Maniphest T354488

'request' Toolforge tool uses Cloudflare CDN
Open, Needs TriagePublic
Actions

Assigned To

None

Authored By

	LucasWerkmeister
	Jan 7 2024, 1:36 PM

Tags

Referenced Files

None

Subscribers

LucasWerkmeister

Description

The “Bilderwunsch API” of the request tool, which allows users to search for image requests from German Wikipedia, loads JavaScript from https://cdnjs.cloudflare.com/. To preserve users’ privacy, it should use the Toolforge cdnjs proxy instead (compare Toolforge help). Specifically:

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Open		None	T133919 [EPIC] Protect end-user privacy by restricting non-consensual third-party browser interactions
		Open		None	T130748 Add Content-Security-Policy header enforcing 3rd party web interaction restrictions to proxy responses
		Open		None	T172065 Hunt for Toolforge tools that load resources from third party sites
		Open		None	T354488 'request' Toolforge tool uses Cloudflare CDN

Event Timeline

LucasWerkmeister created this task.Jan 7 2024, 1:36 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 7 2024, 1:36 PM

I didn't even officially request access to the tool yet and already got my first task assigned. 😂 Thanks, I guess...

Not assigned, just CCed so far :P you can use it like “look, there’s work that someone™ needs to do” in your access request ;)

JJMC89 edited parent tasks, added: T172065: Hunt for Toolforge tools that load resources from third party sites; removed: T133919: [EPIC] Protect end-user privacy by restricting non-consensual third-party browser interactions.Jan 7 2024, 5:24 PM

JJMC89 removed a project: Privacy Engineering.

• NoOnEtHeMaStA added a commit: rMEXTf658c3375869: Update git submodules.Jan 7 2024, 9:15 PM

Aklapper removed a commit: rMEXTf658c3375869: Update git submodules.Jan 7 2024, 9:24 PM