Page MenuHomePhabricator

Security Review of Trending Edits Endpoint
Closed, ResolvedPublic

Description

Project Information

Description of the tool/project

https://phabricator.wikimedia.org/T140102

Description of how the tool will be used at WMF

The Trending Edits service will be used to provide a list of currently active articles to apps and web sites by analyzing the edit traffic using Kafka

Dependencies

List dependencies, or upstream projects that this project relies on
RESTBase
Kafka

Has this project been reviewed before?

No

Working test environment

https://en.wikipedia.org/api/rest_v1/#!/Feed/trendingEdits

Post-deployment

#reading-infrastructure-team

Event Timeline

@mobrovac @Fjalapeno is this done or being done (given its in production.. I assume it's done?)?

I haven't requested the review itself. Has any of you done so? If not, please request it.

Fjalapeno updated the task description. (Show Details)

@Bawolff let me know if you need any other information, thanks!

Bawolff claimed this task.
Bawolff moved this task from Scheduled to Waiting on the deprecated-security-team-reviews board.

This looks good. Review passed.

[Not a security issue]: I did find it a little confusing that the totalEdits and editors is not actually the total over all time, but just for some unclear duration of recent time. Perhaps that should be documented.

If that were to be Editors over all time, I would perhaps be worried about maybe leaking if revdel'd edits were by the same author. This would be a very minor leak as far as leaks go, but nonetheless if there's any future plan to make the Editors list extend over all time, please keep that in mind.

At the moment, this doesn't include who the recent editors are (which seems good). If in the future you ever decide to expose that information, please keep revision deletion in mind to avoid exposing revdeleted users.