1449026 - Infosec review of third party code (js) for use on www.mozilla.org

Status: NEW

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Eric Renaud [:erenaud]]

Marketing requirements for the Portland campaign include the use of a 3rd party font on www.mozilla.org

We've licensed the font, which requires use of js to track page views.

The code needing review and sign off by Infosec is here https://bugzilla.mozilla.org/attachment.cgi?id=8962437

Comment 1

[Eric Renaud [:erenaud]]

Please note required launch of the webpage is 3/30/2018

Comment 2

[Jonathan Petto [:jpetto]]

If it helps, the page is on a demo server [1], and the code is available in an in-progress PR [2].

[1] https://bedrock-demo-jpetto.us-west.moz.works/en-US/firefox/new/?xv=portland
[2] https://github.com/mozilla/bedrock/pull/5525/

Comment 3

[Frederik Braun [:freddy]]

CCing April

Comment 4

[April King [:April]]

Do you have the un-minified JavaScript for code review?

Comment 5

[Eric Renaud [:erenaud]]

Jon - please see April's question above

Comment 6

[April King [:April]]

:jpetto ripped out that script, so I got my only security concern answered.

Thanks so much!