Page MenuHomePhabricator

[DRAFT] Security self-review for Extension:WP25EasterEggs
Closed, DeclinedPublic

Description

NOTE: Due to the timelines associated with the Wikipedia 25 birthday celebration, we are pre-emptively planning a security self-review for the Wikipedia 25 Easter Egg extension before enabling it in production. @ATitkov will expand on the following sections to the best of his ability. The following sections are based on T405993.
1. XSS Protection
2. Third-Party JavaScript Library Security
Audit NPM packages
Audit Foreign Resources
3. API Security & Data Flow
MediaWiki API Usage
External Wiki Configuration
4. Input Validation & Sanitization
Image URL Handling
Alt Text Escaping
5. Client-Side Security
Local Storage / Caching
Router Security
6. Server-Side Security
PHP Hook Review
7. Manual Security Review
8.. Pre-Deployment Final Checks