T135963: Add support for Content-Security-Policy (CSP) headers in MediaWiki

Phabricator Link	T135963
Status	open
Priority	Medium (orange)
Points
Phabricator Task Created	2016/05/22 09:03 PM
Wiki Page Created	2019/06/09 01:29 PM
Phabricator Task Last Modified	2021/06/30 01:01 PM
Wiki Page Last Updated	2021/06/30 03:42 PM
Phabricator Task Closed
Authored By	Bawolff (Brian Wolff)
Assigned To
Projects	ContentSecurityPolicy (MediaWiki) Epic MediaWiki-General Patch-For-Review Platform Team Legacy (Watching / External) Security-Team (Back Orders) TechCom-RFC (TechCom-RFC-Closed) (Implemented)
Platform Engineering Initiative Column
Platform Team Workboards Column
Subtasks	T209022: current CSP testing policy would block frames (invalid) T208188: RFC: Partial opt-out method for Content security policy (open) T120888: Create optional XSS filter step for the parser (open) T208191: Set hhvm.virtual_host[default][always_decode_post_data] = false (declined) T196923: CSP Report: Triggered by mediawiki.js's domEval() function in Chrome and Safari (but not Firefox) (resolved)
Parent Tasks

Column Transitions: (Added project: ⇑, Removed project: ⇓,Entered column: ⇒, Exited column: ⇐)

Project	Column	Date
TechCom-RFC	⇐ P1: Define	1 June 2016
TechCom-RFC	⇒ Request IRC meeting	1 June 2016
TechCom-RFC	⇐ Request IRC meeting	15 June 2016
TechCom-RFC	⇒ Under discussion	15 June 2016
TechCom-Has-shepherd	⇐ Backlog	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
TechCom-Has-shepherd	⇐ Krinkle	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
⇑ MediaWiki-Platform-Team		26 March 2018
MediaWiki-Platform-Team	⇐ Inbox	26 March 2018
MediaWiki-Platform-Team	⇒ Watching	26 March 2018
⇑ Epic		11 June 2018
Security-Team	⇐ Incoming	10 July 2018
Security-Team	⇒ Incoming	10 July 2018
⇓ MediaWiki-Platform-Team		11 July 2018
⇑ Core-Platform-Team-Old		11 July 2018
Core-Platform-Team-Old	⇐ Inbox	11 July 2018
Core-Platform-Team-Old	⇒ Watching	11 July 2018
⇑ Patch-For-Review		13 August 2018
Security-Team	⇐ Incoming	4 September 2018
Security-Team	⇒ Epics in progress	4 September 2018
⇓ TechCom-RFC		14 September 2018
TechCom-RFC	⇐ Under discussion	14 September 2018
TechCom-RFC	⇒ TechCom-RFC-Closed	14 September 2018
⇑ TechCom-RFC (TechCom-RFC-Closed)		14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇐ Untriaged	14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	14 September 2018
⇓ Core-Platform-Team-Old		1 October 2018
⇑ Platform Team Legacy (Watching / External)		1 October 2018
Security-Team	⇐ Epics in progress	23 September 2019
Security-Team	⇒ Waiting	23 September 2019
⇑ ContentSecurityPolicy		3 November 2019
ContentSecurityPolicy	⇐ Backlog	25 November 2019
ContentSecurityPolicy	⇒ MediaWiki	25 November 2019
TechCom-RFC (TechCom-RFC-Closed)	⇐ Implemented	23 September 2020
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	23 September 2020
Security-Team	⇐ Waiting	17 May 2021
Security-Team	⇒ Back Orders	17 May 2021
⇑ MediaWiki-General		30 June 2021