Page MenuHomePhabricator

Allow URL shortening for wikimediafoundation.org domain
Open, Stalled, Needs TriagePublic

Description

I am not sure why this was not among the white listed domains.

Event Timeline

Ammarpad created this task.Apr 29 2019, 5:11 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 29 2019, 5:11 PM
Reedy added a subscriber: Reedy.

I am not sure why this was not among the white listed domains.

Probably because it's not a wiki

Ladsgroup added a subscriber: Ladsgroup.

It's actually a little bit more complex. wikimediafoundation.org is not in WMF infrastructure and doesn't go through our varnish/LVS/other bits (don't get me started). It also used to load outside modules T201022: Third party resources loaded by wikimediafoundation.org so it's a little bit scary to allow this as the website might have reflective XSS vulnerabilities and abuses can got hidden through URL shortener. I leave the decision to CPT and Secuirty though.

If someone is reasonably confident/has audited wikimediafoundation.org to make sure there are no open redirects it should be fine to add.

Varnent added a subscriber: Varnent.EditedApr 30 2019, 5:37 AM

It's actually a little bit more complex. wikimediafoundation.org is not in WMF infrastructure and doesn't go through our varnish/LVS/other bits (don't get me started). It also used to load outside modules T201022: Third party resources loaded by wikimediafoundation.org so it's a little bit scary to allow this as the website might have reflective XSS vulnerabilities and abuses can got hidden through URL shortener. I leave the decision to CPT and Secuirty though.

@Ladsgroup: Which outside modules are you referring to? As noted in the ticket you linked to, the ones previously identified have been disabled since August 2018.

I defer to Security and CPT on adding URL shortener to this domain, but want to make sure we are discussing it accurately. Are there additional external modules you are concerned about which are not discussed in T201022: Third party resources loaded by wikimediafoundation.org?

@Ladsgroup: Which outside modules are you referring to? As noted in the ticket you linked to, the ones previously identified have been disabled since August 2018.

Hey, I used past tense ("used to load"). Still reflective XSS can be a problem in javascript of the website but there are tools to scan for such vulnerabilities. (Security team knows better, does this website passed security review?)

So if security review of this website is a blocker, has such review already done?

Could wmflabs.org also be considered in this request?

wmflabs.org should probably be a whole separate ticket.

So if security review of this website is a blocker, has such review already done?

Not that I'm aware of. Specifically, someone needs to verify there are no open redirects. Also no dangerous URLs that perform actions upon GET requests (e.g. T220923).

Legoktm changed the task status from Open to Stalled.Aug 1 2019, 7:13 AM

Marking as stalled pending confirmation from someone(?) that someone has reviewed wikimediafoundation.org for:

  • reflective XSS
  • open redirects
  • dangerous URLs that perform actions upon GET requests
Husky added a subscriber: Husky.Aug 29 2019, 7:16 AM

wmflabs.org should probably be a whole separate ticket.

I've added T231518 as a ticket specifically for wmflabs.org.

Marking as stalled pending confirmation from someone(?) that someone has reviewed wikimediafoundation.org for:

  • reflective XSS
  • open redirects
  • dangerous URLs that perform actions upon GET requests

How can we go about getting this review done for the site?

Marking as stalled pending confirmation from someone(?) that someone has reviewed wikimediafoundation.org for:

  • reflective XSS
  • open redirects
  • dangerous URLs that perform actions upon GET requests

How can we go about getting this review done for the site?

I guess someone from Security-Team ?

How can we go about getting this review done for the site?

I guess someone from Security-Team ?

Correct! @Varnent - You'd want to start out with the new Security-Team services request form. There is some basic, pre-populated information in the description field where you can describe what @Legoktm discusses in T222089#5383470. This will get the request into our queue so we can evaluate options with you and schedule any resultant work. Thanks.

How can we go about getting this review done for the site?

I guess someone from Security-Team ?

Correct! @Varnent - You'd want to start out with the new Security-Team services request form. There is some basic, pre-populated information in the description field where you can describe what @Legoktm discusses in T222089#5383470. This will get the request into our queue so we can evaluate options with you and schedule any resultant work. Thanks.

Awesome! Will do - thank you!