Page MenuHomePhabricator

Security review of wikiba.se
Closed, ResolvedPublic

Description

We are planning to move this to WMF infra and as @faidon pointed out, a security review would be needed. Since it's a static website, it'll be piece of cake (I guess)

Event Timeline

Bawolff added a subscriber: Bawolff.Aug 3 2017, 6:39 PM

Is the site in a git repo somewhere?

Restricted Application added a subscriber: PokestarFan. · View Herald TranscriptAug 3 2017, 6:39 PM

Yes, that's the correct repo.

Reedy added a subscriber: Reedy.Sep 21 2017, 10:34 PM

https://github.com/wikimedia/wikiba.se/blob/master/composer.json#L6 - Why are you including dflydev/embedded-composer yourself? https://packagist.org/packages/sculpin/sculpin adds the same version. I was trying to work out what it was used for; and the answer seems to be nothing directly

What's the deployment strategy going to be? Commit the generated files (from vendor/bin/sculpin generate --env=prod) into another repo (wikiba.se-deploy or similar?)... As we're presumably not going to be running composer and then sculpin on the misc servers and then serving those files?

Package operations: 79 installs, 0 updates, 0 removals

Yeah... That's definitely not being run in prod. lol

Reedy closed this task as Resolved.Sep 21 2017, 10:53 PM
Reedy claimed this task.

There's nothing really scary here other than the dependancy tree of vendor/composer libs. But that's not a production issue.

The 3rd party loading of fonts was fixed recently, so that's good.

TBH, I don't think this really needed a security review; the resultant files are mostly static html, with a bit of (standard 3rd party) js

reedy@ubuntu64-web-esxi:~/wikiba.se/output_prod$ tree
.
├── applications
│   └── index.html
├── components
│   ├── bootstrap
│   │   ├── bootstrap-built.css
│   │   ├── bootstrap-built.js
│   │   └── dist
│   │       ├── css
│   │       │   ├── bootstrap.css
│   │       │   ├── bootstrap.min.css
│   │       │   ├── bootstrap-theme.css
│   │       │   └── bootstrap-theme.min.css
│   │       ├── fonts
│   │       │   ├── glyphicons-halflings-regular.eot
│   │       │   ├── glyphicons-halflings-regular.svg
│   │       │   ├── glyphicons-halflings-regular.ttf
│   │       │   ├── glyphicons-halflings-regular.woff
│   │       │   └── glyphicons-halflings-regular.woff2
│   │       └── js
│   │           ├── bootstrap.js
│   │           └── bootstrap.min.js
│   ├── font-awesome
│   │   ├── css
│   │   │   ├── font-awesome.css
│   │   │   ├── font-awesome.css.map
│   │   │   └── font-awesome.min.css
│   │   ├── font-awesome-built.css
│   │   └── fonts
│   │       ├── FontAwesome.otf
│   │       ├── fontawesome-webfont.eot
│   │       ├── fontawesome-webfont.svg
│   │       ├── fontawesome-webfont.ttf
│   │       ├── fontawesome-webfont.woff
│   │       └── fontawesome-webfont.woff2
│   ├── index.html
│   ├── jquery
│   │   ├── jquery-built.js
│   │   ├── jquery.js
│   │   ├── jquery-migrate.js
│   │   ├── jquery-migrate.min.js
│   │   ├── jquery.min.js
│   │   └── jquery.min.map
│   ├── require-built.js
│   ├── require.config.js
│   ├── require.css
│   └── require.js
├── css
│   └── style.css
├── images
│   ├── droidwiki.png
│   ├── eagle-project.png
│   ├── favicon.ico
│   ├── logo.png
│   └── wikidata.png
├── index.html
├── ontology-1.0.owl
├── projects
│   └── index.html
└── resources
    └── index.html