871669 - install "RSS" extension on wiki.mozilla.org

Status: RESOLVED FIXED

(Infrastructure & Operations :: IT-Managed Tools, task)

Description

[:Gavin Sharp [email: [e-mail]]]

http://www.mediawiki.org/wiki/Extension:RSS

This would be useful for incorporating status updates from http://benjamin.smedbergs.us/weekly-updates.fcgi/ into weekly meeting notes.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

jakem, is this something your team can help with? Do I need to file a secreview bug?

Comment 2

[Mark A. Hershberger (hexmode)]

I would get a secreview.  Wikimedia uses this on the Foundation wiki, but it has restricted access.

Comment 3

[Daniel Veditz [:dveditz]]

requesting sec-review from Yvan for now so this doesn't get lost. A recent bugzilla change broke our queries and the needinfo request is effectively hiding this bug (see bug 828344 comment 72)

Comment 4

[Jake Maul [:jakem]]

I have no concerns about this apart from sec-review. Seems like it'd be easy to install.

The sec-review flag should be sufficient for starters. They'll tell us if they want a separate bug. Usually seems to depend on how trivial the thing being reviewed is. This plugin doesn't seem *too* complicated...

Comment 5

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

My only concern are these two config options:

$wgRSSAllowLinkTag
$wgRSSAllowImageTag

When set to true, they will allow <A> and <IMG> tags in article bodies. I am not concerned about links and images but they do not seem to filter out HREF and SRC attributes that point to javascript: sources.

I'll dig a little deeper. Should have an answer tomorrow.

Comment 6

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Ok so Mediawiki does have a Tag and Attribute sanitizer and they do filter out Javascript, also on content of RSS feeds.

I think the risk for this plugin is low, but I would recommend to use the $wgRSSUrlWhitelist setting to limit the RSS feeds to ones we know and trust.

So looks good, go ahead.

Comment 7

[:Gavin Sharp [email: [e-mail]]]

I don't know how the whitelist works exactly, but I am most interested in including RSS feeds from http://benjamin.smedbergs.us/weekly-updates.fcgi/.

Comment 8

[Jake Maul [:jakem]]

Moving to the proper component so we can get this installed! :)

Comment 9

[Jake Maul [:jakem]]

Sorry for the very long delay.

I've rolled this out on wiki-dev.allizom.org and wiki.allizom.org. Would you care to confirm that it's working and nothing seems horribly broken? (that is, nothing that wasn't already broken anyway!)

If this looks good, it's an easy deploy to production.

Comment 10

[:Gavin Sharp [email: [e-mail]]]

Wow, thanks. I'm getting:

Extension:RSS -- Error: "http://benjamin.smedbergs.us/weekly-updates.fcgi/project/firefox/feed" is not in the whitelist of allowed feeds. There are no allowed feed URLs in the whitelist.

on wiki.allizom.org

Can you adjust wgRSSUrlWhitelist to include benjamin.smedbergs.us? I'm not sure what form the whitelist takes...

Comment 11

[:Gavin Sharp [email: [e-mail]]]

https://wiki.allizom.org/User:GavinSharp/Dashboard is where I was testing this.

Comment 12

[Jake Maul [:jakem]]

Ah! I didn't realize it used an allow/deny list. Sure... done.

Sadly, it appears that his feed is an Atom feed, not an RSS one. Compare:

https://wiki.allizom.org/User:Stagetest
https://wiki.allizom.org/User:GavinSharp/Dashboard

The former uses http://blog.wikimedia.org/feed/ and https://blog.mozilla.org/feed/, which are both RSS feeds. All 3 feeds render similarly in Firefox, but bsmedberg's renders very poorly on wikimo using this extension.

Next step for that particular feed might be to reach out to him to see if there's a usable RSS feed, or if one could be worked up. Failing that, finding a similar extension that can render Atom feeds (after a cursory search, I haven't found anything obvious). Failing that, there are libraries and/or services that purport to convert an Atom feed into RSS... I have no idea what sort of risk that might pose or how complicated they would be to set up (I tried the free one at http://devtacular.com/utilities/atomtorss/, and the RSS extension balks at the generated XML).

Comment 13

[Jake Maul [:jakem]]

I've deployed this to production and populated the whitelist with a handful of obvious Mozilla feeds (including bsmedberg's, even though it's an Atom feed and doesn't render properly).

Sorry the feed you wanted didn't work out. If we can come up with another possibility (a similar extension for Atom feeds, or a conversion, or a new link to an RSS feed), please re-open this or file a new bug as appropriate. Thanks!