Maniphest T316354

Ensure rate limiting and potentially other harm preventions are in place for the Wikibase REST API
Closed, ResolvedPublic
Actions

Assigned To

Lydia_Pintscher

Authored By

	Lydia_Pintscher
	Aug 26 2022, 2:24 PM

Tags

Referenced Files

None

Subscribers

Lydia_Pintscher

Ollie.Shotton_WMDE

Description

As an editor I want API users to be restricted in how much damage they can cause in order to make it harder to vandalize the data and harm the project.

List of things to check:

rate limiting is happening (T301970)
abuse filters are processed and obeyed (T326093)
blocked users/IPs can not make edits (T326954)
a protected Item can only be edited by accounts that should be able to edit it
URLs on the spam block list can not be added as values (T326955)

Acceptance criteria:

the above items have been checked and are working as expected

Open questions:

What's currently in place for the action API?
How do we want to do things (potentially differently) for the REST API?

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Open		None	T335067 Epic: Wikidata Query Service stabilization
		Resolved		Lydia_Pintscher	T314503 rollout of the new Wikibase REST API to Wikidata
		Resolved		Lydia_Pintscher	T316354 Ensure rate limiting and potentially other harm preventions are in place for the Wikibase REST API
		Resolved	Security	WMDE-leszek	T321318 🤖️ Wikibase REST API ignores `bot` user right, lets anyone mark edits as bot edits
		Resolved	Security	Jakob_WMDE	T321567 🤖️ Check the 'bot' user privilege in REST API's ItemUpdater
		Resolved	Security	Jakob_WMDE	T321570 🤖️ Create middleware to check `bot` user right
		Resolved		Muhammad_Yasser_Jazirahly_WMDE	T326954 Ensure that blocked users/IPs can not make edits
		Resolved		Ollie.Shotton_WMDE	T326093 Confirm Wikibase REST API are considered by the AbuseFilter
		Resolved		Silvan_WMDE	T326955 Ensure URLs on the spam block list can not be added as values

Event Timeline

Lydia_Pintscher created this task.Aug 26 2022, 2:24 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 26 2022, 2:24 PM

Lydia_Pintscher added a parent task: T314503: rollout of the new Wikibase REST API to Wikidata.Oct 12 2022, 5:25 PM

Lydia_Pintscher added a subtask: T321318: 🤖️ Wikibase REST API ignores `bot` user right, lets anyone mark edits as bot edits.Oct 20 2022, 3:51 PM

WMDE-leszek closed subtask T321318: 🤖️ Wikibase REST API ignores `bot` user right, lets anyone mark edits as bot edits as Resolved.Dec 7 2022, 12:55 PM

see T301970 for rate limiting topic

Lydia_Pintscher moved this task from Backlog to First release on the Wikibase REST API (archieved) board.Jan 6 2023, 1:59 PM

Lydia_Pintscher updated the task description. (Show Details)Jan 6 2023, 2:11 PM

Michael subscribed.Jan 10 2023, 10:32 AM

karapayneWMDE mentioned this in T324999: configure Wikibase REST API on Wikidata.Jan 10 2023, 10:36 AM

Ollie.Shotton_WMDE added a subtask: T326093: Confirm Wikibase REST API are considered by the AbuseFilter.Jan 13 2023, 1:29 PM

Ollie.Shotton_WMDE updated the task description. (Show Details)

"a protected Item can only be edited by accounts that should be able to edit it" is done and there are automated e2e tests to check this

Ollie.Shotton_WMDE updated the task description. (Show Details)Jan 13 2023, 3:31 PM

Ollie.Shotton_WMDE updated the task description. (Show Details)Jan 26 2023, 10:29 AM

Lydia_Pintscher closed this task as Resolved.Feb 3 2023, 11:36 AM

Lydia_Pintscher claimed this task.

WMDE-leszek closed subtask T326955: Ensure URLs on the spam block list can not be added as values as Resolved.Feb 7 2023, 9:42 PM

WMDE-leszek closed subtask T326954: Ensure that blocked users/IPs can not make edits as Resolved.

WMDE-leszek closed subtask T326093: Confirm Wikibase REST API are considered by the AbuseFilter as Resolved.