Difference between revisions of "T135963: Add support for Content-Security-Policy (CSP) headers in MediaWiki"

Revision as of 11:20, 1 March 2020

Phabricator Link	T135963
Status	open
Priority	Medium (orange)
Points
Phabricator Task Created	2016/05/22 09:03 PM
Wiki Page Created	2019/06/09 01:29 PM
Phabricator Task Last Modified	2020/01/22 04:55 PM
Wiki Page Last Updated	2021/06/30 03:42 PM
Phabricator Task Closed
Authored By	Bawolff (Brian Wolff)
Assigned To
Projects	ContentSecurityPolicy (MediaWiki) Epic MediaWiki-General Patch-For-Review Platform Team Legacy (Watching / External) Security-Team (Back Orders) TechCom-RFC (TechCom-RFC-Closed) (Implemented)
Platform Engineering Initiative Column
Platform Team Workboards Column
Subtasks	T209022: current CSP testing policy would block frames (invalid) T208188: RFC: Partial opt-out method for Content security policy (open) T120888: Create optional XSS filter step for the parser (open) T208191: Set hhvm.virtual_host[default][always_decode_post_data] = false (declined) T196923: CSP Report: Triggered by mediawiki.js's domEval() function in Chrome and Safari (but not Firefox) (resolved)
Parent Tasks

Column Transitions: (Added project: ⇑, Removed project: ⇓,Entered column: ⇒, Exited column: ⇐)

Project	Column	Date
TechCom-RFC	⇐ P1: Define	1 June 2016
TechCom-RFC	⇒ Request IRC meeting	1 June 2016
TechCom-RFC	⇐ Request IRC meeting	15 June 2016
TechCom-RFC	⇒ Under discussion	15 June 2016
TechCom-Has-shepherd	⇐ Backlog	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
TechCom-Has-shepherd	⇐ Krinkle	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
⇑ MediaWiki-Platform-Team		26 March 2018
MediaWiki-Platform-Team	⇐ Inbox	26 March 2018
MediaWiki-Platform-Team	⇒ Watching	26 March 2018
⇑ Epic		11 June 2018
Security-Team	⇐ Incoming	10 July 2018
Security-Team	⇒ Incoming	10 July 2018
⇓ MediaWiki-Platform-Team		11 July 2018
⇑ Core-Platform-Team-Old		11 July 2018
Core-Platform-Team-Old	⇐ Inbox	11 July 2018
Core-Platform-Team-Old	⇒ Watching	11 July 2018
⇑ Patch-For-Review		13 August 2018
Security-Team	⇐ Incoming	4 September 2018
Security-Team	⇒ Epics in progress	4 September 2018
⇓ TechCom-RFC		14 September 2018
TechCom-RFC	⇐ Under discussion	14 September 2018
TechCom-RFC	⇒ TechCom-RFC-Closed	14 September 2018
⇑ TechCom-RFC (TechCom-RFC-Closed)		14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇐ Untriaged	14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	14 September 2018
⇓ Core-Platform-Team-Old		1 October 2018
⇑ Platform Team Legacy (Watching / External)		1 October 2018
Security-Team	⇐ Epics in progress	23 September 2019
Security-Team	⇒ Waiting	23 September 2019
⇑ ContentSecurityPolicy		3 November 2019
ContentSecurityPolicy	⇐ Backlog	25 November 2019
ContentSecurityPolicy	⇒ MediaWiki	25 November 2019
TechCom-RFC (TechCom-RFC-Closed)	⇐ Implemented	23 September 2020
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	23 September 2020
Security-Team	⇐ Waiting	17 May 2021
Security-Team	⇒ Back Orders	17 May 2021
⇑ MediaWiki-General		30 June 2021

@@ Line 35: / Line 35: @@
 }}
 |subtasks=209022,208191,208188,196923,120888
+|transitions={{Transition
+|project=ContentSecurityPolicy
+|column=MediaWiki
+|transitionDate=1574670667
+|transitionType=Entered Column
+}}{{Transition
+|project=ContentSecurityPolicy
+|column=Backlog
+|transitionDate=1574670667
+|transitionType=Exited Column
+}}{{Transition
+|project=Security-Team
+|column=Waiting
+|transitionDate=1569254857
+|transitionType=Entered Column
+}}{{Transition
+|project=Security-Team
+|column=Epics in progress
+|transitionDate=1569254857
+|transitionType=Exited Column
+}}{{Transition
+|project=TechCom-RFC (TechCom-RFC-Closed)
+|column=Implemented
+|transitionDate=1536960362
+|transitionType=Entered Column
+}}{{Transition
+|project=TechCom-RFC (TechCom-RFC-Closed)
+|column=Untriaged
+|transitionDate=1536960362
+|transitionType=Exited Column
+}}{{Transition
+|project=TechCom-RFC
+|column=TechCom-RFC-Closed
+|transitionDate=1536941430
+|transitionType=Entered Column
+}}{{Transition
+|project=TechCom-RFC
+|column=Under discussion
+|transitionDate=1536941430
+|transitionType=Exited Column
+}}{{Transition
+|project=Security-Team
+|column=Epics in progress
+|transitionDate=1536078289
+|transitionType=Entered Column
+}}{{Transition
+|project=Security-Team
+|column=Incoming
+|transitionDate=1536078289
+|transitionType=Exited Column
+}}{{Transition
+|project=Core-Platform-Team-Old
+|column=Watching
+|transitionDate=1531355307
+|transitionType=Entered Column
+}}{{Transition
+|project=Core-Platform-Team-Old
+|column=Inbox
+|transitionDate=1531355307
+|transitionType=Exited Column
+}}{{Transition
+|project=Security-Team
+|column=Incoming
+|transitionDate=1531228823
+|transitionType=Entered Column
+}}{{Transition
+|project=Security-Team
+|column=Incoming
+|transitionDate=1531228823
+|transitionType=Exited Column
+}}{{Transition
+|project=MediaWiki-Platform-Team
+|column=Watching
+|transitionDate=1522103848
+|transitionType=Entered Column
+}}{{Transition
+|project=MediaWiki-Platform-Team
+|column=Inbox
+|transitionDate=1522103848
+|transitionType=Exited Column
+}}{{Transition
+|project=TechCom-Has-shepherd
+|column=Krinkle
+|transitionDate=1468412570
+|transitionType=Entered Column
+}}{{Transition
+|project=TechCom-Has-shepherd
+|column=Krinkle
+|transitionDate=1468412570
+|transitionType=Exited Column
+}}{{Transition
+|project=TechCom-Has-shepherd
+|column=Krinkle
+|transitionDate=1468386590
+|transitionType=Entered Column
+}}{{Transition
+|project=TechCom-Has-shepherd
+|column=Backlog
+|transitionDate=1468386590
+|transitionType=Exited Column
+}}{{Transition
+|project=TechCom-RFC
+|column=Under discussion
+|transitionDate=1465963486
+|transitionType=Entered Column
+}}{{Transition
+|project=TechCom-RFC
+|column=Request IRC meeting
+|transitionDate=1465963486
+|transitionType=Exited Column
+}}{{Transition
+|project=TechCom-RFC
+|column=Request IRC meeting
+|transitionDate=1464810257
+|transitionType=Entered Column
+}}{{Transition
+|project=TechCom-RFC
+|column=Inbox
+|transitionDate=1464810257
+|transitionType=Exited Column
+}}
 }}