Is this to be added on donate wiki or payments wiki? If it is donate wiki then this needs to go to the prod group since we don't have access to the CSP for that side.

It's on donate wiki. We'll also need at least cdn.fundraiseup.com and static.fundraiseup.com. Probably safest to just add *.fundraiseup.com

On looking a bit more, it turns out this is actually report only so the connections can be made. However we will probably want to add exceptions anyway to avoid the report spam.

Change 957983 had a related patch set uploaded (by Ejegg; author: Ejegg):

[operations/mediawiki-config@master] Allow FundraiseUp scripts in Donatewiki CSP

https://gerrit.wikimedia.org/r/957983

@Pcoombe I've put up a mediawiki-config patch for review to add fndrsp.net and *.fundraiseup.com.

Adding a custom CSP for donatewiki is also be an opportunity to lock down the CSP a bit further than the current settings, which allow for loading scripts from basically any foundation-controlled domain (and therefore a lot of user content). Do we want to remove anything from that default-src list in the task description?

Thanks @Ejegg. I don't think there's a need to remove any of the other sites.

In T345379#9170890, @Ejegg wrote:

... and get sign-off from Security team for the addition to the CSP (I'm assuming they already approved the actual integration while I was on sabbatical). @sguebo_WMF and @Reedy please let me know if I should tag any Security people not named Sam.

Per our Slack conversation, I don't believe this happened. I believe this went through a brief legal review, but the Privacy Engineering and Security Team AppSec teams were not informed that we needed to review anything.

HI @Sbasset, I just heard from @ERoden-WMF that the initial security review was done by @Aprum / @aranyap . I see @JFishback_WMF and @KHurd-WMF CC'ed on those communications as well. I hope that helps!

Hi @Ejegg thanks for bringing this to our attention. I initially conducted a privacy review for Fundraise Up and deemed it to be a low risk for the particular use-case that was specified by @ERoden-WMF . As for any additional integrations, I'll need to consult with @JFishback_WMF and @samuelguebo to determine whether this needs further review. I'll update here once I get more info. Thanks!

Hi @aranyap, we're still talking about the same use case - only loading the Fundraise Up scripts for people who choose to donate. So this ticket is limited to just changing the CSP headers on donatewiki, no other foundation sites.

You both are correct @Ejegg and @sbassett, a review was done, but not this type of review. I'll explain.

The scripts were not reviewed and are not a part of security reviews for potential new vendors.

The ticket that is being referred to is the security review that is completed for all new vendors and renewal contracts with vendors. It includes a vendor review (review of security posture, SOC 2 Type II certifications, ISO 27001 certifications, etc.) and a privacy review (which includes checking for what kind of data will be used/collected, does it include PII, etc.). Script reviews are never a part of this type of review.

From what I understand, to get a script review, a team would need to enter a Phab ticket and tag the Security Team AppSec team for review.

Hope this makes sense and please correct me, if I'm wrong.

OK @KHurd-WMF , I'm adding the recommended tags here.

to get a script review, a team would need to enter a Phab ticket and tag the Security Team AppSec team for review.

Per steps linked from https://phabricator.wikimedia.org/tag/application_security_reviews/ this should be a separate (sub)task by filling out the form, I'd say.

Application Security Review ticket submitted at https://phabricator.wikimedia.org/T347104

Hi, given the comment at https://phabricator.wikimedia.org/T347104#9197120 that the security review could be non-blocking, is it possible to proceed with the CSP change?

In T345379#9205751, @Pcoombe wrote:

Hi, given the comment at https://phabricator.wikimedia.org/T347104#9197120 that the security review could be non-blocking, is it possible to proceed with the CSP change?

Sure, we can review the CSP change on gerrit - I've already left some comments on the change set.

Hi @sbassett -- I'm following up on Peter's note, is there an update to the CSP change? Thanks

@MSuijkerbuijk_WMF - I've left a comment on the change set: https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/957983/4#message-ee7001efb7d41824b5572d8bc604327f211cab91

@sbassett Thanks for your prompt answer, I have a follow up question: when does the production config deploy happen? Is this also under your team? Apologies for the ignorance, I'm looking at how to help coordinating.

@MSuijkerbuijk_WMF it sounds like @sbassett wants @greg and @Lgruwell-WMF to acknowledge that the security department has assessed FundraiseUp's code as high risk, and confirm they want to move forward with it.

@greg and @Lgruwell-WMF do you want to weigh in here?

Regarding the actual vendor code, I'd believe we'd need to rate that as high risk for now, given some of the issues with the vendor, which Greg and Lisa would need to accept.

I spoke with @acooper today and we are comfortable moving forward with this change after receiving the policy and assessment documents from FundraiseUp. This is now a medium risk instead of high.

Change 957983 merged by jenkins-bot:

[operations/mediawiki-config@master] Allow FundraiseUp scripts in Donatewiki CSP

https://gerrit.wikimedia.org/r/957983

Mentioned in SAL (#wikimedia-operations) [2023-10-12T20:15:12Z] <dr0ptp4kt@deploy2002> Started scap: Backport for [[gerrit:957983|Allow FundraiseUp scripts in Donatewiki CSP (T345379)]]

Mentioned in SAL (#wikimedia-operations) [2023-10-12T20:16:27Z] <dr0ptp4kt@deploy2002> dr0ptp4kt and ejegg: Backport for [[gerrit:957983|Allow FundraiseUp scripts in Donatewiki CSP (T345379)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2023-10-12T20:22:53Z] <dr0ptp4kt@deploy2002> Finished scap: Backport for [[gerrit:957983|Allow FundraiseUp scripts in Donatewiki CSP (T345379)]] (duration: 07m 40s)

Deployed, verified I see the frup domains listed in our CSP header response.

Also verified that there's no more CSP report messages in the browser console. Thanks everyone!