Page MenuHomePhabricator

Application Security Review Request : Extension:IPReputation
Closed, ResolvedPublic

Description

Project Information

Description of the tool/project: Provide access for fetching, logging, and acting on IP reputation data.

Description of how the tool will be used at WMF: Enrich event logging events with IP reputation metadata; provide a low-level interface for other callers to the IP reputation database; provide IP reptuation as a signal to other tools like AbuseFilter; be a potential place where mitigations on bad actors based on IP reputation could be enacted.

Dependencies

List dependencies, or upstream projects that this project relies on.

iPoid-Service

Has this project been reviewed before?

Please link to tasks or wiki pages of previous reviews.

The extension is currently https://gerrit.wikimedia.org/r/c/mediawiki/extensions/IPReputation/+/1010522 which is already deployed in production code (in CentralAuth) which was reviewed by other engineers at WMF already.

Working test environment

Please link or describe setup process for setting up a test environment.

Enable the extension, and set up an SSH tunnel to a deployment server (queries to ipoid should just work as the default URL config uses localhost:6035)

Post-deployment

Name of team responsible for tool/project after deployment and primary contact.

@kostajh and Trust and Safety Product Team

Details

Risk Rating
Low

Event Timeline

Hey @kostajh - Just wanted to check in and see if ext:IPReputation is ready for review or if you're planning any large, meaningful development cycles soon (and I should wait a bit). Thanks.

Hey @kostajh - Just wanted to check in and see if ext:IPReputation is ready for review or if you're planning any large, meaningful development cycles soon (and I should wait a bit). Thanks.

I think it is ready for review as is. Thanks!

Quick update on this: I plan to post the review next Monday or Tuesday (2024-06-16 or 2024-06-18). I haven't really found anything concerning at all.

Security Review Summary - T360070 - 2024-06-17
Last commit reviewed: be78eb0148

Summary

Overall, the current extension looks great and has an overall risk rating of: low.

Vulnerable Packages - Development
Risk: low

VulnerabilityPackageServiceRemediationRisk
Missing Release of Resource afte...inflight@1.0.6snyk[see advisory link] medium
Regular Expression Denial of Ser...underscore.string@3.3.5snyk[see advisory link] high
CVE-2024-4067: CWE-1333, advisory linkmicromatchauditjs[see advisory link] medium

Outdated Packages
As reported via npm outdated:
(no explicit vulnerabilities reported, simply noting for completeness' sake.)

PackageCurrentWantedLatestDepended By
eslint-config-wikimedia0.28.00.28.00.28.2IPReputation
grunt-eslint24.3.024.3.025.0.0IPReputation
grunt-stylelint0.20.00.20.00.20.1IPReputation
stylelint-config-wikimedia0.17.10.17.10.17.2IPReputation

As reported via composer outdated:
(no explicit vulnerabilities reported, simply noting for completeness' sake.)

PackageCurrentLatestNotes
phpcsstandards/phpcsextra1.1.21.2.1A collection of sniffs and standards for use with PHP_CodeSniffer.
phpcsstandards/phpcsutils1.0.91.0.12A suite of utility functions for use with PHP_CodeSniffer
sabre/event5.1.46.0.0sabre/event is a library for lightweight event-based programming
squizlabs/php_codesniffer3.8.13.10.1PHP_CodeSniffer tokenizes PHP, JavaScript and CSS files and detects violations o...

General code health score
Risk: low.

  1. The Wikimedia code health check tool returned a weighted risk score of 34.10 (which is low).
+-----------+----------+----------+------+---------------+---------------+--------------+-------------+------------+--------------+-----------+---------------+
| Vuln Pkgs | Pkg Mgmt | Test Cov | SAST | Non-auto Cmts | Uniq Contribs | Contrib Conc | Lang Guides | Staff Supp | Task Backlog | Code Stew | Weighted Risk |
+===========+==========+==========+======+===============+===============+==============+=============+============+==============+===========+===============+
|         0 |        4 |        3 |    0 |            10 |            10 |            7 |           7 |         10 |            0 |         0 |         34.10 |
+-----------+----------+----------+------+---------------+---------------+--------------+-------------+------------+--------------+-----------+---------------+
sbassett triaged this task as Low priority.
sbassett moved this task from In Progress to Our Part Is Done on the secscrum board.
sbassett moved this task from In Progress to Done on the user-sbassett board.