Quick/short security review of Extension:Sentry
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	greg
	Jan 13 2015, 4:19 PM

Description

The extension's code will change a lot before deployment to production, so it might not be worth a full on review now, but given that Sentry is to deal with stack traces, I figured a quick look is warranted.

Related Objects
Search...

Status	Assigned	Task
Declined	None	T382 RfC: Server-side Javascript error logging
Resolved	Tgr	T524 Interface to display JS error logs
Resolved	• Gilles	T525 Review existing JS error logging solutions
Open	None	T106913 Use Sentry on non-production Wikimedia wikis, Toolforge and other sites/tools
Declined	None	T106915 Use Sentry in production
Declined	Tgr	T91649 Deploy Sentry (JavaScript error logging) to production, configured to log only a limited subset of users/pages
Resolved	Tgr	T1345 Set up and test Sentry on Labs for JS error logging
Resolved	Tgr	T78807 Deploy Sentry extension on beta cluster
Resolved	csteipp	T86677 Quick/short security review of Extension:Sentry
Resolved	Tgr	T105374 Investigate if the XSS vulnerability addressed in Sentry 7.6.1 affects us
Resolved	• jlinehan	T88399 Improve Javascript error logging coverage
Resolved	Tgr	T78809 Implement module wrapping for Sentry
Declined	Tgr	T85262 Add startup script to automatically wrap asynchronous functions in try..catch
Declined	Tgr	T86058 Find out whether any browser supported by MediaWiki needs TraceKit's "rethrow to window.onerror" logic for stack traces
Declined	Tgr	T92247 Wrap jQuery AJAX callbacks in try..catch via mw.errorLogging
Resolved	Tgr	T92701 Test the impact of Javascript error logging on performance
Declined	Tgr	T93392 Make sure async wrapping for Javascript error logging only happens when the call is truly async
Resolved	Tgr	T85263 Track module initialization errors in ResourceLoader
Resolved	Tgr	T88874 Catch uncaught exceptions with Sentry
Resolved	Krinkle	T93986 mw.track subscribers cannot unsubscribe
Declined	None	T90524 Use source urls in mw.loader.store
Open	None	T508 Use CORS-enabled fetch of scripts to avoid same-domain limitations in JS error logging
Resolved	Tgr	T507 Measure how many users have CORS-hostile proxies
Declined	None	T88078 Automated tests for Javascript error logging
Open	None	T526 Add sampling and throttling support to JS error logging
Invalid	None	T89732 Investigate production and/or beta requirements for Sentry
Declined	Tgr	T93138 Procure hardware for Sentry
Resolved	Tgr	T84956 Create basic puppet role for Sentry
Resolved	jcrespo	T112228 Need to run postgresql::user twice to set the password
Resolved	Tgr	T94428 Log Javascript errors in UploadWizard funnel flow

Event Timeline

greg created this task.Jan 13 2015, 4:19 PM

greg assigned this task to csteipp.

greg raised the priority of this task from to Medium.

greg updated the task description. (Show Details)

greg added projects: Patch-For-Review, Sentry, Multimedia.

greg added subscribers: Aklapper, Tgr, He7d3r and 7 others.

Aklapper added a project: deprecated-security-team-reviews.Jan 14 2015, 6:12 PM

Super lame data flow diagram for Sentry: https://docs.google.com/a/wikimedia.org/presentation/d/1kdSdtLFev6r9rirI35n9QUrU9-3J5XgYk00vDJrqISI/edit#slide=id.p

I talked through the privacy aspects with Tgr, and as long as access to the collection server is restricted to start, we should be ok on that.

raven.js doesn't look likely to harm us. @Tgr, who on multimedia is responsible for making sure that any security fixes in upstream will get deployed into our environment?

In T86677#1019781, @csteipp wrote:

@Tgr, who on multimedia is responsible for making sure that any security fixes in upstream will get deployed into our environment?

I'll assume responsibility for that.

csteipp closed this task as Resolved.Feb 6 2015, 12:57 AM

csteipp set Security to None.

Liuxinyu970226 removed a subscriber: Liuxinyu970226.Feb 6 2015, 1:56 AM

Tgr mentioned this in T89732: Investigate production and/or beta requirements for Sentry.Apr 9 2015, 7:29 AM

sbassett moved this task from Incoming to Done on the deprecated-security-team-reviews board.Apr 24 2019, 6:40 PM

• chasemp removed a project: deprecated-security-team-reviews.Jan 8 2020, 4:18 PM