812230 - SecReview Item: Review WebAppSec Secure coding checklist

Status: RESOLVED FIXED

(Release Engineering :: Release Automation: Other, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

SecReview tracking bug
Actions regarding the review of the dependent bug should be tracked here.
----
review web secuirty checklist https://wiki.mozilla.org/WebAppSec/Secure_Coding_QA_Checklist ::before testing

Comment 1

[[e-mail] (:bhearsum)]

I think I've addressed everything on here (most of it was taken care of for free by sqlalchemy/wtforms/flask, though). We're currently in the process of getting a dev environment set-up. I think it'll be easier to do the review once that's done.

Comment 2

[[e-mail] (:bhearsum)]

The dev environment is now set up @ https://ship-it-dev.allizom.org/, and it's got the latest and greatest input validation. As far as I know, it addresses everything on the checklist at this point. I think Stefan was going to do the review?

Comment 3

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Ben did you see https://bugzilla.mozilla.org/show_bug.cgi?id=812234#c6

Comment 4

[[e-mail] (:bhearsum)]

(In reply to Stefan Arentz [:st3fan] from comment #3)
> Ben did you see https://bugzilla.mozilla.org/show_bug.cgi?id=812234#c6

Whoops, I lost track of that bug. Since that's tracked over there, is there anything else to do here?

Comment 5

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

No i don't think so.