Page MenuHomePhabricator

Security review of Citoid
Closed, ResolvedPublic0 Estimated Story Points

Description

I gave some input to the team prior to deployment, but we never did a full review.

https://gerrit.wikimedia.org/r/p/mediawiki/extensions/Citoid.git

https://gerrit.wikimedia.org/r/p/mediawiki/services/citoid

"dependencies": {
  "async": "0.9.0",
  "bluebird": "2.9.24",
  "body-parser": "1.12.3",
  "bunyan": "1.3.5",
  "cheerio": "0.18.0",
  "compression": "1.4.3",
  "content-type": "1.0.1",
  "express": "4.12.3",
  "html-metadata": "0.1.1",
  "iconv-lite": "0.4.8",
  "js-yaml": "3.2.7",
  "node-uuid": "1.4.3",
  "preq": "0.3.13",
  "request": "2.49.0",
  "service-runner": "0.1.8"
}

$wgCitoidServiceUrl = '//citoid.wikimedia.org/api';

Event Timeline

csteipp claimed this task.
csteipp raised the priority of this task from to High.
csteipp updated the task description. (Show Details)

FYI, the codebase is going to change substantially following T75993 (and to some extent T95295) so it will need to be redone following that, I suspect.

FYI, the codebase is going to change substantially following T75993 (and to some extent T95295) so it will need to be redone following that, I suspect.

I think we should be fine actually. The code-base will change to some extent, but security-wise, not much will change - the dependencies will stay the same, just as the functional part of Citoid wrt inter-service communication patterns.

@Mvolz, is there a version of citoid running in labs that I can try some things on?

csteipp closed subtask Restricted Task as Declined.May 21 2015, 9:42 PM
mobrovac closed subtask Restricted Task as Resolved.Jun 1 2015, 7:31 AM
MoritzMuehlenhoff closed subtask Restricted Task as Resolved.Jul 27 2015, 7:18 PM
mobrovac closed subtask Restricted Task as Resolved.Aug 20 2015, 12:54 PM
Jdforrester-WMF subscribed.

I assume this can be marked Resolved now, right? :-)

Looks like all of the issues have been followed up.

Jdforrester-WMF set Security to None.