Difference between revisions of "T135963: Add support for Content-Security-Policy (CSP) headers in MediaWiki"

Latest revision as of 14:42, 30 June 2021

Phabricator Link	T135963
Status	open
Priority	Medium (orange)
Points
Phabricator Task Created	2016/05/22 09:03 PM
Wiki Page Created	2019/06/09 01:29 PM
Phabricator Task Last Modified	2021/06/30 01:01 PM
Wiki Page Last Updated	2021/06/30 03:42 PM
Phabricator Task Closed
Authored By	Bawolff (Brian Wolff)
Assigned To
Projects	ContentSecurityPolicy (MediaWiki) Epic MediaWiki-General Patch-For-Review Platform Team Legacy (Watching / External) Security-Team (Back Orders) TechCom-RFC (TechCom-RFC-Closed) (Implemented)
Platform Engineering Initiative Column
Platform Team Workboards Column
Subtasks	T209022: current CSP testing policy would block frames (invalid) T208188: RFC: Partial opt-out method for Content security policy (open) T120888: Create optional XSS filter step for the parser (open) T208191: Set hhvm.virtual_host[default][always_decode_post_data] = false (declined) T196923: CSP Report: Triggered by mediawiki.js's domEval() function in Chrome and Safari (but not Firefox) (resolved)
Parent Tasks

Column Transitions: (Added project: ⇑, Removed project: ⇓,Entered column: ⇒, Exited column: ⇐)

Project	Column	Date
TechCom-RFC	⇐ P1: Define	1 June 2016
TechCom-RFC	⇒ Request IRC meeting	1 June 2016
TechCom-RFC	⇐ Request IRC meeting	15 June 2016
TechCom-RFC	⇒ Under discussion	15 June 2016
TechCom-Has-shepherd	⇐ Backlog	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
TechCom-Has-shepherd	⇐ Krinkle	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
⇑ MediaWiki-Platform-Team		26 March 2018
MediaWiki-Platform-Team	⇐ Inbox	26 March 2018
MediaWiki-Platform-Team	⇒ Watching	26 March 2018
⇑ Epic		11 June 2018
Security-Team	⇐ Incoming	10 July 2018
Security-Team	⇒ Incoming	10 July 2018
⇓ MediaWiki-Platform-Team		11 July 2018
⇑ Core-Platform-Team-Old		11 July 2018
Core-Platform-Team-Old	⇐ Inbox	11 July 2018
Core-Platform-Team-Old	⇒ Watching	11 July 2018
⇑ Patch-For-Review		13 August 2018
Security-Team	⇐ Incoming	4 September 2018
Security-Team	⇒ Epics in progress	4 September 2018
⇓ TechCom-RFC		14 September 2018
TechCom-RFC	⇐ Under discussion	14 September 2018
TechCom-RFC	⇒ TechCom-RFC-Closed	14 September 2018
⇑ TechCom-RFC (TechCom-RFC-Closed)		14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇐ Untriaged	14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	14 September 2018
⇓ Core-Platform-Team-Old		1 October 2018
⇑ Platform Team Legacy (Watching / External)		1 October 2018
Security-Team	⇐ Epics in progress	23 September 2019
Security-Team	⇒ Waiting	23 September 2019
⇑ ContentSecurityPolicy		3 November 2019
ContentSecurityPolicy	⇐ Backlog	25 November 2019
ContentSecurityPolicy	⇒ MediaWiki	25 November 2019
TechCom-RFC (TechCom-RFC-Closed)	⇐ Implemented	23 September 2020
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	23 September 2020
Security-Team	⇐ Waiting	17 May 2021
Security-Team	⇒ Back Orders	17 May 2021
⇑ MediaWiki-General		30 June 2021

