In T404738#11250951, @sbassett wrote:

Hey @jsn.sherman and @Samwalton9-WMF - I'm not sure what conversations you've had with @Catrope regarding this review, but if we could summarize those here and any other expectations regarding this review, that would be great. Thanks.

Hi there,

After walking @Catrope through the code a few weeks ago, our expectation is that this should be a fairly quick/fast track review given that the extension is a refactor/streamlining of the homepage portion of the GrowthExperiments extension; i.e. this code is pretty much already in production.

We'd like to be able to roll out this extension with our first experimental/trial dashboard modules in November. We know we need the dashboard in the long term, but the since the initial modules themselves are currently under development and will be part of an experiment, we want to exclude them from review for now.

If there's anything we can do to move things along, please let us know.

Just FYI, I plan to have a quick chat with @Catrope about this when he's back in the office next week.

@sbassett @Catrope we now have at least one module merged in so you can see how this works. We do have another module about ready to go, but are running into a ci configuration issue on the new repo
You can run it locally easily enough as long as you setup CommunityConfiguration as well. Patch for that module:
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PersonalDashboard/+/1200167

Thanks, @jsn.sherman. Is there a more specific deployment date for this code? Not that this review would necessarily block such a milestone.

In T404738#11345291, @sbassett wrote:

Thanks, @jsn.sherman. Is there a more specific deployment date for this code? Not that this review would necessarily block such a milestone.

Originally we were aiming to deploy by the week of the 17th, but there are still design and copy changes happening. We're deploying to non-English wikis, so translation will be the other potential blocker besides this review. We're aiming to be deployed with translations by the end of this month. Sooner is better, but it's not like we have everything else wrapped up with a neat bow and are solely waiting on this.

cc @Samwalton9-WMF @DMburugu

Hi @sbassett, just checking in: how are things looking?

In T404738#11401254, @jsn.sherman wrote:

Hi @sbassett, just checking in: how are things looking?

Is the code within a fairly stable state at this point? i.e. there are unlikely to be further, volatile changes for at least a few weeks? If so, we should get https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PersonalDashboard/+/1189934 rebased and free of conflicts and then I can complete the review.

In T404738#11402314, @sbassett wrote:

In T404738#11401254, @jsn.sherman wrote:

Hi @sbassett, just checking in: how are things looking?

Is the code within a fairly stable state at this point? i.e. there are unlikely to be further, volatile changes for at least a few weeks? If so, we should get https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PersonalDashboard/+/1189934 rebased and free of conflicts and then I can complete the review.

The master branch now has functional modules in it, so you should just be able to look directly there and skip the example module patch. I will abandon it.
There are a few other things that will be added for the MVP, but we shouldn't be blazing any trails that would impact our security posture. We can call those changes out when we're merging them in if that would be helpful.

Since we're drifting near the end-of-calendar-year deployment freeze, we're amending our goal to reflect reality: we're now aiming to get this in front of users in early January. We would like to shake down on test wiki before the deployment freeze, which would mean catching the Dec 15 (1.46.0-wmf.7) train at the latest.

@sbassett just checking in; do you have what you need to review this week?

In T404738#11440662, @jsn.sherman wrote:

@sbassett just checking in; do you have what you need to review this week?

Hey @jsn.sherman - Yes, the review has been in-progress, up to 4a614aa4c0. I need to analyze a few additional details and then should have something posted this week.

Security Review Summary - T404738 - 2025-12-05
Last commit reviewed: 4a614aa4c0

Summary

Overall, the current PersonalDashboard extension code appears to be in very good shape with an overall risk rating of: low. See specific issues found below.

Vulnerable Packages - Production
Risk: low

Numerous tools including osv_scanner, semgrep and various language-specifc audit tools were run and no vulnerabilities were found.

Vulnerable Packages - Development
Risk: low

Numerous tools including osv_scanner, semgrep and various language-specifc audit tools were run and no vulnerabilities were found.

Outdated Packages

As reported via composer outdated:
(no explicit vulnerabilities reported, simply noting for completeness' sake.)

Static Analysis Findings
Risk: low

No major findings via semgrep and similar tools. See General Security Issues below for more details.

HTTP and other protocol Leaks
Risk: low

None found.

General code health score
Risk: low

1. The Wikimedia code health check tool returned a weighted risk score of 35.90.

+-----------+----------+----------+------+---------------+---------------+--------------+-------------+------------+--------------+-----------+---------------+
| Vuln Pkgs | Pkg Mgmt | Test Cov | SAST | Non-auto Cmts | Uniq Contribs | Contrib Conc | Lang Guides | Staff Supp | Task Backlog | Code Stew | Weighted Risk |
+===========+==========+==========+======+===============+===============+==============+=============+============+==============+===========+===============+
|         0 |        7 |        7 |    0 |            10 |            10 |            4 |           7 |         10 |            0 |         0 |         35.90 |
+-----------+----------+----------+------+---------------+---------------+--------------+-------------+------------+--------------+-----------+---------------+

General Security Issues
Risk: low

1. Within package.json, for the vitest-plugin-mediawiki dev dependency, it is preferred that this be set to an actual published, pinned version as opposed to referencing specific commits within a gitlab.wikimedia.org URL. Since this is a dev dependency and is hosted at Wikimedia's Gitlab instance, it would still be considered low-risk but is not a best practice.
2. There were a couple of extremely minor issues found by bearer SAST in certain JavaScript files in resources: basically insufficient randomization with Math.random() and potentially disclosing sensitive data via certain console.warn() calls. These are extremely low-risk issues, if that, primarily just flagging for awareness.
3. There are several instances of Html::rawElement() that some of our MediaWiki-specific semgrep rules found, but cross-checking with $wgUseXssLanguage enabled within a local MediaWiki-Docker environment and the Phan taint-check plugin did not yield any positive findings.