Why is this security?

In T242821#5804476, @Urbanecm wrote:

Why is this security?

"Filed as a security task in case there are security issues pertinent to expanding access, given that the views are restricted in the first place" - I don't have access to security tasks, so I don't know the full history / can't tell if there is some other issue that may be relevant. Filed as security to err on the side of caution.

Thanks, missed that. @Daimona and @sbassett , what do you think?

I think it's good to have this task protected as sectask as a precaution. However, I don't really think it should stay protected. I believe there's nothing exploitable in the various test features, as they don't give any access to private filters, in any way. Either way, it'd be good to have Scott or someone else on the Sec Team speak their mind.

As for the subject of the task, I'm fine with that, we can introduce a new right (as long as the change is back-compat for WMF wikis).

Just want to note that the restrictions on access to /test separate from the ability to view private filters came up in a discussion at https://en.wikipedia.org/w/index.php?title=Wikipedia_talk:Edit_filter_helper#Nomination_requirement? - allowing a separate right would make it easier to expand access to the testing interface without the potential consequences of expanding access to viewing private filters.

In T242821#5804775, @Daimona wrote:

I think it's good to have this task protected as sectask as a precaution. However, I don't really think it should stay protected. I believe there's nothing exploitable in the various test features, as they don't give any access to private filters, in any way. Either way, it'd be good to have Scott or someone else on the Sec Team speak their mind.

{{ping}} any objections to making this public @sbassett?

In T242821#6714343, @DannyS712 wrote:

{{ping}} any objections to making this public @sbassett?

None from me. I agree with @Daimona that the task and the proposed solution do not expose anything particularly security-sensitive and/or not already-known by interested parties. I'll make this task public now.

The only concern that came up on the enwp discussion was to ensure that someone could not overload the tool with either rate or size of test cases, with a corresponding effect on the wiki itself since the tool does run the regex against the live database. So some sort of rate limit or query condition limit may be desirable.

Please reset the edit policy.

Instead of a rate limit, what if unprivileged uses of /test were limited to at most N cores and M bytes of memory? Then the only "service" anyone could "deny" is /test itself, which doesn't seem like a worthwhile target. Something similar is done with regex and Special:Search, if I recall.

Change 665374 had a related patch set uploaded (by Matěj Suchánek; owner: Matěj Suchánek):
[mediawiki/extensions/AbuseFilter@master] Use a new method for using

https://gerrit.wikimedia.org/r/665374

As a reminder, Special:AbuseFilter/test still allows you to view private filters with a URL like https://en.wikipedia.org/wiki/Special:AbuseFilter/test/2.

In T242821#6844239, @suffusion_of_yellow wrote:

As a reminder, Special:AbuseFilter/test still allows you to view private filters with a URL like https://en.wikipedia.org/wiki/Special:AbuseFilter/test/2.

But only if you have abusefilter-modify or abusefilter-view-private.

@sbassett: I thought the idea was to have canTestTools(), in the future, also allow users some new right (abusefilter-test, etc.). If that's done, then users with that new right will also be able to view private filters, with an URL like the one above.

Not saying anything is broken now, or even with this patch.

In T242821#6844336, @suffusion_of_yellow wrote:

Not saying anything is broken now, or even with this patch.

Right, I just wanted to avoid any confusion if someone thought /test wasn't currently locked down via af user rights.

Change 665374 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Create a new method for authorizing access to test tools

https://gerrit.wikimedia.org/r/665374

Untagged team task in cleanup meeting in https://office.wikimedia.org/wiki/Wikimedia_Security_Team/Phabricator_Workboard_Maintenance