@@ Line 5: / Line 5: @@
 |points=
 |dateCreated=1463965397
-|dateModified=1579730151
+|dateModified=1625072473
 |author={{Phabricator User
 |type=author
@@ Line 17: / Line 17: @@
 }}{{Phabricator Project
 |name=Epic
+|entryDate=1463965397
+}}{{Phabricator Project
+|name=MediaWiki-General
 |entryDate=1463965397
 }}{{Phabricator Project
@@ Line 23: / Line 26: @@
 }}{{Phabricator Project
 |name=Security-Team
-|column=Waiting
+|column=Back Orders
-|entryDate=1569254857
+|entryDate=1621268229
 }}{{Phabricator Project
 |name=TechCom-RFC (TechCom-RFC-Closed)
 |column=Implemented
-|entryDate=1536960362
+|entryDate=1600895695
 }}{{Phabricator Project
-|name=Core Platform Team Legacy
+|name=Platform Team Legacy
 |column=Watching / External
 |entryDate=1463965397
@@ Line 36: / Line 39: @@
 |subtasks=209022,208191,208188,196923,120888
 |transitions={{Transition
+|date=1625072473
+|type=Added Project
+|project=MediaWiki-General
+}}{{Transition
+|date=1621268229
+|type=Entered Column
+|project=Security-Team
+|column=Back Orders
+}}{{Transition
+|date=1621268229
+|type=Exited Column
+|project=Security-Team
+|column=Waiting
+}}{{Transition
+|date=1600895695
+|type=Entered Column
+|project=TechCom-RFC (TechCom-RFC-Closed)
+|column=Implemented
+}}{{Transition
+|date=1600895695
+|type=Exited Column
+|project=TechCom-RFC (TechCom-RFC-Closed)
+|column=Implemented
+}}{{Transition
+|date=1574670667
+|type=Entered Column
 |project=ContentSecurityPolicy
 |column=MediaWiki
-|transitionDate=1574670667
-|transitionType=Entered Column
 }}{{Transition
+|date=1574670667
+|type=Exited Column
 |project=ContentSecurityPolicy
 |column=Backlog
-|transitionDate=1574670667
-|transitionType=Exited Column
 }}{{Transition
+|date=1572775916
+|type=Added Project
+|project=ContentSecurityPolicy
+}}{{Transition
+|date=1569254857
+|type=Entered Column
 |project=Security-Team
 |column=Waiting
-|transitionDate=1569254857
-|transitionType=Entered Column
 }}{{Transition
+|date=1569254857
+|type=Exited Column
 |project=Security-Team
 |column=Epics in progress
-|transitionDate=1569254857
-|transitionType=Exited Column
 }}{{Transition
+|date=1538412490
+|type=Removed Project
+|project=Core-Platform-Team-Old
+}}{{Transition
+|date=1538412490
+|type=Added Project
+|project=Platform Team Legacy (Watching / External)
+}}{{Transition
+|date=1536960362
+|type=Entered Column
 |project=TechCom-RFC (TechCom-RFC-Closed)
 |column=Implemented
-|transitionDate=1536960362
-|transitionType=Entered Column
 }}{{Transition
+|date=1536960362
+|type=Exited Column
 |project=TechCom-RFC (TechCom-RFC-Closed)
 |column=Untriaged
-|transitionDate=1536960362
-|transitionType=Exited Column
 }}{{Transition
+|date=1536941430
+|type=Removed Project
+|project=TechCom-RFC
+}}{{Transition
+|date=1536941430
+|type=Added Project
+|project=TechCom-RFC (TechCom-RFC-Closed)
+}}{{Transition
+|date=1536941430
+|type=Entered Column
 |project=TechCom-RFC
 |column=TechCom-RFC-Closed
-|transitionDate=1536941430
-|transitionType=Entered Column
 }}{{Transition
+|date=1536941430
+|type=Exited Column
 |project=TechCom-RFC
 |column=Under discussion
-|transitionDate=1536941430
-|transitionType=Exited Column
 }}{{Transition
+|date=1536078289
+|type=Entered Column
 |project=Security-Team
 |column=Epics in progress
-|transitionDate=1536078289
-|transitionType=Entered Column
 }}{{Transition
+|date=1536078289
+|type=Exited Column
 |project=Security-Team
 |column=Incoming
-|transitionDate=1536078289
-|transitionType=Exited Column
 }}{{Transition
+|date=1534175799
+|type=Added Project
+|project=Patch-For-Review
+}}{{Transition
+|date=1531355307
+|type=Entered Column
 |project=Core-Platform-Team-Old
 |column=Watching
-|transitionDate=1531355307
-|transitionType=Entered Column
 }}{{Transition
+|date=1531355307
+|type=Exited Column
 |project=Core-Platform-Team-Old
 |column=Inbox
-|transitionDate=1531355307
-|transitionType=Exited Column
 }}{{Transition
+|date=1531355169
+|type=Removed Project
+|project=MediaWiki-Platform-Team
+}}{{Transition
+|date=1531355169
+|type=Added Project
+|project=Core-Platform-Team-Old
+}}{{Transition
+|date=1531228823
+|type=Entered Column
 |project=Security-Team
 |column=Incoming
-|transitionDate=1531228823
-|transitionType=Entered Column
 }}{{Transition
+|date=1531228823
+|type=Exited Column
 |project=Security-Team
 |column=Incoming
-|transitionDate=1531228823
-|transitionType=Exited Column
 }}{{Transition
+|date=1528733479
+|type=Added Project
+|project=Epic
+}}{{Transition
+|date=1522103848
+|type=Entered Column
 |project=MediaWiki-Platform-Team
 |column=Watching
-|transitionDate=1522103848
-|transitionType=Entered Column
 }}{{Transition
+|date=1522103848
+|type=Exited Column
 |project=MediaWiki-Platform-Team
 |column=Inbox
-|transitionDate=1522103848
-|transitionType=Exited Column
 }}{{Transition
+|date=1522103828
+|type=Added Project
+|project=MediaWiki-Platform-Team
+}}{{Transition
+|date=1468412570
+|type=Entered Column
 |project=TechCom-Has-shepherd
 |column=Krinkle
-|transitionDate=1468412570
-|transitionType=Entered Column
 }}{{Transition
+|date=1468412570
+|type=Exited Column
 |project=TechCom-Has-shepherd
 |column=Krinkle
-|transitionDate=1468412570
-|transitionType=Exited Column
 }}{{Transition
+|date=1468386590
+|type=Entered Column
 |project=TechCom-Has-shepherd
 |column=Krinkle
-|transitionDate=1468386590
-|transitionType=Entered Column
 }}{{Transition
+|date=1468386590
+|type=Exited Column
 |project=TechCom-Has-shepherd
 |column=Backlog
-|transitionDate=1468386590
-|transitionType=Exited Column
 }}{{Transition
+|date=1465963486
+|type=Entered Column
 |project=TechCom-RFC
 |column=Under discussion
-|transitionDate=1465963486
-|transitionType=Entered Column
 }}{{Transition
+|date=1465963486
+|type=Exited Column
 |project=TechCom-RFC
 |column=Request IRC meeting
-|transitionDate=1465963486
-|transitionType=Exited Column
 }}{{Transition
+|date=1464810257
+|type=Entered Column
 |project=TechCom-RFC
 |column=Request IRC meeting
-|transitionDate=1464810257
-|transitionType=Entered Column
 }}{{Transition
+|date=1464810257
+|type=Exited Column
 |project=TechCom-RFC
-|column=Inbox
+|column=P1: Define
-|transitionDate=1464810257
-|transitionType=Exited Column
 }}
 }}