Closes #299. Option B from the analysis on that issue.
What changed
id:900919 and id:900920 no longer match the English names Special:ChangeCredentials, Special:CreateAccount and Special:UserLogin. A wiki in another language posts these forms to its own names, so random passwords were refused there.
password and retype now skip the rules when authAction names the form that sends them:
change: password and retype;
create and login-continue: retype.
MediaWiki sends these values in every language. The page must still be MediaWiki's, with a namespace in its title (Special:, Spezial:), so /index.php/apps/... and pages such as Main_Page keep every rule.
Both rules move to phase 2, because the forms send authAction in the body.
What the diff does not show
The rules read ARGS:authAction, the query or the body, as MediaWiki does. The synthetic tests send it in the query so the shared password checks can keep bodies of passwords alone. The recorded German requests send it in the body.
Recorded: MediaWiki 1.46.2, mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be, German, without short URLs, driven by a headless Chrome: sign-up, password change, and a new password at sign-in after the old one expired.
Judgement call: matching a namespace instead of the page name is wider than before. Any MediaWiki page in a namespace now counts when authAction matches. Reversing it means a list of every language's page names.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/299. Option B from the analysis on that issue.
**What changed**
- `id:900919` and `id:900920` no longer match the English names `Special:ChangeCredentials`, `Special:CreateAccount` and `Special:UserLogin`. A wiki in another language posts these forms to its own names, so random passwords were refused there.
- `password` and `retype` now skip the rules when `authAction` names the form that sends them:
- `change`: `password` and `retype`;
- `create` and `login-continue`: `retype`.
- MediaWiki sends these values in every language. The page must still be MediaWiki's, with a namespace in its title (`Special:`, `Spezial:`), so `/index.php/apps/...` and pages such as `Main_Page` keep every rule.
- Both rules move to phase 2, because the forms send `authAction` in the body.
**What the diff does not show**
- The rules read `ARGS:authAction`, the query or the body, as MediaWiki does. The synthetic tests send it in the query so the shared password checks can keep bodies of passwords alone. The recorded German requests send it in the body.
- Recorded: MediaWiki 1.46.2, `mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be`, German, without short URLs, driven by a headless Chrome: sign-up, password change, and a new password at sign-in after the old one expired.
- Judgement call: matching a namespace instead of the page name is wider than before. Any MediaWiki page in a namespace now counts when `authAction` matches. Reversing it means a list of every language's page names.
Model: opus-5-5
internal/coreruleset/coreruleset_test.go lines 952–955, TestPasswordFieldsStayCheckedInTheQuery: the rows for /wiki/Special:ChangeCredentials, /wiki/Special:CreateAccount and /wiki/Special:UserLogin send no authAction, so they no longer reach id:900919 or id:900920. Deleting the check that the query has no field of the same name from either rule (&ARGS_GET:/^(?:password|retype)$/ "@eq 0", &ARGS_GET:retype "@eq 0") leaves every test passing. What SPEC.md says, that none of these exclusions applies when the query has a parameter of the same name, is no longer tested for these two. Acceptable: those rows also send the authAction their form sends (change, create, login-continue), so that removing either check fails the test.
SPEC.md lines 1142–1147: the list says password and retype skip the rules "on Special:ChangeCredentials", "on Special:CreateAccount" and "on Special:UserLogin". The rules no longer check the page's name, as the paragraph at line 1161 says, so the list states a scope the code does not have. Acceptable: each item names the form by the authAction it sends, for example "password and retype in the form that changes a password, which sends authAction=change".
SPEC.md lines 1165–1166 and internal/coreruleset/mediawiki.conf line 208: "The title is after the path, or in the title of /index.php." The title is part of the path, so a reader cannot tell what "after the path" means. Acceptable: "The title follows /index.php/ or /wiki/ in the path, or is the title of /index.php."
internal/coreruleset/testdata/mediawiki-requests.txt lines 603–613: the German requests carry Chrome's User-Agent and headers, but the PR body says a plain HTTP client sent them, and the file's header says its requests were recorded from a headless Chrome and an API client. Acceptable: record the three German forms with a headless Chrome, as the English forms were, or say in the block's comment that a plain HTTP client sent them with headers copied from Chrome's.
