=== Overview ===
This checklist provides actionable steps to verify the security of the ImageBrowsing feature before deployment to production Wikipedia for A/B testing.
---
==== 1. XSS Protection - v-html Usage Audit ====
===== Caption HTML Sanitization =====
- [ ] Confirm that all caption sources (label, figcaption, alt text) are coming from MW-parsed content which has been is sanitized
- [ ] Confirm that all uses of `v-html` in the feature will only receive sanitized content; no user-controllable content should be able to reach these areas
==== 2. Third-Party JavaScript Library Security ====
===== Audit NPM packages
- [x] NPM packages (all dev dependencies in this project) have been audited with a vulnerability scanning tool like Snyk and any discovered issues have been patched.
- Patch to update Glob to a supported version is here: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReaderExperiments/+/1192912
===== Audit Foreign Resources =====
Review `resources/lib/foreign-resources.yaml`:
- [x] **fast-average-color (v9.5.0)**
- Current version: 9.5.0
- License: MIT
- Usage: Color extraction from images
- **Action**: Check for known vulnerabilities: Search CVE databases and npm audit
- **Action**: Verify integrity hash matches: `sha512-nC6x2YIlJ9xxgkMFMd1BNoM1ctMjNoRKfRliPmiEWW3S6rLTHiQcy9g3pt/xiKv/D0NAAkhb9VyV+WJFvTqMGg==`
- **Action**: Review source code at https://github.com/fast-average-color/fast-average-color for suspicious patterns
- **Action**: Check latest version available and changelog for security fixes
- [x] **smartcrop (v2.0.5)**
- Current version: 2.0.5
- License: MIT
- Usage: Image cropping intelligence
- **Action**: Check for known vulnerabilities: Search CVE databases and npm audit
- **Action**: Verify integrity hash matches: `sha384-MFx/krFqqAwdVQcbFsG7NZ6io1/k+p/zRG1aJxYtjjnzaiwRUxVslq915QQ/c3Cl`
- **Action**: Review source code at https://github.com/jwagner/smartcrop.js for suspicious patterns
- **Action**: Check latest version available and changelog for security fixes
Foreign resources have been manually reviewed. Interestingly it looks like the Smartcrop library was re-formatted locally at some point (probably unintentionally). This patch restores all project foreign resources to their pristine versions to ensure that integrity is maintained: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReaderExperiments/+/1192958/1
==== 3. API Security & Data Flow ====
===== MediaWiki API Usage =====
- [ ] **Review API interactions in useMwApi.js**
- Verify `mw.ForeignApi` is initialized with `{ anonymous: true }` (line 11)
- Confirm no authentication tokens or sensitive data in API calls
- **Action**: Verify all API calls are read-only (no POST/write operations)
- [ ] **Audit API endpoints called**
- useEntityId.js: Wikibase entity lookups
- useMediaSearchResults.js: Commons media search
- useExternalImages.js: External wiki image queries
- **Action**: Verify all queries use proper parameter escaping
- **Action**: Confirm rate limiting is handled by MediaWiki's ForeignApi
===== External Wiki Configuration =====
- [ ] **Review external wiki allowlist in extension.json:28-34**
- Verify only trusted wikis: `wikipedia.org` and `wikidata.org`
- **Action**: Confirm no arbitrary external URLs can be injected
- **Action**: Test that user input cannot override allowed wikis list
==== 4. Input Validation & Sanitization ====
===== Image URL Handling =====
- [ ] **Review URL parsing in thumbExtractor.js:72-113**
- Uses `mw.util.parseImageUrl()` - MediaWiki core utility
- Verify URLs are validated before use
- **Action**: Test with malformed/malicious image URLs
- **Action**: Verify `crossorigin="anonymous"` attribute on all image urls
===== Alt Text Escaping =====
- [ ] **Verify HTML escaping of alt text**
- Confirmed: `mw.html.escape()` used anywhere alt text is displayed
- **Action**: Test with alt text containing HTML entities and script tags
- **Action**: Verify escaping is consistent across all components
==== 5. Client-Side Security ====
===== Local Storage / Caching =====
- [ ] **Review useBackgroundColor.js**
- Uses in-memory Map for caching (lines 45, 66)
- No localStorage or persistent storage used
- **Action**: Verify no sensitive data stored client-side
===== Router Security =====
- [ ] **Verify router usage** (dependency: `mediawiki.router`)
- Check for open redirect vulnerabilities
- Verify URL parameters are properly validated
- **Action**: Test with malicious URL fragments and query parameters
==== 6. Server-Side Security ====
===== PHP Hook Review =====
- [ ] **Audit Hooks.php**
- **Action**: Confirm no user input reflected in server-side output without sanitization
===== 7. Configuration Security =====
- [ ] **Review configuration in extension.json**
- `ReaderExperimentsApiBaseUri` - verify only trusted URLs can be configured
- **Action**: Add validation for API base URI format
===== 8. Manual Security Review =====
- [ ] **Code review checklist**
- All v-html uses documented and justified
- No `eval()`, `Function()`, or `innerHTML` assignments from user input
- All external data properly validated
- No sensitive data in client-side code or console logs
==== 9. Documentation & Maintenance ====
- [ ] **Security documentation**
- Document security model (MediaWiki-sanitized content only)
- Explain v-html usage and safety guarantees
- List third-party libraries and their security review status
- **Action**: Create SECURITY.md file with contact info and disclosure policy
==== 10. Pre-Deployment Final Checks ====
- [ ] Run full test suite including security tests
- [ ] Run `npm audit` and resolve any high/critical vulnerabilities
- [ ] Review all foreign resource versions for known CVEs
- [ ] Conduct manual security review
- [ ] Document all security assumptions and threat model