Hi @EMagallanes - I have included you in the acl-security-legal group. Could you please verify if the permissions appear correct at this time? Thank you.

Hi @EMagallanes - To proceed, we kindly request your manager's approval.

Security Review Summary - T334962 - 2023-05-11
Last commit reviewed: 8015a9c

Hey @eoghan - I have included you in the acl-security-sre group. Could you please verify if the permissions appear correct at this time? Thank you.

Hi - we appreciate your inquire, but we regret to inform you that we currently do not provide support for this particular form of pre-release access and have no immediate plans to do so.

Hi - this task will be made public soon.

As previously mentioned, the additional powers granted by int-admin privileges already pose a significant risk in terms of potential damage. Therefore, restricting the use of withJS would result in more limitations than benefit for this particular scenario.

As mentioned in the preceding comments, unfortunately, the Security-Team cannot dedicate their efforts to resolving this issue due to its high level of complexity and negligible potential impact.

Supplemental announcement is out!

Subject: MediaWiki Extensions and Skins Security Release Supplement (1.35.10/1.38.6/1.39.3)

Security Review Summary - T324536 - 2023-03-31
Last commit reviewed: 536706d

Hi @NCommander - thanks for reporting this issue.
In case anyone is interested in writing a patch that can enhance the processing of PNG files with crop information and reject any data beyond the IEND binary marker, we would be open to that. Please note that it's not our system but Android devices that are susceptible to this issue.

Although the presence of executable javascript code may seem concerning, the appearance of such code without actual execution is unlikely to cause harm. Unfortunately, there is little that can be done about this issue as MediaWiki allows both legitimate HTML tags and escaped HTML as valid wikitext output.
There may even be a MediaWiki page about a component of javascript that may require displaying apparently valid HTML and javascript code.

Hi @alex-mashin - I'm sorry, but I'm not able to reproduce the problem in version 1.35 either. Could you please give me more information to help me understand the issue better?

Hi @alex-mashin - I cannot reproduce this issue in current master version as well.

Hi @pfischer - security access has been granted.

Hi @Stevemunene - Access has been granted.

Hi @WMDE-leszek - A risk rating of medium requires mitigations to reduce to a lower risk level or risk acceptance/ownership at the manager/director level at the WMF.

Security Review Summary - T316523 - 2023-01-20

Hi SRE and @Stevemunene - Can we get your manager's approval, please?

Supplemental announcement is out!

Subject: MediaWiki Extensions and Skins Security Release Supplement (1.35.9/1.38.4/1.39.1)

Hi @WMDE-leszek - I am going to post this security review within the next 3 weeks.

Security Review Summary - T315250 - 2022-12-22
Last commit reviewed: 58b7f7a

Since the risk for this issue is very low, we are not going to deploy it to WMF production at this moment.

Hey @CBogen - I confirm what said from @sbassett; I will post my review within the next two weeks.

Hi @Lectrician1 - I wanted to point out that the Security-Team is not disapproving the change; we have just rated it as medium risk.

In T314296#8439201, @JMcLeod_WMF wrote:

Note that the flagged "Password Hash with Insufficient Computation Effort" issue is a false positive; in this case, the SHA1 hash is being used as a hash rather than as a password, so there are no security ramifications.

Hi - The Security-Team has reviewed this proposed feature, and our feedback is that even though we agree in using Gitlab as a central repository for userscripts and gadgets would be a good idea, we don't suggest to achieve this by removing the nosniff option, as we would be exposed to several kinds of attacks such as: MIME confusion attacks and unauthorized hotlinking. The risk of doing this would be medium.

Security Review Summary - T314296 - 2022-11-24
Last commit reviewed: 14ac4b6

Hi @AnneT - Thanks for investigating these issues. The review came in as low risk, so I am just going to resolve this ticket for the moment.

In T240870#5764088, @Peachey88 wrote:

Do we need a over-all wmf group at all? Would a group per service be better for a granularized access point of view and annual access auditing?

Hi @Dreamy_Jazz - We appreciate the mention, but unfortunately we do not plan to work on this issue anytime soon.

Hi @AnneT - even though my review has an overall risk of low, do you have any plans for addressing those issues?

Subject: MediaWiki Extensions and Skins Security Release Supplement (1.35.8/1.37.5/1.38.3)

+ (T308861, CVE-2022-39191) - OAuth debug log includes consumer secrets
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OAuth/+/817860

Security Review Summary - T308495 - 2022-09-26

Hi Anti-Harassment team, do you have any interest in working on the porting of this patch?

Hi @Tgr - thank you for your patch.