881706 - SecReview: CSOL-site

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Frederik Braun [:freddy]]

I just did the security review for bug 879991 and atul pointed me at csol-site, so I figured this could require a review as well.

Brian, would you mind addressing the questions from https://wiki.mozilla.org/Security/Reviews/Review_Request_Form#Security_Assurance_Review_Request to speed up the security review?
As far as I understand this project is high profile and needs to be completed very soon.


Thanks!

Comment 1

[Brian Brennan [:brianloveswords]]

cc'ing Andrew Hayward who did the bulk of the work on this project.

Comment 2

[Frederik Braun [:freddy]]

The most obvious & dangerous spots look rather OK, but I need a test environment to play with the handling of user input.

Andrew, can you provide answers to the typical review questions and point me at a the staging/dev sites you are using?
I already found out about openbadger-csol.mofostaging.net and https://csol-aestimia.herokuapp.com - but it looks like a csol-site is missing here.

Also, I would like to have access to admin things, api-keys and session-secrets for those sites.
My persona ID is [e-mail] and I'm happy to receive those secrets on IRC (my session "freddyb", should be registered and using SSL at all times.)

Comment 3

[Andrew Hayward [:arhayward]]

Review Q&A:

Who is/are the point of contact(s) for this review?

- Andrew Hayward <[e-mail]>
- Mike Larsson <[e-mail]>
- Chris McAvoy <[e-mail]>
- JP Schneider <[e-mail]> - DevOps / Infrastructure


Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):

 - csol-site runs chicagosummeroflearning.org.
 - Developed in partnership with the City of Chicago.
 - All terms of service and privacy policies are agreements between the users and the City of Chicago.
 - Mozilla is acting as a 3rd party host to the website. A memo of understanding of our role in the site is 'on file' with Mozilla Counsel.
 - The site allows users (both over and under 13) to find summer programs to participate in and earn badges from.


Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:

 - https://github.com/mozilla/CSOL-site - the code repository
 - http://csol-aws.mofostaging.net/ - staging server


Does this request block another bug? If so, please indicate the bug number

 - No


This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

 - As soon as possible - this is technically already live


To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list? If so, which goal?

 - Not that I'm aware of


Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

 - No


Are there any portions of the project that interact with 3rd party services?

 - Yes - OpenBadger and Aestimia, though both are Mozilla properties (and both of which you're already aware of)


Will your application/service collect user data? If so, please describe

 - Yes - we are currently requiring most users to enter full names, and email addresses if they are aged 13 and above.
 - Additionally, we are also asking for a user's school, student ID, gender, ethnicity and ZIP code, though these are not required.

Comment 4

[Frederik Braun [:freddy]]

Sorry, forgot closing the bug.
Please take a look at the dependant bugs. The XSS issue is probably the most pressing.