Moving to waiting to see if there is anything this team needs to do to help.

Where is/what is the extent of he integration?

All I can obviously see in Kartographer...

				if ( !class_exists( 'JsonConfig\\JCSingleton' ) ) {
					return Status::newFatal( 'kartographer-error-service-name', $object->service );
				}
				$jct = JCSingleton::parseTitle( $object->title, NS_DATA );
				if ( !$jct || JCSingleton::getContentClass( $jct->getConfig()->model ) !==
							  JCMapDataContent::class
				) {
					return Status::newFatal( 'kartographer-error-title', $object->title );
				}

@Reedy yep, that's pretty much all of it. Also, JsonConfig is mostly a refactoring of the original ZeroAccess extension, which was originally implemented ~7? years ago, and later had many changes. It grew so big that at one point i simply split it into 3 extensions - JsonConfig, ZeroPortal, and ZeroBanner.

How is the security review going?

Was it done?

Update: Sorry for the crazy delays on all of this. I'm officially starting in on this today (2/8).

Thanks, @sbassett!

Update: Still working on this :) I've run some automated scans/tests against the JsonConfig code and didn't find much beyond basic linter-y issues ($wgParser global and wfLoadExtension entrypoints being deprecated and the like.) Phan-taint-check didn't come up with anything either, which makes sense as there aren't any direct db or shell interactions, other smells like unserialize() or obviously unsafe uses of Html::rawElement().

That said, in evaluating some of the previous known security issues (T163166, T134719) I'd like to focus a bit more on the specific interaction between Kartographer/JsonConfig and areas such as JCUtil::sanitizeRecursive, JCDataContent->renderDescription() and the valueToHtml() functions within the JC*ContentView.php files. Should have a report on any resulting issues by tomorrow or early next week.

Security Review Summary - March 2019
Per T163827#5010048, after running some automated scanning tools and digging into the code of JsonConfig a bit more, specifically how the extension is currently used by Kartographer, I wasn't able to find anything obviously concerning. Given that JsonConfig has been in production for nearly 5 years now, I'm going to assume some level of stability and that the issues which prompted the creation of this task (XSS within Kartographer) have been resolved within those separate tasks. I may do a little more local testing against the extension just for my own curiosity, but for now I'm going to mark this task as resolved.

@sbassett Thanks!