685199 - need mozilla security review of Case Conductor

Status: VERIFIED DUPLICATE of bug 731749

(Mozilla QA Graveyard :: MozTrap, enhancement)

Description

[Cameron Dawson [:camd]]

Mozilla has an internal security team for web projects.  Case Conductor needs this review at some point.

Comment 1

[Cameron Dawson [:camd]]

A Pivotal Tracker story has been created for this Bug: http://www.pivotaltracker.com/story/show/17978937

Comment 2

[Cameron Dawson [:camd]]

Cameron Dawson added a comment in Pivotal Tracker:   
   
here are some of Mozilla's security coding guidelines: https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines

Comment 3

[Cameron Dawson [:camd]]

Cameron Dawson added a comment in Pivotal Tracker:   
   
Here is the form to request the review: https://wiki.mozilla.org/WebAppSec/Security_Review_Request

Comment 4

[Cameron Dawson [:camd]]

Cameron Dawson added a comment in Pivotal Tracker:   
   
Apparently using Django is a great way to make the security review faster and easier.  Yay for us!  :)  However, the mix with the platform may be a difference from that.  Dunno.  I'll let the experts do the work on that.

Comment 5

[Cameron Dawson [:camd]]

Carl Meyer added a comment in Pivotal Tracker:   
   
I already knew about the coding guidelines, and I think we already follow almost all of them. (I even wrote a popular open-source Django app to check your project's compliance with some of the guidelines!) 

Anyway, I'll double-check when we get to this story, before we request the review.

Comment 6

[Cameron Dawson [:camd]]

Cameron Dawson added a comment in Pivotal Tracker:   
   
Carl, you're 27 kinds of awesome!  :)

Comment 7

[Cameron Dawson [:camd]]

Cameron Dawson added a comment in Pivotal Tracker:   
   
OK, created new infrasec review in this bug:  https://bugzilla.mozilla.org/show_bug.cgi?id=731749

Comment 8

[Cameron Dawson [:camd]]

Carl Meyer added a comment in Pivotal Tracker:   
   
Cam - I'd also be interested in getting CCed on any new Bugzilla bugs they file against Case Conductor as part of this review. I'm guessing you were thinking that you'd catch them in Bugzilla and add them to PT and I'd see them there? But I'm thinking they may file some bugs due to a misunderstanding of something, and I might be able to address it with a comment in Bugzilla without ever needing to get to PT. Is it ok with you if I comment on that bug requesting they CC me as well?

Comment 9

[Cameron Dawson [:camd]]

Cameron Dawson added a comment in Pivotal Tracker:   
   
Oh, of course!  Absolutely.  Sorry, just an oversight on my part.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Is this a dupe of bug 731749 (secreview for Case Conductor, take 2), or is this separate?

If it is separate, please set the sec-review-needed keyword (and privacy-review-needed if applicable).

Comment 12

[Cameron Dawson [:camd]]

Cameron Dawson changed story state to accepted in Pivotal Tracker

Comment 13

[Matt Brandt [:mbrandt]]

Bumping to verified duplicate