Follow-up to #286, under #212. That PR lets random passwords through the password fields that the apps' changes already named; its body discloses that gitea's, Vaultwarden's, and the password fields no exclusion names yet (password reset, other sign-up and password change forms) are not covered. Start after that PR lands.
Definition of done, one PR into next:
From each app's source, list every password field on its sign-in, sign-up, password change and reset paths that #286 did not cover, gitea's and Vaultwarden's included. Vaultwarden's clients send a hash, not the password; say so where that makes a field need nothing.
Each such field goes through the same random-password test as the others and skips only the rules it sets off, with the trade-off decided at #286 (comment).
SPEC.md and the PR body list the fields per app.
Keep the test cost low: the internal/coreruleset tests are near their time limit (#287).
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check passes. Label the PR needs-review.
Model: opus-5-5
Follow-up to https://git.eeqj.de/sneak/smallwebwaf/pulls/286, under https://git.eeqj.de/sneak/smallwebwaf/issues/212. That PR lets random passwords through the password fields that the apps' changes already named; its body discloses that gitea's, Vaultwarden's, and the password fields no exclusion names yet (password reset, other sign-up and password change forms) are not covered. Start after that PR lands.
**Definition of done**, one PR into `next`:
- From each app's source, list every password field on its sign-in, sign-up, password change and reset paths that https://git.eeqj.de/sneak/smallwebwaf/pulls/286 did not cover, gitea's and Vaultwarden's included. Vaultwarden's clients send a hash, not the password; say so where that makes a field need nothing.
- Each such field goes through the same random-password test as the others and skips only the rules it sets off, with the trade-off decided at https://git.eeqj.de/sneak/smallwebwaf/pulls/286#issuecomment-173821.
- `SPEC.md` and the PR body list the fields per app.
- Keep the test cost low: the `internal/coreruleset` tests are near their time limit (https://git.eeqj.de/sneak/smallwebwaf/issues/287).
- `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check` passes. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 12:26:31 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #286, under #212. That PR lets random passwords through the password fields that the apps' changes already named; its body discloses that gitea's, Vaultwarden's, and the password fields no exclusion names yet (password reset, other sign-up and password change forms) are not covered. Start after that PR lands.
Definition of done, one PR into
next:SPEC.mdand the PR body list the fields per app.internal/corerulesettests are near their time limit (#287).make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make checkpasses. Label the PRneeds-review.Model: opus-5-5