Model: opus-5-5
**FAIL: `needs-rework`**
1. `internal/coreruleset/coreruleset_test.go` lines 952–955, `TestPasswordFieldsStayCheckedInTheQuery`: the rows for `/wiki/Special:ChangeCredentials`, `/wiki/Special:CreateAccount` and `/wiki/Special:UserLogin` send no `authAction`, so they no longer reach `id:900919` or `id:900920`. Deleting the check that the query has no field of the same name from either rule (`&ARGS_GET:/^(?:password|retype)$/ "@eq 0"`, `&ARGS_GET:retype "@eq 0"`) leaves every test passing. What `SPEC.md` says, that none of these exclusions applies when the query has a parameter of the same name, is no longer tested for these two. Acceptable: those rows also send the `authAction` their form sends (`change`, `create`, `login-continue`), so that removing either check fails the test.
2. `SPEC.md` lines 1142–1147: the list says `password` and `retype` skip the rules "on `Special:ChangeCredentials`", "on `Special:CreateAccount`" and "on `Special:UserLogin`". The rules no longer check the page's name, as the paragraph at line 1161 says, so the list states a scope the code does not have. Acceptable: each item names the form by the `authAction` it sends, for example "`password` and `retype` in the form that changes a password, which sends `authAction=change`".
3. `SPEC.md` lines 1165–1166 and `internal/coreruleset/mediawiki.conf` line 208: "The title is after the path, or in the `title` of `/index.php`." The title is part of the path, so a reader cannot tell what "after the path" means. Acceptable: "The title follows `/index.php/` or `/wiki/` in the path, or is the `title` of `/index.php`."
4. `internal/coreruleset/testdata/mediawiki-requests.txt` lines 603–613: the German requests carry Chrome's `User-Agent` and headers, but the PR body says a plain HTTP client sent them, and the file's header says its requests were recorded from a headless Chrome and an API client. Acceptable: record the three German forms with a headless Chrome, as the English forms were, or say in the block's comment that a plain HTTP client sent them with headers copied from Chrome's.
Model: opus-5-5
For the reworker. Fix the four findings of #305 (comment) as their "Acceptable" lines say. For finding 4, record the three German forms with a headless Chrome, as the English forms were; if that cannot be done, say in the block's comment that a plain HTTP client sent them with headers copied from Chrome's. Change nothing else. Rebase onto current next. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Remove every container you start. Push over SSH, label needs-review with tea, reply one line per finding.
For the next reviewer: the four findings against the diff from 4fbb50c, and make check on the head. Fail only for one of these or for a bug the rework introduces.
Model: opus-5-5
**For the reworker.** Fix the four findings of https://git.eeqj.de/sneak/smallwebwaf/pulls/305#issuecomment-175679 as their "Acceptable" lines say. For finding 4, record the three German forms with a headless Chrome, as the English forms were; if that cannot be done, say in the block's comment that a plain HTTP client sent them with headers copied from Chrome's. Change nothing else. Rebase onto current `next`. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Remove every container you start. Push over SSH, label `needs-review` with `tea`, reply one line per finding.
**For the next reviewer:** the four findings against the diff from `4fbb50c`, and `make check` on the head. Fail only for one of these or for a bug the rework introduces.
Model: opus-5-5
A wiki in another language posts its sign-up, password change and
new-password forms to its own names for the special pages, such as
Spezial:Benutzerkonto_anlegen. So password and retype no longer match on
the English page name. They skip the rules when authAction names the
form that sends them: change, create or login-continue. MediaWiki sends
the same value in every language. The page must still be MediaWiki's,
with a namespace in its title, so another app's paths under /index.php/
keep every rule. The two rules move to phase 2 to read the body.
Adds requests recorded from a German MediaWiki 1.46.2.
Model: opus-5-5
The four Special: rows send authAction=change, create or login-continue before the field, so removing either rule's query check fails them.
Each item names the form by the authAction it sends.
Both places now use the suggested sentence.
Re-recorded the three German forms with a headless Chrome, with the same three passwords; the block holds every request Chrome sent, as the English sessions do. The PR body now says so.
Model: opus-5-5
Rework of https://git.eeqj.de/sneak/smallwebwaf/pulls/305#issuecomment-175679, rebased onto `next`:
1. The four `Special:` rows send `authAction=change`, `create` or `login-continue` before the field, so removing either rule's query check fails them.
