706184 - TellUsMore: Security review

Status: VERIFIED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Chris More [:cmore]]

We are going to need a security review of the TellUsMore extension of Input due to automatic account creation in Bugzilla. TellUsMore will land in either late Q4 2011 or Q1 2012 (more likely).

Comment 1

[Chris More [:cmore]]

Wiki page: https://wiki.mozilla.org/Firefox/TellUsMore

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

1. Who is/are the point of contact(s) for this review?
2. Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
3. Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
4. Does this request block another bug? If so, please indicate the bug number
5. This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
6. To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list?  If so, which goal?
7. Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
7a. Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?
7b. Are there any portions of the project that interact with 3rd party services?
7c. Will your application/service collect user data? If so, please describe 
8. If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
9. Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 4

[:glob ✱]

i'll answer what i can..

> 1. Who is/are the point of contact(s) for this review?

involved parties are :aakashd (pm), :nigelb (input dev), :glob (bugzilla dev)

> 2. Please provide a short description of the feature / application (e.g.
> problem solved, use cases, etc.):

The primary purpose of Tell Us More will be to supplement the sad feedback form with an option for users to submit a bug report into Mozilla bug tracking system and allow our community of triagers to move the bug through its life cycle properly. 

> 3. Please provide links to additional information (e.g. feature page, wiki)
> if available and not yet included in feature description:

input:
https://wiki.mozilla.org/Firefox/TellUsMore
https://github.com/mozilla/input.mozilla.org/pull/40

bugzilla:
https://wiki.mozilla.org/BMO/TellUsMore
http://bzr.mozilla.org/bmo/4.0-dev/files/head:/extensions/TellUsMore/

> 7a. Does this feature or code change affect Firefox, Thunderbird or any
> product or service the Mozilla ships to end users?

no

> 7b. Are there any portions of the project that interact with 3rd party
> services?

no

> 7c. Will your application/service collect user data? If so, please describe 

yes, email address for bugzilla account creation.

Comment 5

[Mark Goodwin [:mgoodwin]]

This is a dupe of a secreview already assigned to me; taking.

Comment 6

[Aakash Desai [:aakashd]]

What glob said is all a-ok.

Comment 7

[Mark Goodwin [:mgoodwin]]

Thanks

Comment 8

[Nigel Babu [:nigelb]]

Thanks!

Comment 9

[Aakash Desai [:aakashd]]

Much obliged!