54
U
Property:SecReview action items
From MozillaWiki
This is a property of type Text
Pages using the property "SecReview action items"
Showing 25 pages using this property.
M | |
|---|---|
| MoPal + | ` + |
S | |
| Security/AppsProject/B2GDeviceStorage + | * Who :: What :: By when pault: check cjones around sizes/dos risks/paths/partitions dougt**Investigate file blob -> File handle patch** dougt & Djf ** Further investigate permission granularity/implementation** adamm::file bug that isSafePath checks for "." and ".." paths, "..." would get by **Other patterns that have historically caused abuse are in https://code.google.com/p/fuzzdb/source/browse/trunk/attack-payloads/path-traversal/traversals-8-deep-exotic-encoding.txt (ignore %encoded ones in this context) dougt:: fix [https://bugzilla.mozilla.org/show_bug.cgi?id=xxx bug xxx] filed by adamm above + |
| Security/AppsProject/Element.mozRequestFullscreenWithKeys + | ` + |
| Security/AppsProject/IdentityKPIBackend + | * code review of JS (when ready) * code review of WebService API (when ready) + |
| Security/AppsProject/LightningNightlyPHP + | ` + |
| Security/Kuma2 + | * Who :: What :: By when (Keep in mind all these things will be bugs that block the reivew bug, that blocks the feature bug) * adamm :: reveiw list of bleached whitelist items :: before launch * adamm :: Diagram overall architecture, build high-level architecture :: asap ** Identify existing areas of known tech debt :: asap ** adamm :: Review architecture, identify areas of architectural risk :: asap * adamm :: Identify defensive approaches defined by the project for handling expected types of bugs (injection, output encoding, csrf, etc) :: asap ** code-review areas identified as high-risk * adamm :: Identify areas of techical risk which warrant code review * adamm :: Black-box test of staging environment + |
| Security/Reviews/APK Factory + | ` + |
| Security/Reviews/Accounts Sync + | * grant jeff (jbryner@mozilla.com) and ulfr (jvehent@mozilla.com) access to 'fraud and abuse' etherpad mentioned in the wiki: https://id.etherpad.mozilla.org/fxacct-metrics-fraud-detection * Schedule Op meeting for fxa * Schedule auth-server discussion with dcoates ** Schedule reviews for auth / cloud, desktop, fxos, android, attached services (end of q1 target) Fraud and abuse meta issue: https://github.com/mozilla/fxa-auth-server/issues/222 ==OPSEC== Threat mapping What would you say are the 2-3 security/intrusion scenarios we should focus on How would you like to respond to those scenarios: --Contain and clear an intrusion --Detect and Deter active attempts --Pursue and Prosecute attackers --(Combination of any/all of the above) + |
| Security/Reviews/Audio Recording - Web API + | - Pauljt::determine the threat model for WebRTC:: - Cdiehl::fuzz this API - Pauljt::Tainting audio/video elements with cross-origin audio data, so that this API fails in such cases. (ie web page should not be able to access the contents of cross-origin resources) + |
| Security/Reviews/Autoland + | * autolander and patch review must not be the same person * individuals in the autoland group must be educated to respect sec-approval needs (security team to educate sheriffs and release management folks). * bug commit message and bug number must match (people fat finger this, or attackers could try to confuse us as to where a patch came from) + |
| Security/Reviews/B2G/mozapp + | ` + |
| Security/Reviews/B2GAppUpdates + | * Who :: What :: By when (Keep in mind all these things will be bugs that block the review bug, that blocks the feature bug) ** Confirm the update UI for pure hosted apps (ie no appcacheache) --> [jsmith] Just tested, no UI shown, update is automatically applied ** Storage permission could be granted by MITM to a hosted app not using SSL. This grants unlimited storage, so the MITM could then try to fill up the disk. ** Add UI the source of the app (install and app info section, under permission) --> install prompt bug might be https://bugzilla.mozilla.org/show_bug.cgi?id=827562 + |
| Security/Reviews/B2GBrowser + | * Who :: What :: By when (Keep in mind all these things will be bugs that block the review bug, that blocks the feature bug) * pauljt :: List of the required UI for URL Bar (SSL indicators etc?) :: by Aurora * pauljt :: Security testing of Browser API :: before beta completion + |
| Security/Reviews/B2GUpdates + | bbondy::Check to make the update is not significantly larger than expected to prevent disk space being exhausted::https://bugzilla.mozilla.org/show_bug.cgi?id=801855 Resolved<br> pauljt:: Fuzz mar format::804046 Resolved + |
