Once the extension has been code reviewed and tested on staging, have it security reviewed before deployment to the main cluster.
http://git.wikimedia.org/summary/?r=mediawiki/extensions/ORES.git
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Invalid | Halfak | T112319 Revscoring integration as a beta feature | |||
| Resolved | None | T120183 Improve mwext-ORES integration with RecentChanges | |||
| Resolved | None | T120923 Ask for consensus to enable and deploy ORES extension to production | |||
| Resolved | awight | T112856 Write prototype MediaWiki extension to surface ORES scores | |||
| Resolved | Halfak | T112995 Include model version in ORES response structure | |||
| Declined | None | T115785 Set up periodic maintenance jobs for ORES cache | |||
| Resolved | awight | T120921 Generalize how RecentChanges flags are rolled up, to better support flags added by extensions | |||
| Resolved | awight | T120922 Security review of the ORES extension |
Event Timeline
Comment Actions
Is this a different component from what we did in T110072: Security Review of Revscoring?
Comment Actions
Yes, this is much simpler, happily. It's an ORES client which integrates with MediaWiki. Let me know if you'd like to see more documentation anywhere in the source code!
Comment Actions
Cool. Please link to the code repo, any documentation about the project,
and a dev/demo setup if you have one. What is your timeline on this?
Comment Actions
Thank you for doing this: http://git.wikimedia.org/summary/?r=mediawiki/extensions/ORES.git
Comment Actions
This looks good, you all. No issues found:
General Observations
- Positive
- Use of MWHttpRequest in Api.php verifies SSL certificate chain by default
- Database access uses built-in MW methods to avoid SQL injection
- No input from client-side used (aside from revision content)
- No user-controlled input is re-displayed in the browser
- Negative
- None
- Neutral
- None
Issues
None
Configuration Recommendations
None
Files
./extension.json
OK
./includes/Api.php
OK
./includes/Cache.php
OK
./includes/FetchScoreJob.php
OK
./includes/Hooks.php
OK
./includes/Scoring.php
OK
./maintenance/CheckModelVersions.php
OK
./maintenance/PurgeScoreCache.php
OK
./sql/ores_classification.sql
OK
./sql/ores_model.sql
OK