Page MenuHomePhabricator

Application Security Review Request : Revaluate JsonConfig extension
Closed, ResolvedPublic

Description

Project Information

Description of the tool/project:
The JsonConfig extension allows other extensions to store their configuration data as a JSON blob in a wiki page.

Description of how the tool will be used at WMF:
The extension has been deployed to Wikimedia production for 5+years but with the introduction of Charts it is seeing renewed usage.

In T369950, @mmartorana pointed out that the json-config extension hasn’t been reviewed in some time (T163827, 5 years ago). I recommend conducting an updated review, as it plays a critical role in input validation.

Has this project been reviewed before?
Yes

Working test environment
The extension and the service are deployed in the beta cluster.

Post-deployment
The Charts task force is responsible for this extension and is actively developing it. The main point of contact is Jon Robson (@Jdlrobson), who is filling in for Roan Kattouw (@Catrope)'s parental leave until late November / early December.

Event Timeline

sbassett changed the task status from Open to In Progress.Jan 9 2025, 5:19 PM
sbassett assigned this task to mmartorana.
sbassett triaged this task as Medium priority.
sbassett moved this task from Upcoming Quarter Planning Queue to In Progress on the secscrum board.
sbassett changed the task status from In Progress to Stalled.Mar 12 2025, 4:10 PM
mmartorana changed the task status from Stalled to In Progress.Apr 30 2025, 2:58 PM
mmartorana moved this task from Waiting to In Progress on the secscrum board.

Security Review Summary - T380653 - 2025-05-16
Last commit reviewed: 9c8e61f

Summary

I conducted non-complex manual tests using primarily black-box techniques, given the nature of this extension. The only issues identified were minor UI deception and visual spoofing vectors. No vulnerable or outdated dependencies were found.
Based on these findings, the overall risk associated with this review is considered : low.

Vulnerable Packages
none
npm audit reported no issues low risk.
snyk reported no issues low risk.
npm outdated reported no issues low risk.
composer audit reported no issues low risk.
phpcs reported no issues low risk.
composer audit reported no issues low risk.
osv-scanner reported no issues low risk.
composer outdated reported no issues low risk.

Static Analysis Findings
none
semgrep reported no issues low risk.
horusec reported false positive low risk.
bearer reported false positives low risk.
snyk reported no issues low risk.
sh-scan reported no issues low risk.
git-secrets reported false positives low risk.

Manual Testing
Risk:. low risk.

  1. Zero-Width Space (\u200B) Injection. Payload: "title": {"en": "P\u200BC\u200B"} appears as <th>PC</th> but not real "PC"
  2. RTL Override (\u202E) Injection. Payload: "title": { "en": "PC\u202E<pwned>.js"} appears as <th>PCsj.>dnewp<</th>