Page MenuHomePhabricator

[Task] Security review of Wikibase-Quality-External-Validation branch master
Closed, DeclinedPublic

Description

Please do a security review of Wikibase-Quality-External-Validation.
Thank you very much!

Gerrit: https://gerrit.wikimedia.org/r/#/admin/projects/mediawiki/extensions/WikibaseQualityExternalValidation

Event Timeline

Tamslo updated the task description. (Show Details)May 20 2015, 1:27 PM
Tamslo set Security to None.
Restricted Application added a project: Wikidata. · View Herald TranscriptMay 24 2015, 7:24 PM
csteipp claimed this task.Jun 5 2015, 12:03 AM
csteipp added a project: Security-Team.
csteipp moved this task from Backlog to Ready on the Security-Team board.
Lydia_Pintscher moved this task from incoming to monitoring on the Wikidata board.Jun 12 2015, 1:25 PM
Tamslo added a subscriber: Tamslo.Jun 18 2015, 9:23 AM

@csteipp: are you still working on it? And on T99352? :)

@Tamslo, are you asking if this can be closed? Definitely not. Both of the other extensions have serious issues that need to be addressed before they can be deployed, and I've only started reviewing this one. If plans change on wmde's side, please let me know.

Could you be so kind and clarify the blocking issues for the other two extensions? For Constraints we have seen only one open ticket (T101467), for which we have uploaded a fix.
Same for the Quality extension. Only one blocking task for which we have uploaded some patches. I'm not sure if we can close it on our own or if you could have another look at it?

As far as the plans of wmde are concerned:
The current plan is to do a Beta deploy about June, 19th 2015 0800 PDT.
On June, 30th there should be a deploy on test and July, 8th on wikidata.org. So far the current plans.

Do you have, additional to the questions above, something that would block the planned beta deploy?

Short clarification: Please review branch v1 on gerrit.

Tamslo moved this task from Backlog to DOING on the Wikibase-Quality board.Jun 19 2015, 2:32 PM
csteipp moved this task from Ready to In Progress on the Security-Team board.Jun 22 2015, 8:28 PM
Tamslo updated the task description. (Show Details)Jun 23 2015, 9:12 AM

The URL of the repository changed, see the description.

@Tamslo, what is the expected size of wbqev_dump_information?

@csteipp, wbqev_dump_information contains a row for each database dump, that was imported. For now, there are only 3 ones. When new databases are integrated for cross-checks, the number will increase, but this table will always just have a few rows.

JanZerebecki renamed this task from Security review of Wikibase-Quality-External-Validation to Security review of Wikibase-Quality-External-Validation branch v1.Jun 25 2015, 11:02 AM

SpecialCrossCheck::buildResultTable
$referenceStatus = $this->msg( "wbqev-crosscheck-status-" . $result->getReferenceResult()->getStatus() )->text();

Either user escaped() or don't use rawhtml in the table cell.

In ComparisonResult you guard setting the result to a list of constant strings, but in ReferenceResult that only happens on object creation. ReferenceResult should do the same as ComparisonResult.

SpecialCrossCheck::buildResultTable
$referenceStatus = $this->msg( "wbqev-crosscheck-status-" . $result->getReferenceResult()->getStatus() )->text();
Either user escaped() or don't use rawhtml in the table cell.

That already got fixed. Sorry about that.

csteipp moved this task from In Progress to Waiting on the Security-Team board.Jun 25 2015, 9:06 PM

Change 221104 had a related patch set uploaded (by Dominic.sauer):
T99358 guard setting the result to a list of constant strings in ReferenceResult similar to the ComparisonResult

https://gerrit.wikimedia.org/r/221104

Change 221107 had a related patch set uploaded (by Dominic.sauer):
T99358 guard setting the result to a list of constant strings in ReferenceResult similar to the ComparisonResult

https://gerrit.wikimedia.org/r/221107

Change 221104 merged by jenkins-bot:
T99358 guard setting the result to a list of constant strings in ReferenceResult similar to the ComparisonResult

https://gerrit.wikimedia.org/r/221104

Change 221107 merged by jenkins-bot:
T99358 guard setting the result to a list of constant strings in ReferenceResult similar to the ComparisonResult

https://gerrit.wikimedia.org/r/221107

Lydia_Pintscher renamed this task from Security review of Wikibase-Quality-External-Validation branch v1 to [Task] Security review of Wikibase-Quality-External-Validation branch v1.Aug 17 2015, 4:18 PM

@csteipp: Is this good to go from your side once T103912 is closed?

JanZerebecki renamed this task from [Task] Security review of Wikibase-Quality-External-Validation branch v1 to [Task] Security review of Wikibase-Quality-External-Validation branch master.Sep 29 2015, 10:53 AM
csteipp triaged this task as High priority.Sep 30 2015, 11:58 PM
csteipp moved this task from Backlog to Scheduled on the Security-Team-Reviews board.

@csteipp: Is this good to go from your side once T103912 is closed?

Yes

@Lydia_Pintscher, can you give us an update on this ticket?

Lydia_Pintscher changed the task status from Open to Stalled.Apr 6 2017, 3:15 PM

Sorry. For now you can ignore this. I'll mark it as stalled and reopen it when it becomes relevant again.

Aklapper removed csteipp as the assignee of this task.Dec 9 2017, 11:58 AM
Aklapper lowered the priority of this task from High to Low.
Aklapper removed a project: Patch-For-Review.

Lowering priority per last comment by Lydia; resetting assignee.

Addshore closed this task as Declined.EditedSep 21 2018, 7:51 AM
Addshore added a subscriber: Addshore.
Restricted Application removed a subscriber: Liuxinyu970226. · View Herald TranscriptSep 21 2018, 7:51 AM