698034 - host htmlpad.org on Mozilla infra

Status: RESOLVED WONTFIX

(Infrastructure & Operations Graveyard :: WebOps: Other, task, P5)

Description

[matthew zeier [:mrz]]

This app is so useful.  We should pull it in house an treat it like a prod app.

On Thu Oct 27 22:54:35 2011, matthew zeier wrote:
What's it take to get this hosted on mozilla infra?

It should be pretty easy, actually--it's a very simple django project:

https://github.com/toolness/htmlpad

Who typically deals with deploying stuff like this?

- Atul

Comment 1

[Jeremy Orem [:oremj]]

This allows users to inject full HTML and javascript. We'll probably have to, at least, buy a domain for this, but security should look at it too.

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

(In reply to Jeremy Orem [:oremj] from comment #1)
> This allows users to inject full HTML and javascript. We'll probably have
> to, at least, buy a domain for this, but security should look at it too.

Yes, if this allows user controlled html or javascript then it will have to have its own domain.  Please file a security review request for this app and we'll take a look:

https://wiki.mozilla.org/WebAppSec/Security_Review_Request

Comment 3

[Joe Stevensen [:joe]]

Nothing for OpSec to do here. Moving back to server operations.

Comment 4

[Jake Maul [:jakem]]

This bug might as well be the sec review bug... all the information I have is already here, and there's no WebOps work until we have some commentary from AppSec. The github repo is in comment 0.

Note that http://htmlpad.org/ currently doesn't actually work. I believe it's been broken ever since our Etherpad installation began forcing SSL with a redirect. This is probably a simple fix in the htmlpad code.

This particular domain is already owned by a Mozilla employee (Atul Varma)... with his good graces we could conceivably transfer that domain to our ownership and move it under our standard registration/DNS/hosting infrastructure. I don't know if there are any security concerns beyond needing to be hosted on a separate domain.

Comment 5

[Jake Maul [:jakem]]

This app doesn't work, and absolutely nothing has happened lately to fix it. And it's likely to break again when we moved to Etherpad Lite.

I recommend folks switch to https://thimble.webmaker.org/en-US/editor, which is tailor-made to do more or less precisely what htmlpad does/did.