This will tentatively be scheduled for review during the next quarter (2024-01-01 through 2024-03-31).

In T350253#9310764, @sbassett wrote:

This will tentatively be scheduled for review during the next quarter (2024-01-01 through 2024-03-31).

Thanks! We're hoping to deploy to testwiki sometime in February 2024, and to two pilot wikis in March 2024. (cc @Madalina)

Hey @kostajh - Is https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/ReportIncident/+/refs/heads/master fairly stable for review? Or do you anticipate more changes prior to the expected February deploy to testwiki?

In T350253#9448334, @sbassett wrote:

Hey @kostajh - Is https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/ReportIncident/+/refs/heads/master fairly stable for review? Or do you anticipate more changes prior to the expected February deploy to testwiki?

It's stable for review. We will make more changes in the next months, but we don't have a specific development plan for that yet.

In T350253#9448808, @kostajh wrote:

It's stable for review. We will make more changes in the next months, but we don't have a specific development plan for that yet.

The testwiki and other pilot deploys are still on schedule with the extension codebase as it exists now, correct?

Hi @sbassett,

I expect most of it will be the same but we will have some additional features. We're not currently planning any changes to the "Report" links, overflow menu or the ability to send an email to a configured email address.

We might be adding an extra step in the flow where users can indicate whether the incident experienced is an emergency or not. If the user indicates an emergency we will proceed with sending an email. If no emergency the user will be directed to a community help wiki page.

We will also be adding instrumentation.

In terms of timeline we'll probably need to push testwiki release to March and pilot release to late March/April.

I hope this helps. We're currently working on a document that details the high level additional features and timeline, I'll share it here when ready.

In T350253#9452918, @Madalina wrote:

I expect most of it will be the same but we will have some additional features. We're not currently planning any changes to the "Report" links, overflow menu or the ability to send an email to a configured email address.

We might be adding an extra step in the flow where users can indicate whether the incident experienced is an emergency or not. If the user indicates an emergency we will proceed with sending an email. If no emergency the user will be directed to a community help wiki page.

We will also be adding instrumentation.

Ok, it might make sense to wait a bit on this review until those features are at least a bit further along.

In terms of timeline we'll probably need to push testwiki release to March and pilot release to late March/April.

I hope this helps. We're currently working on a document that details the high level additional features and timeline, I'll share it here when ready.

Sounds good. Does it seem feasible that the aforementioned work you mentioned might be completed within a month or two? If so, then I think it's likely reasonable that this review could be completed this quarter.

Security Review Summary - T350253 - 2024-03-19
Last commit reviewed: 5839499579

Summary

Overall, the current state of the ReportIncident extension looks good and I'm assigning it an overall risk rating of low, for now. The only truly actionalbe items would be mitigating the reachable vulernability found within the two dev dependencies, if feasible.

Vulnerable Packages - Production
Risk: None, (no production packages)

Vulnerable Packages - Development
Risk: medium

IMPORTANT: Unfortunately, semgrep supply chain found a vulnerable dependency that is reachable within ext:ReportIncident's dev dependencies (see: P58901). This is a dependency for @babel/preset-env@7.16.11 and jest@27.4.7, so perhaps merely bumping those versions to newer releases would mitigate the issue. Given vulnerability is for code execution, it would still be fairly sensitive even within a "dev" context.

Outdated Packages
As reported via npm outdated: None

As reported via composer outdated:
(no explicit vulnerabilities reported, simply noting for completeness' sake.)

Static Analysis Findings

1. semgrep with various custom and well-known policies. The reported issues were either false-positives or low-risk. Risk: low.
2. semgrep with some basic JavaScript sink-finding and PHP sink-finding rules. The reported issues were either false-positives or low-risk. Risk: low.
3. bearer sast - no reported issues. Risk: low.
4. lockfile-lint - no reported issues. Risk: low.
5. gitleaks - no reported issues. Risk: low.
6. git secrets - no reported issues. Risk: low.
7. whispers - no reported issues. Risk: low.

Dynamic Application Scanning Findings
Risk: low.
A small bit of manual testing (on beta cluster enwiki) and code-review was performed. ext:ReportIncident primarily leverages MediaWiki's default authentication/authorization mechanisms, essentially requiring an unblocked, logged-in user with a confirmed email address, more than 0 edits and their account having existed for at least 3 hours to be able to submit incident reports. There is a single right, incidentreport, that is default-granted to all authenticated MediaWiki users, so anon users and temp users are not allowed to report incidents. The browser frontend is built with Vue and leverages the single rest API endpoint to submit its html form data. I was not able to find any obvious issues or problems from these manual tests, other than the REST API endpoint seemed to be failing via a direct curl request due to a 500 error on beta enwiki with what I believe was valid incident report submission data. But a similar request worked just fine through the web UI, which uses the same REST API endpoint, so there was likely something amiss with my curling.

HTTP and other protocol Leaks
Risk: None, (no credible leaks found).

General code health score
Risk: low.

1. The Wikimedia code health check tool returned a weighted risk score of 27.90.

+-----------+----------+----------+------+---------------+---------------+--------------+-------------+------------+--------------+-----------+---------------+
| Vuln Pkgs | Pkg Mgmt | Test Cov | SAST | Non-auto Cmts | Uniq Contribs | Contrib Conc | Lang Guides | Staff Supp | Task Backlog | Code Stew | Weighted Risk |
+===========+==========+==========+======+===============+===============+==============+=============+============+==============+===========+===============+
|         2 |        4 |        0 |    0 |             5 |            10 |            4 |           7 |         10 |            0 |         0 |         27.90 |
+-----------+----------+----------+------+---------------+---------------+--------------+-------------+------------+--------------+-----------+---------------+

Policy Compliance
Risk: low.

1. As noted within the code, it seems that, at some point, portions of various reported responses would be stored within MediaWiki's primary database. Given the potentially sensitive nature of these reports, Privacy Engineering should likely weigh in on such a feature.

Miscellanous Issues/Points of Discussion/Nits
Risk: low.

1. As noted within T356190, there were some now-resolved CSRF issues regarding various REST API endpoints within this extension.

Change #1015330 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ReportIncident@master] build: Update npm dependencies

https://gerrit.wikimedia.org/r/1015330

IMPORTANT: Unfortunately, semgrep supply chain found a vulnerable dependency that is reachable within ext:ReportIncident's dev dependencies (see: P58901). This is a dependency for @babel/preset-env@7.16.11 and jest@27.4.7, so perhaps merely bumping those versions to newer releases would mitigate the issue. Given vulnerability is for code execution, it would still be fairly sensitive even within a "dev" context.

I think these are addressed via https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReportIncident/+/1015330

Change #1015330 merged by jenkins-bot:

[mediawiki/extensions/ReportIncident@master] build: Update npm dependencies

https://gerrit.wikimedia.org/r/1015330