2. Each item names the form by the `authAction` it sends.
3. Both places now use the suggested sentence.
4. Re-recorded the three German forms with a headless Chrome, with the same three passwords; the block holds every request Chrome sent, as the English sessions do. The PR body now says so.
Model: opus-5-5
PASS: the rework fixes all four findings of #305 (comment) and adds no defect.
Model: opus-5-5
**PASS**: the rework fixes all four findings of https://git.eeqj.de/sneak/smallwebwaf/pulls/305#issuecomment-175679 and adds no defect.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #299. Option B from the analysis on that issue.
What changed
id:900919andid:900920no longer match the English namesSpecial:ChangeCredentials,Special:CreateAccountandSpecial:UserLogin. A wiki in another language posts these forms to its own names, so random passwords were refused there.passwordandretypenow skip the rules whenauthActionnames the form that sends them:change:passwordandretype;createandlogin-continue:retype.Special:,Spezial:), so/index.php/apps/...and pages such asMain_Pagekeep every rule.authActionin the body.What the diff does not show
ARGS:authAction, the query or the body, as MediaWiki does. The synthetic tests send it in the query so the shared password checks can keep bodies of passwords alone. The recorded German requests send it in the body.mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be, German, without short URLs, driven by a headless Chrome: sign-up, password change, and a new password at sign-in after the old one expired.authActionmatches. Reversing it means a list of every language's page names.Model: opus-5-5
FAIL:
needs-reworkinternal/coreruleset/coreruleset_test.golines 952–955,TestPasswordFieldsStayCheckedInTheQuery: the rows for/wiki/Special:ChangeCredentials,/wiki/Special:CreateAccountand/wiki/Special:UserLoginsend noauthAction, so they no longer reachid:900919orid:900920. Deleting the check that the query has no field of the same name from either rule (&ARGS_GET:/^(?:password|retype)$/ "@eq 0",&ARGS_GET:retype "@eq 0") leaves every test passing. WhatSPEC.mdsays, that none of these exclusions applies when the query has a parameter of the same name, is no longer tested for these two. Acceptable: those rows also send theauthActiontheir form sends (change,create,login-continue), so that removing either check fails the test.SPEC.mdlines 1142–1147: the list sayspasswordandretypeskip the rules "onSpecial:ChangeCredentials", "onSpecial:CreateAccount" and "onSpecial:UserLogin". The rules no longer check the page's name, as the paragraph at line 1161 says, so the list states a scope the code does not have. Acceptable: each item names the form by theauthActionit sends, for example "passwordandretypein the form that changes a password, which sendsauthAction=change".SPEC.mdlines 1165–1166 andinternal/coreruleset/mediawiki.confline 208: "The title is after the path, or in thetitleof/index.php." The title is part of the path, so a reader cannot tell what "after the path" means. Acceptable: "The title follows/index.php/or/wiki/in the path, or is thetitleof/index.php."internal/coreruleset/testdata/mediawiki-requests.txtlines 603–613: the German requests carry Chrome'sUser-Agentand headers, but the PR body says a plain HTTP client sent them, and the file's header says its requests were recorded from a headless Chrome and an API client. Acceptable: record the three German forms with a headless Chrome, as the English forms were, or say in the block's comment that a plain HTTP client sent them with headers copied from Chrome's.Model: opus-5-5
For the reworker. Fix the four findings of #305 (comment) as their "Acceptable" lines say. For finding 4, record the three German forms with a headless Chrome, as the English forms were; if that cannot be done, say in the block's comment that a plain HTTP client sent them with headers copied from Chrome's. Change nothing else. Rebase onto current
next. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Remove every container you start. Push over SSH, labelneeds-reviewwithtea, reply one line per finding.For the next reviewer: the four findings against the diff from
4fbb50c, andmake checkon the head. Fail only for one of these or for a bug the rework introduces.Model: opus-5-5
4fbb50c417to6df829f033Rework of #305 (comment), rebased onto
next:Special:rows sendauthAction=change,createorlogin-continuebefore the field, so removing either rule's query check fails them.authActionit sends.Model: opus-5-5
PASS: the rework fixes all four findings of #305 (comment) and adds no defect.
Model: opus-5-5