title=Special:UserLogin"
|
||||
// mediawikiAccountChange is the page that changes a password.
|
||||
const mediawikiAccountChange = "/wiki/Special:ChangeCredentials"
|
||||
|
||||
// mediawikiSignUp is the page that creates an account.
|
||||
const mediawikiSignUp = "/wiki/Special:CreateAccount"
|
||||
|
||||
// mediawikiMove is the address MediaWiki's form for moving a page posts to.
|
||||
const mediawikiMove = "/index.php?title=Special:MovePage&action=submit"
|
||||
|
||||
@@ -242,16 +245,55 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
|
||||
func TestMediaWikiSignUpAndPasswordChangeFieldsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
// The form that changes a password posts to this subpage.
|
||||
const subpage = "/MediaWiki%5CAuth%5CPasswordAuthenticationRequest"
|
||||
|
||||
change := []string{passwordKey, retypeKey}
|
||||
retype := []string{retypeKey}
|
||||
|
||||
wantPasswordFieldsPass(t, []passwordFields{
|
||||
{"/wiki/Special:CreateAccount", formData, []string{retypeKey}},
|
||||
{mediawikiSignUp, formData, retype},
|
||||
{"/index.php/Special:CreateAccount", formData, retype},
|
||||
{"/index.php?title=Special:CreateAccount&returnto=Main_Page", formData, retype},
|
||||
{mediawikiAccountChange, formData, change},
|
||||
{mediawikiAccountChange + subpage, formData, change},
|
||||
{"/index.php/Special:ChangeCredentials", formData, change},
|
||||
{mediawikiAPI, formData, []string{retypeKey}},
|
||||
{"/index.php?title=Special:ChangeCredentials" + subpage, formData, change},
|
||||
{"/w/index.php?title=Special:ChangeCredentials", formData, change},
|
||||
{mediawikiAPI, formData, retype},
|
||||
})
|
||||
}
|
||||
|
||||
// Other apps use the names password and retype too. So these fields keep every
|
||||
// rule on any page that does not take them, whatever title the query names.
|
||||
func TestMediaWikiPasswordFieldsStayCheckedOffTheirPages(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
const appPath = "/index.php/apps/mail/api/accounts"
|
||||
|
||||
crs := readingBodies(t)
|
||||
|
||||
for _, sent := range []struct{ target, name string }{
|
||||
{appPath, passwordKey},
|
||||
{appPath, retypeKey},
|
||||
{appPath + "?title=Special:ChangeCredentials", passwordKey},
|
||||
{appPath + "?title=Special:CreateAccount", retypeKey},
|
||||
{"/index.php?title=Main_Page", passwordKey},
|
||||
{"/index.php/Main_Page", retypeKey},
|
||||
{"/wiki/Main_Page", passwordKey},
|
||||
{"/wiki/Special:ChangeCredentialsExample", passwordKey},
|
||||
{mediawikiSignUp, passwordKey},
|
||||
{"/index.php?title=Special:CreateAccount", passwordKey},
|
||||
} {
|
||||
r := request{http.MethodPost, sent.target, []string{formData}}
|
||||
|
||||
body := formBody(sent.name, "' OR '1'='1")
|
||||
if got, _ := inspectBody(t, crs, r, body); got.Score < mediawikiThreshold {
|
||||
t.Errorf("POST %s %s let through: %+v", sent.target, sent.name, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestMediaWikiPasswordsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
|
||||
@@ -102,50 +102,54 @@ SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:password"
|
||||
|
||||
# The other passwords, in form data or JSON, skip the same rules:
|
||||
# password: confirming the password, resetting it, a public share's password,
|
||||
# setting a share's password, creating or editing a user, and an administrator
|
||||
# password: confirming the password, resetting it, checking a sign-in with
|
||||
# person/check, a public share's password, setting a share's password or
|
||||
# sending it by email, creating or editing a user, and an administrator
|
||||
# changing a user's password
|
||||
# oldpassword, newpassword: changing the password on the settings page
|
||||
# oldPassword, newPassword: changing an expired LDAP password, and changing
|
||||
# the password of the encryption app's private key or recovery key
|
||||
# recoveryPassword: an administrator changing the password of an encrypted
|
||||
# account
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?(?:login/confirm|lostpassword/set/[^/]+/[^/]+|settings/(?:personal|users)/changepassword|s/[^/]+/authenticate/[^/]+)$|^/ocs/v[12]\.php/(?:cloud/users(?:/[^/]+)?|apps/files_sharing/api/v1/shares(?:/[^/]+)?)$" \
|
||||
# account, or setting the encryption app's recovery key
|
||||
# confirmPassword: the encryption app's recovery key, typed again
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?(?:login/confirm|lostpassword/set/[^/]+/[^/]+|settings/(?:personal|users)/changepassword|s/[^/]+/authenticate/[^/]+|apps/user_ldap/renewpassword|apps/encryption/ajax/(?:updatePrivateKeyPassword|changeRecoveryPassword|adminRecovery))$|^/ocs/v[12]\.php/(?:person/check|core/apppassword/confirm|cloud/users(?:/[^/]+)?|apps/files_sharing/api/v1/shares(?:/[^/]+(?:/send-email)?)?)$" \
|
||||
"id:900126,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword)$/"
|
||||
SecRule &ARGS_GET:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=920540;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=921200;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=930100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=930110;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932130;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932270;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932280;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932330;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932340;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933135;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933180;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942100;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942290;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942320;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=942550;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/,\
|
||||
ctl:ruleRemoveTargetById=944150;ARGS:/^(?:json\.)?(?:password|oldpassword|newpassword|recoverypassword|confirmpassword)$/"
|
||||
|
||||
# Editing a user through the OCS API can name the password as the field to
|
||||
# change: key=password&value=..., or the same in JSON. This rule is in phase 2,
|
||||
|
||||
@@ -338,8 +338,23 @@ func TestNextcloudPasswordFieldsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
password := []string{passwordKey}
|
||||
change := []string{"oldPassword", "newPassword"}
|
||||
recovery := []string{"oldPassword", "newPassword", "confirmPassword"}
|
||||
adminRecovery := []string{"recoveryPassword", "confirmPassword"}
|
||||
|
||||
wantPasswordFieldsPass(t, []passwordFields{
|
||||
{"/ocs/v1.php/person/check", formData, password},
|
||||
{"/ocs/v2.php/person/check", jsonBody, password},
|
||||
{"/ocs/v2.php/core/apppassword/confirm", jsonBody, password},
|
||||
{nextcloudShares + "/42/send-email", jsonBody, password},
|
||||
{"/apps/user_ldap/renewpassword", formData, change},
|
||||
{"/index.php/apps/user_ldap/renewpassword", formData, change},
|
||||
{"/apps/encryption/ajax/updatePrivateKeyPassword", formData, change},
|
||||
{"/index.php/apps/encryption/ajax/updatePrivateKeyPassword", formData, change},
|
||||
{"/apps/encryption/ajax/changeRecoveryPassword", formData, recovery},
|
||||
{"/index.php/apps/encryption/ajax/changeRecoveryPassword", formData, recovery},
|
||||
{"/apps/encryption/ajax/adminRecovery", formData, adminRecovery},
|
||||
{"/index.php/apps/encryption/ajax/adminRecovery", formData, adminRecovery},
|
||||
{"/login/confirm", jsonBody, password},
|
||||
{"/index.php/login/confirm", formData, password},
|
||||
{"/lostpassword/set/AbCdEf/alice", jsonBody, password},
|
||||
|
||||
Reference in new issue
Block a user