@Iniquity - The Security-Team typically handles application security reviews on a quarterly cadence, and we've just set our reviews for this quarter. Also - is there a sponsoring team at the WMF to assist in the management of maintenance, security, etc. issues?

In T355161#9464099, @sbassett wrote:

@Iniquity - The Security-Team typically handles application security reviews on a quarterly cadence, and we've just set our reviews for this quarter.

Thanks for the information! :) But suddenly you have time earlier, the extension is very small :)

Also - is there a sponsoring team at the WMF to assist in the management of maintenance, security, etc. issues?

@Ernstkm and, I hope, Editing team: T355164

@sbassett Hello! I see you have already created a pool of extensions for testing? Are we missing this quarter too? How long should we wait? Are there any criteria or something like that?
https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Security_Review_Planning/2024-04-08

In T355161#9708335, @Iniquity wrote:

@sbassett Hello! I see you have already created a pool of extensions for testing? Are we missing this quarter too? How long should we wait? Are there any criteria or something like that?
https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Security_Review_Planning/2024-04-08

Yes, unfortunately we had a few other reviews to accommodate at this time and due to our limited resources, this one wasn't able to be officially scheduled this quarter. Please also refer to our AppSec Review SOP: https://www.mediawiki.org/wiki/Security/SOP/Application_Security_Reviews#How_are_these_requests_prioritized?

In T355161#9715419, @sbassett wrote:

In T355161#9708335, @Iniquity wrote:

@sbassett Hello! I see you have already created a pool of extensions for testing? Are we missing this quarter too? How long should we wait? Are there any criteria or something like that?
https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Security_Review_Planning/2024-04-08

Yes, unfortunately we had a few other reviews to accommodate at this time and due to our limited resources, this one wasn't able to be officially scheduled this quarter. Please also refer to our AppSec Review SOP: https://www.mediawiki.org/wiki/Security/SOP/Application_Security_Reviews#How_are_these_requests_prioritized?

Is there any time frame for when this task will be taken on?

In T355161#9715467, @Iniquity wrote:

Is there any time frame for when this task will be taken on?

Not officially, no. As a team, we basically have a look at all requests that we've accumulated during a given quarter and then prioritize and distribute those across the limited resources Security Team AppSec has available for reviews each quarter. We try to accommodate every request as best we can, but sometimes there are re-prioritizations, delays, etc.

In T355161#9715544, @sbassett wrote:

In T355161#9715467, @Iniquity wrote:

Is there any time frame for when this task will be taken on?

Not officially, no. As a team, we basically have a look at all requests that we've accumulated during a given quarter and then prioritize and distribute those across the limited resources Security Team AppSec has available for reviews each quarter. We try to accommodate every request as best we can, but sometimes there are re-prioritizations, delays, etc.

Do I understand correctly that with the current state of affairs, this request can be processed for several years? And is it easier for me to forget about this request and not plan any work for the coming years?

@Iniquity if you fill in the

Link to scc output for general sizing of codebases (https://github.com/boyter/scc):

part of the task description it might be easier for the security team to prioritize given just how *tiny* this extension really is (120 lines of PHP total and by my count 57 of those are comments and 14 are blank, so really 49 lines of PHP; no JavaScript)

In T355161#9715739, @DannyS712 wrote:

@Iniquity if you fill in the

Link to scc output for general sizing of codebases (https://github.com/boyter/scc):

part of the task description it might be easier for the security team to prioritize given just how *tiny* this extension really is (120 lines of PHP total and by my count 57 of those are comments and 14 are blank, so really 49 lines of PHP; no JavaScript)

Thanks for the tip! I thought it would be more difficult to do than it turned out :)

In T355161#9715623, @Iniquity wrote:

Do I understand correctly that with the current state of affairs, this request can be processed for several years? And is it easier for me to forget about this request and not plan any work for the coming years?

Probably not several years, but it might have to wait a quarter or two, yes. Our manual security review process just isn't realistically scalable for the entirety of the MediaWiki/Wikimedia ecosystem. We hope to provide better and faster security analysis in the future via increased automation and better processes (like rapid risk assessments).

@sbassett Hi! Are you able to check the extension next quarter?

In T355161#9919029, @Iniquity wrote:

@sbassett Hi! Are you able to check the extension next quarter?

We'll be having our quarterly reviews planning meeting sometime either the first week (or early second week) of July, where we select reviews to complete for the upcoming quarter. We'll use the current prioritization process to select and prioritize security reviews. We have quite a few reviews within our upcoming planning and back orders columns, so it's going to be difficult to guarantee anything at this time.