Security/SOP/Application Security Reviews

Review Required by: 12th February 2020

Purpose
To document the process and requirements for individuals in need of a pre-deployment security code review.

Before a new feature or significant change to an existing feature, extension, service, or library is deployed (or intended to be deployed) to production on SRE-managed hardware, it MUST have gone through the security review process defined in this SOP.

Work product this SHALL NOT be relevant for:
 * Routine changes which are typically submitted through Gerrit and handled via standard code review
 * Security patches or other discreetly-deployed code
 * Apps running under Cloud VPS, even high-visibility apps like Quarry, etc.
 * Any user-JavaScript or Gadgets which may run on various Wikimedia wikis
 * Various Node services and python applications or tooling which will run under SRE-managed hardware (in addition to MW core and extensions)

If there are any questions as to what constitutes the requirement for a security review, please contact the Security Team (security-team@undefinedwikimedia.org).

Preparing for a Security Readinesss Review
Typically, WMF teams or individual MediaWiki developers embarking on a new project should plan to have 2 or 3 check-ins with the Security Team.

Reviewing before intended deployment

Initiatives MUST have a Security Readiness Review task in Phabricator documenting that a pre-deployment security code review, and addressed any blockers before they can deploy a new extension or major feature. This review will ensure that the controls identified in any design or concept review have been implemented prior to deployment. Additionally, the Security Team will attempt to ensure that the project avoids common implementation flaws. New requests can be made via the Security Readiness Review request form.

If a task has already been created within Phabricator as a placeholder for a review, we ask that you provide the information from the aforementioned Phabricator form on said task. Review requests which are missing requested information may be delayed or declined.

There are three possible results of this review:


 * No issues found, extension can be deployed (provided other requirements at Review queue are met). (Example: T148583)
 * Minor issues found, or any major issues found are straightforward fixes. Extension can be deployed once the found issues are fixed. (Example: T149808)
 * Major or complex security issues found. Once the identified issues are fixed, the extension/software will have to be re-reviewed. (Example: T133408)

Request Submission and Timelines

 * 1) At least 30 days prior to the estimated deployment date, the requester creates a Phabricator Task using the Security Readiness Review request form.
 * 2) Weekly, the Security Coordinator reviews Requests that come into the queue.


 * 1) Security Coordinator checks that the Task is at least 30 days prior to deployment date or puts the Task in the queue for prioritization and contacts the task author.
 * 2) Security Coordinator checks that Task has ALL required information; if the Task is missing information, the Security Coordinator sends the Task back to the owner and holds the Task for 3 days awaiting information.
 * 3) If the task meets the prerequisite requirements the Security Coordinator will approve the Task, and assign it to a Security Team Engineer and places the Task in the  “In Progress” queue.
 * 4) See the #Security-Team-Reviews workboard for currently planned reviews.
 * 5) The “In Progress” queue reflects all active Security Readiness Reviews. These tasks typically have target completion dates of two to four weeks.
 * 6) A Security Team Engineer will review the task and will comment and change status as appropriate.
 * 7) If your Task is reviewed by the Security Team Engineer and requires action on your part, the task will be placed in the Waiting queue. The Task may reside there for no more than 30 days.
 * 8) If the Security Team Engineer has not received a response within 30 days for the above, the task will be moved to the Frozen column.

Expectations

 * All code SHOULD avoid the top 25 CWEs, and comply with the requirements of Security for developers/Architecture.
 * Libraries SHOULD encourage safe practices by the developers who use them, or clearly document when misuse can result in a security flaw.
 * Services SHOULD use a standard framework or service template.
 * External applications (services, or applications such as media conversion utilities) used by the code SHOULD not have known, open security issues. The application SHOULD be supported by a competent security program.
 * For external application or libraries, a WMF team MUST be committed to being alerted about and fixing any security issues that are fixed by the upstream developers.
 * The people developing the code have already reviewed it, and believe it to be secure. See also:
 * What We Are Looking For
 * Third Party Code Review Checklist
 * Security Checklist For Developers
 * Security For Developers Tutorial
 * Security For Developers Architecture


 * 1) The Security Readiness Review request MUST include the following information (as templated within the request form):
 * 2) Name of tool/project
 * 3) Description of the tool/project
 * 4) Description of how the tool will be used at WMF
 * 5) Name of the individual/group requesting review and primary contact
 * 6) Name of the individual/group responsible for tool/project after deployment and primary contact
 * 7) The target date for deployment (or approximate date deployed if already in production or labs)
 * 8) Information from any review of the tool that has already been conducted
 * 9) Working test environment
 * 10) Programming language(s) used
 * 11) Source code repository location
 * 12) Upstream project home page (if applicable)
 * 13) WMF project home page (if applicable)
 * 14) Related Phabricator tickets
 * 15) Related patch set(s)

If your project is not on the schedule and you believe it should be, or if you have any questions about the Security Teams Readiness Review process, please (contact the Security Team) as soon as possible.