Done and done.

Subject: MediaWiki Extensions and Skins Security Release Supplement

Thanks @Reedy @Bawolff and @matmarex for taking care of 1.31 and 1.33!

In T232932#6003030, @Ladsgroup wrote:

There's a Herald rule that doesn't let users mistakenly "open" a ticket to public when it has PermanentlyPrivate tag on it. I think here it was used as more of a tool. Fixing it should not be that hard, create a tag like "StayPrivate" and use that instead (with the proper herald rules added)

Actually, re-opening to attempt some backports to release branches. And obviously this won't be held for a security release since the patch went through gerrit.

In T236509#5996533, @matmarex wrote:

Looks like I re-discovered and fixed this issue with change https://gerrit.wikimedia.org/r/c/mediawiki/core/+/582909. I was not aware it was filed as a security bug.

In T248360#5998997, @Jdlrobson wrote:

@matmarex @sbassett looks like we can revert this change now?

Done and updated on T240393:
T232932: CVE-2020-10959
T246602: CVE-2020-10960

Not sure what we want to do about T234104, re: mentioning it as part of the release announcement.

In T234104#5997251, @DannyS712 wrote:

Should this be made public?

CVEs requested. Will update table in task description and task titles when I have them.

In T248360#5996245, @Jdlrobson wrote:

Can you add me to that ticket @sbassett ? Thanks in advance!

@DannyS712 - per our SOP under Submission and Timelines, we'll still need some additional information before we can re-triage and schedule this review, namely the target date for deployment (Community-Tech as the deployment sponsors will need to confirm this) and a branch and commit sha signifying the development stopping point for the review, as we cannot review a moving target. If that's just 3515ac6, that's fine - please feel free to add it to the task description.

See also related security task: T236509.

I'd hoped to polish up the patch a bit more around some of the suggestions, but well, yeah. Strange times. Hopefully I can find some time soon to work through a few modifications and improvements.

Note: I was granted functionary rights by Trust-and-Safety on testwiki and test2wiki due to my role on the Security-Team and my involvement with CU development and testing. This was not done via the staff group as I believe that grants functionary rights across all of the projects, which I do not require. It also might be noteworthy that I have both deployment and analytics-privatedata rights and so technically have unlimited, unmonitored access to all of the same underlying data that CU would be able to access.

In T229731#5968478, @DannyS712 wrote:

Not all the backports are merged yet - should this still be open?

CVE here. Thanks, @Reedy, @DannyS712, @Jdforrester-WMF for getting the backports done!

I've submitted the CVE request for this issue - I'll update this task and T240400 once I have it. Gerrit couldn't seem to handle simple picks for the backports to 1.31, 1.33 and 1.34, so those will likely involve a bit more work, if they're even feasible.

Calling this done for now per alternative, merged patch: https://gerrit.wikimedia.org/r/579003

In T247468#5963266, @hashar wrote:

• emptying the repo and just leaving README file that would point to this task
• mark the repository inactive in Gerrit to prevent further changes.
• delete the github mirror

In T247531#5965198, @Tgr wrote:

...but I have no idea how to turn the task into a normal bug report.

In T247365#5958662, @Daimona wrote:

From a very quick look, it may be caused by the 'parentheses' message not being escaped in formatRow. It's probably worth a try. (Note: I didn't check what's the effect of changing text() to escaped() on the params)

Note: this would likely be called out as an issue in T240869, when that is completed. We currently anticipate our vendor to begin the security review around March 13th, 2020.

In T229731#5956124, @Reedy wrote:

Noting GlobalBlocking is not bundled, and it's not a core patch...

Works! Thanks.

Stalling until T247136 is resolved.

Commands used to create new repos, per doc:

1. ssh -p 29418 gerrit.wikimedia.org gerrit create-project --require-change-id --owner=wikimedia-security --parent=wikimedia/security --description='"Repository for Deployer Audit tool"' wikimedia/security/deployer-audit
2. ssh -p 29418 gerrit.wikimedia.org gerrit create-project --require-change-id --owner=wikimedia-security --parent=wikimedia/security --description='"Repository for Git Monitor tool"' wikimedia/security/gitmonitor
3. ssh -p 29418 gerrit.wikimedia.org gerrit create-project --require-change-id --owner=wikimedia-security --parent=wikimedia/security --description='"Repository for PHP Security Tools"' wikimedia/security/php-security-tools
4. ssh -p 29418 gerrit.wikimedia.org gerrit create-project --require-change-id --owner=wikimedia-security --parent=wikimedia/security --description='"Repository for Spam Accounts Statistics tool"' wikimedia/security/spamaccountstats
5. ssh -p 29418 gerrit.wikimedia.org gerrit create-project --require-change-id --owner=wikimedia-security --parent=wikimedia/security --description='"Repository for Gerrit and Phabricator User Tracker tool"' wikimedia/security/usertracker

In T234104#5949597, @DannyS712 wrote:

Can I be added to T240393 please?

Great, lets let it go out next week before we make this task public, just to be safe. Since the security issue was resolved via a nondescript gerrit patch, I don't think this needs to be held or anything for the next security release (T240393), though not sure if @Reedy would want to include mention of it there or not.