Maniphest T343458

Allow logged-out users to run (community-approved) implementations on wikifunctions.org via the `wikilambda-execute` right
Closed, ResolvedPublicSecurity
Actions

Assigned To

Jdforrester-WMF

Authored By

	Jdforrester-WMF
	Aug 3 2023, 1:52 PM

Tags

Referenced Files

None

Subscribers

Jdforrester-WMF

Description

This is disabled for initial launch, but ultimately we want to provide it for all users.

Decide what criteria will we use to judge if this is ready
Decide what criteria will we use to decide to roll back
Make appropriate system changes to implement and monitor above
Execute

Details

Risk Rating: Low
Author Affiliation: WMF Product

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		gengh	T349054 Adjust and improve Wikifunctions user rights grants for General Availability
		Resolved		Jdforrester-WMF	T349100 Reach agreed product security and monitoring milestones to grant General Availability
		Resolved	Security	Jdforrester-WMF	T343458 Allow logged-out users to run (community-approved) implementations on wikifunctions.org via the `wikilambda-execute` right
		Resolved		JMeybohm	T347544 Separate deployment for wikifunctions.org
		Resolved		Jdforrester-WMF	T346264 Improve wikifunctions logging
		Resolved		cmassaro	T343829 Sandboxing Strategy for Wikifunctions
		Resolved		cmassaro	T308250 Should Wikifunctions use a WebAssembly runtime?
		Resolved	Security	cmassaro	T343709 Wikifunctions Kubernetes evaluator service exposes some sensitive data/functions within the container
		Resolved		Jdforrester-WMF	T343388 Split the monolithic function-evaluator service up in production so we have differently-scalable pods for python vs. node
		Resolved		Jdforrester-WMF	T343459 Split the wikifunctions k8s pod up in production so we have differently-scalable pods for the orchestrator vs. the evaluator
		Resolved		cmassaro	T343165 Disallow Child Process Spawning within the Executors
		Resolved		JMeybohm	T347397 Migrate functions-orchestrator service to mw-api-int
		Resolved	PRODUCTION ERROR	Jdforrester-WMF	T344998 Wikifunctions functions that require a lookup on wikifunctions.org timing out in the orchestrator, UX instead showing 'http'

Event Timeline

Jdforrester-WMF created this task.Aug 3 2023, 1:52 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 3 2023, 1:52 PM

I've filed this as a security task out of an abundance of caution, but ideally it'd be a public one.

sbassett moved this task from Incoming to Watching on the Security-Team board.Aug 7 2023, 4:16 PM

sbassett added a project: SecTeam-Processed.

Jdforrester-WMF triaged this task as Low priority.Aug 7 2023, 6:12 PM

Jdforrester-WMF moved this task from To Triage to Needs Product/Design on the Abstract Wikipedia team board.

Quiddity subscribed.Aug 7 2023, 6:45 PM

Jdforrester-WMF added a project: Epic.Aug 23 2023, 4:14 PM

Jdforrester-WMF added subtasks: T347544: Separate deployment for wikifunctions.org, T346264: Improve wikifunctions logging, T343829: Sandboxing Strategy for Wikifunctions, T343709: Wikifunctions Kubernetes evaluator service exposes some sensitive data/functions within the container, T343388: Split the monolithic function-evaluator service up in production so we have differently-scalable pods for python vs. node, T343165: Disallow Child Process Spawning within the Executors, T347397: Migrate functions-orchestrator service to mw-api-int, T344998: Wikifunctions functions that require a lookup on wikifunctions.org timing out in the orchestrator, UX instead showing 'http'.Oct 12 2023, 4:34 PM

Jdforrester-WMF moved this task from Needs Product/Design to Backlog on the Abstract Wikipedia team board.

Jdforrester-WMF closed subtask T343388: Split the monolithic function-evaluator service up in production so we have differently-scalable pods for python vs. node as Resolved.Oct 12 2023, 5:18 PM

JMeybohm added a project: serviceops-radar.Oct 13 2023, 7:06 AM

JMeybohm subscribed.

JMeybohm reopened subtask T343388: Split the monolithic function-evaluator service up in production so we have differently-scalable pods for python vs. node as Open.Oct 13 2023, 9:28 AM

Jdforrester-WMF added a parent task: T349100: Reach agreed product security and monitoring milestones to grant General Availability.Oct 17 2023, 2:19 PM

Jdforrester-WMF closed subtask T343388: Split the monolithic function-evaluator service up in production so we have differently-scalable pods for python vs. node as Resolved.Oct 18 2023, 1:18 PM

Jdforrester-WMF closed subtask T343165: Disallow Child Process Spawning within the Executors as Resolved.

Jdforrester-WMF moved this task from Backlog to Verify in production on the Abstract Wikipedia team board.Oct 30 2023, 1:42 PM

Jdforrester-WMF closed subtask T343829: Sandboxing Strategy for Wikifunctions as Resolved.Nov 6 2023, 8:58 PM

Jdforrester-WMF closed this task as Resolved.Nov 6 2023, 10:56 PM

Jdforrester-WMF claimed this task.

Jdforrester-WMF closed subtask T343709: Wikifunctions Kubernetes evaluator service exposes some sensitive data/functions within the container as Resolved.

sbassett changed Author Affiliation from N/A to WMF Product.Nov 8 2023, 5:15 PM

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed the edit policy from "Custom Policy" to "All Users".

sbassett changed Risk Rating from N/A to Low.