| Security/Reviews/B2GWebActivities + | * Who :: What :: By when (Keep in mind all these things will be bugs that block the review bug, that blocks the feature bug) pauljt::Revisit spoofing when doing security testing of web activities:: Post Implementation pauljt::ensure registered URL is restricted to same origin based on principal fabrice::Restrict handling sensitive activities (sms, others?) to trusted or certified apps. + |
| Security/Reviews/BZ Elastic Search + | ` + |
| Security/Reviews/BZBrowserID + | <table border="1"> <tr> <td>Who</td> <td>Action</td> <td>By When</td> <td>Completed date <span style="color: grey; font-size: 80%; font-weight: bold">[NEW]</span> new <span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> Done <span style="color: red; font-size: 80%; font-weight: bold">[MISSED]</span> Miss </td> </tr> <tr> <td>Gerv</td> <td>Update code to check for absence of "nobrowserid" group </td> <td> </td> <td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> Done (http://bzr.mozilla.org/bugzilla/extensions/browserid/trunk/revision/8)</td> </tr> <tr> <td>Gerv</td> <td>File bug on full verifier support (non blocker) </td> <td> </td> <td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> Done - [https://bugzilla.mozilla.org/show_bug.cgi?id=737480 bug 737480]</td> </tr> <tr> <td>Gerv</td> <td>At appropriate moment, rename any UI elements to new branding </td> <td> </td> <td>[http://identity.mozilla.com/post/18038609895/introducing-mozilla-persona not needed]</td> </tr> <tr> <td>Gerv</td> <td>Create nobrowserid group and put relevant groups in it - all security, HR, legal </td> <td> </td> <td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> Done</td> </tr> </table> + |
| Security/Reviews/BackGroundUpdates + | <table> <tr> <td>Who</td> <td>What</td> <td>By When</td> <td>completed Y/N</td> </tr> <tr> <td>imelven</td> <td>review wiki page</td> <td>13-Jan-2012</td> <td>y</td> </tr> </table> + |
| Security/Reviews/Balrog + | * bhearsum :: Are MAR signatures checked on all platforms? Only on windows, but hashes checked on all platforms * releng :: whitelisting URLs that we point to * releng :: notifications upon human addition (maybe change too?) of a release * bhearsum :: db dump w/ instructions on how to use * psiinon :: pentest admin UI + |
| Security/Reviews/BigTent + | * Who :: What :: By when (Keep in mind all these things will be bugs that block the review bug, that blocks the feature bug) * [dchan] - Contact ozten and team about testing environment by EOD 08/20 + |
| Security/Reviews/BrowserIDProfiles + | * Who :: What :: By when (Keep in mind all these things will be bugs that block the reivew bug, that blocks the feature bug) * Yvan Boily :: code review :: before launch * identity team :: What are each of the milestones, how can these steps be broken down, specify when there is an increase in data collected. + |
| Security/Reviews/Campaign management + | * Snippet poll must be over SSL - let's make sure. + |
| Security/Reviews/ChicagoSummerLearning + | * chris :: add persona-auth to demo/ :: xx + |
| Security/Reviews/CleanUpUserProfile + | <table border="1"> <tr> <td>Who</td><td>Action</td><td>By When</td><td>Completed date</td> </tr> <tr><td>mnoorenberghe</td><td>Followup - what's in the cert8.db? We won't be migrating those. '''It does include certificate additions and revocation of trust so it's safer IMO to not migrate since that is closest to our fresh install'''</td><td>before code migrates to aurora</td><td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> 2012.03.05</td> </tr> <tr><td>mnoorenberghe</td><td>check on migration of DNT pref, master password '''we're not going to migrate any prefs. Master password is migrated properly: the pref UI is not tied to a pref.'''</td><td>before code migrates to aurora</td><td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> 2012.03.05</td> </tr> </table> '''For the other non-action items: Sync is being tracked in bug 725904. Bug 731047 tracks cleaning up the old profile.''' Not sure what the plan is for add-ons (plugins, extensions, themes). They would be disabled, but we might not migrate. Also questions on how that would work with sync. Is there anyway to get to the profile manager for someone who has no idea how to use the command line? How do other browsers handle this? Do they delete the old profile? * IE does not support profiles, if you reinstall it over-writes - They support irreversible [http://windows.microsoft.com/en-US/windows7/Reset-Internet-Explorer-settings-in-Internet-Explorer-9 reset in IE 9] though + |
| Security/Reviews/ClickToPlay + | *Keeler::ability to differentiate plugins in persisted permissions :: https://bugzilla.mozilla.org/show_bug.cgi?id=746374 ::FF19? *Keeler::differentiate regular click-to-play permissions from blocklisted click-to-play permissions::before regular click-to-play gets its own UI to enable it + |
