794548 - display "exploitability" rating in UI to logged-in users

Status: RESOLVED FIXED

(Socorro :: Webapp, task)

Description

[(not currently active) Ted Mielczarek]

In bug 794540 we'd like to add an "exploitability" field to the processed JSON. This is somewhat sensitive information, so we'd like to expose it only to logged-in users.

Comment 1

[K Lars Lohn [:lars] [:klohn]]

Just exposing this value in an individual crash's page is likely insufficient.  Is there to be reports based on this value?  I'm imagining that it would be nice to have the value available as a search parameter, too.

We need to know what you want us to do with this value besides just store it.

Comment 2

[(not currently active) Ted Mielczarek]

I don't know that it's all that useful as a search parameter. It'd probably be useful to have reports based on this. Having it displayed on the report index page for logged-in users is pretty much the minimal effort we can do here.

davidb: do you have thoughts on this?

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to Ted Mielczarek [:ted.mielczarek] from comment #2)
> I don't know that it's all that useful as a search parameter. It'd probably
> be useful to have reports based on this. Having it displayed on the report
> index page for logged-in users is pretty much the minimal effort we can do
> here.
> 
> davidb: do you have thoughts on this?

Searching is a nice to have but I wouldn't slow down for it.

Comment 4

[Laura Thomson :laura]

I think for the first iteration, let's just get it into the individual crash report display (for logged-in only).  Having it in the db makes it available for running ad hoc queries, too.

Comment 5

[Laura Thomson :laura]

Given the timing here and how simple this bug is, I think we should do it in both PHP and Django, fwiw

Comment 6

[Laura Thomson :laura]

PR for PHP
https://github.com/mozilla/socorro/pull/960

Comment 7

[[github robot]]

Commits pushed to master at https://github.com/mozilla/socorro

https://github.com/mozilla/socorro/commit/ee01bd9f91cb8f6d712819c54a0cea4e00dc56e6
Fixes bug 794548, expose exploitability attribute in the UI to logged in users

https://github.com/mozilla/socorro/commit/c5cf4b36e4c381ce163f23823ea1945957271e1a
Merge pull request #960 from lauraxt/794548

Fixes bug 794548, expose exploitability attribute in the UI to logged in...

Comment 8

[Laura Thomson :laura]

This was hard to test without data, and apparently I messed it up.  I thought the exploitability value was in the processed JSON, but apparently it's only in PostgreSQL.  Back to the drawing board a little, because nothing else on that page comes from PG.  Reopening.

Comment 9

[[DEACTIVATED] Adrian Gaudebert]

This worked initially, was just missing data from the middleware. Fixed with bug 815309.

Comment 10

[Selena Deckelmann :selenamarie :selena]

QA test should be to be able to see Exploitability field when looking at an individual bug.

Comment 11

[Matt Brandt [:mbrandt]]

QA verified on stage - the new exploitability field is only visible when logged in with an admin account.

Example crash

https://crash-stats.allizom.org/report/index/c68b329d-833c-4d18-82b1-a79c32121129

Comment 12

[Matt Brandt [:mbrandt]]

Attachment: qa - verified on prod

QA verified on prod

Comment 14

[David Bolter [:davidb] (NeedInfo me for attention)]

THANK YOU! \o/

Comment 15

[Peter Bengtsson [:peterbe]]

This regressed when we moved to Django.

Comment 16

[Peter Bengtsson [:peterbe]]

Attachment: Github PR

Comment 18

[Peter Bengtsson [:peterbe]]

Apparently, for new crashes this information is in the HBase processed JSON under the key "sensitive". So we don't need to do depend on 948533 because supposedly, it's there. 
It might be that we don't always get it but for new crashes we should.

(at the time of writing I've not been able to test any recent crashes through HBase on stage to see if it's really there)

Comment 19

[Peter Bengtsson [:peterbe]]

PR https://github.com/mozilla/socorro/pull/1910

Comment 20

[[github robot]]

Commit pushed to master at https://github.com/mozilla/socorro

https://github.com/mozilla/socorro/commit/f903be1eb0473272662f9adb12e1ec2ae26e76e1
fixes bug 794548 - display "exploitability" rating in UI to logged-in users, r=rhelmer,AdrianGaudebert

Comment 21

[[github robot]]

Commit pushed to master at https://github.com/mozilla/socorro

https://github.com/mozilla/socorro/commit/f903be1eb0473272662f9adb12e1ec2ae26e76e1
fixes bug 794548 - display "exploitability" rating in UI to logged-in users, r=rhelmer,AdrianGaudebert