Page MenuHomePhabricator

Application Security Review Request : ReaderExperiments
Open, In Progress, HighPublic

Description

Project Information

───────────────────────────────────────────────────────────────────────────────
Language                 Files     Lines   Blanks  Comments     Code Complexity
───────────────────────────────────────────────────────────────────────────────
JavaScript                  21      2699      298       499     1902        193
JSON                        10       338        0         0      338          0
Vue                          9      1441      159       164     1118         49
Markdown                     5       390       87         0      303          0
License                      2       360       62         0      298          0
PHP                          2        63        8        24       31          3
TypeScript Typings           1        51       14        21       16          0
XML                          1         7        0         0        7          0
YAML                         1        20        0         0       20          0
───────────────────────────────────────────────────────────────────────────────
Total                       52      5369      628       708     4033        245
───────────────────────────────────────────────────────────────────────────────
Estimated Cost to Develop (organic) $116,816
Estimated Schedule Effort (organic) 6.08 months
Estimated People Required (organic) 1.71
───────────────────────────────────────────────────────────────────────────────
Processed 170212 bytes, 0.170 megabytes (SI)
───────────────────────────────────────────────────────────────────────────────

Description of the tool/project:
ReaderExperiments is the codebase being used by the newly-formed Reader Growth team for performing A/B tests of various reader-focused features live on production wikis. A general summary of this codebase (motivation behind it, architectural decisions, etc) can be found here; that document includes some info about security considerations for this project.

This codebase will be used to deploy a series of prototypes as A/B tests for logged-out users. Code will be hidden behind feature flags, and will not be shown to users unless they are 1) bucketed into a running A/B test, or 2) have explicitly opted in to see a prototype via a URL feature flag. Prototypes will be structured as individual resource modules, and they will primarily rely on client-side code to modify the reading experience in various ways; occasionally a small amount of PHP code may also be needed to support a prototype. All features in this codebase are considered temporary and disposable – if any feature tests well and is chosen to be scaled up for true production usage, it will need to be housed in a different codebase. See this ADR for more information about our approach here.

We expect prototypes to come and go over the lifespan of this extension, but the codebase itself will remain as a re-usable space where experiments can be conducted. These prototypes are reader-focused so they are concerned with retrieving / displaying existing data in novel ways; we are not going to be accepting new user-generated content or writing to the DB for our experiments as a general rule.

Description of how the tool will be used at WMF:
Currently we have a single prototype feature, Image Browsing, which adds a new UI to article pages for visual navigation through the page. We need to launch an A/B test of this feature before the end of October to satisfy the requirements of WE 3.1.3 in the WMF annual plan. We will rely on the new Experiment Platform (xLab) and the new edge unique cookies to perform an A/B test with this feature on logged-out users. The test will be performed on about half a dozen wikis, including English Wikipedia. The test will run for roughly 1 month and will then be switched off. Users who are not part of the test will see little or no impact (we are currently optimizing how we "gate" this feature as part of T404233; we will ensure that non-participating users are only impacted very slightly or not at all).

Dependencies
In addition to some existing JS libraries which are already included in MediaWiki (Codex, Vue.js), this project requires two additional JS libraries at runtime; these have been added to a local foreign-resources file:

These dependencies are specific to the ImageBrowsing feature, and can be removed when the prototype is no longer needed.

Has this project been reviewed before?
This is a new project that has not been reviewed before.

Working test environment
We are working on getting this extension to Beta as part of T404398 (we may deploy to beta even before a security review is complete if necessary). Until then, PatchDemo is the only way to stage this codebase. Please contact @egardner for help setting up an instance if you need one.

Post-deployment
Reader Growth team will manage this extension (and the adding/removal of various prototypes within it) going forward.

Details

Risk Rating
Low

Event Timeline

egardner added a project: Reader Growth Team.
egardner moved this task from Incoming/Inbox to Radar on the Reader Growth Team board.
sbassett changed the task status from Open to In Progress.Oct 7 2025, 3:51 PM
sbassett assigned this task to mmartorana.
sbassett moved this task from Back Orders to In Progress on the secscrum board.
sbassett subscribed.

@egardner - We are targeting a mid-quarter turnaround of this review, sometime in November 2025. This should not block any deployments on your end if you have tighter timelines.

@egardner - We are targeting a mid-quarter turnaround of this review, sometime in November 2025. This should not block any deployments on your end if you have tighter timelines.

Great, thanks for the update!

In the mean time I've been doing some self-review work here: https://phabricator.wikimedia.org/T405993

We have received formal manager approval from @HSwan-WMF (see T405993#11257325) to proceed with deployment of this new extension to production prior to the completion of this review, and will move forward with deployment next week.