{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/testpilot/issues/1482","repository_url":"https://api.github.com/repos/mozilla/testpilot","labels_url":"https://api.github.com/repos/mozilla/testpilot/issues/1482/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/testpilot/issues/1482/comments","events_url":"https://api.github.com/repos/mozilla/testpilot/issues/1482/events","html_url":"https://github.com/mozilla/testpilot/issues/1482","id":180028973,"number":1482,"title":"[tracker] Security checklist","user":{"login":"jvehent","id":415617,"avatar_url":"https://avatars.githubusercontent.com/u/415617?v=3","gravatar_id":"","url":"https://api.github.com/users/jvehent","html_url":"https://github.com/jvehent","followers_url":"https://api.github.com/users/jvehent/followers","following_url":"https://api.github.com/users/jvehent/following{/other_user}","gists_url":"https://api.github.com/users/jvehent/gists{/gist_id}","starred_url":"https://api.github.com/users/jvehent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvehent/subscriptions","organizations_url":"https://api.github.com/users/jvehent/orgs","repos_url":"https://api.github.com/users/jvehent/repos","events_url":"https://api.github.com/users/jvehent/events{/privacy}","received_events_url":"https://api.github.com/users/jvehent/received_events","type":"User","site_admin":false},"labels":[{"id":337828600,"url":"https://api.github.com/repos/mozilla/testpilot/labels/security","name":"security","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":{"login":"clouserw","id":80098,"avatar_url":"https://avatars.githubusercontent.com/u/80098?v=3","gravatar_id":"","url":"https://api.github.com/users/clouserw","html_url":"https://github.com/clouserw","followers_url":"https://api.github.com/users/clouserw/followers","following_url":"https://api.github.com/users/clouserw/following{/other_user}","gists_url":"https://api.github.com/users/clouserw/gists{/gist_id}","starred_url":"https://api.github.com/users/clouserw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clouserw/subscriptions","organizations_url":"https://api.github.com/users/clouserw/orgs","repos_url":"https://api.github.com/users/clouserw/repos","events_url":"https://api.github.com/users/clouserw/events{/privacy}","received_events_url":"https://api.github.com/users/clouserw/received_events","type":"User","site_admin":false},"assignees":[{"login":"clouserw","id":80098,"avatar_url":"https://avatars.githubusercontent.com/u/80098?v=3","gravatar_id":"","url":"https://api.github.com/users/clouserw","html_url":"https://github.com/clouserw","followers_url":"https://api.github.com/users/clouserw/followers","following_url":"https://api.github.com/users/clouserw/following{/other_user}","gists_url":"https://api.github.com/users/clouserw/gists{/gist_id}","starred_url":"https://api.github.com/users/clouserw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clouserw/subscriptions","organizations_url":"https://api.github.com/users/clouserw/orgs","repos_url":"https://api.github.com/users/clouserw/repos","events_url":"https://api.github.com/users/clouserw/events{/privacy}","received_events_url":"https://api.github.com/users/clouserw/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2016-09-29T11:59:16Z","updated_at":"2016-11-20T16:08:24Z","closed_at":null,"body":"## Risk Management\r\n- [x] The service must have performed a Rapid Risk Assessment and have a Risk Record bug (**SVC-RRA**).\r\n## Infrastructure rules\r\n- [x] Use [Intermediate TLS](https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility) (**INFRA-TLS**)\r\n- [x] Set HSTS to 31536000 (1 year) (**INFRA-HSTS**)\r\n- [x] Set HPKP to 5184000 (60 days) (**INFRA-HPKP**)\r\n  - `Public-Key-Pins: max-age=300; pin-sha256=\"WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=\"; pin-sha256=\"r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=\";`\r\n    - Start with max-age set to 5 minutes and increase gradually\r\n    - Pin to the EV and DV roots of Digicert\r\n  - [x] If the service is not hosted under `services.mozilla.com`, it must be manually added to [Firefox's preloaded pins](https://dxr.mozilla.org/mozilla-central/source/security/manager/tools/PreloadedHPKPins.json#184).\r\n- If service has an admin panels, it must:\r\n  - [x] only be available behind Mozilla VPN (which provides MFA) (**INFRA-ADMINVPN**)\r\n  - [x] require LDAP authentication (**INFRA-ADMINLDAP**)\r\n  - [x] enforce a two-man rule on sensitive changes (**INFRA-2MANRULE**)\r\n## Coding rules\r\n\r\nThe following rules apply to all web applications: api and websites.\r\n- [ ] Sign all commits (**APP-COMMITSIG**)\r\n  - Developers should [configure git to sign all commits](http://micropipes.com/blog//2016/08/31/signing-your-commits-on-github-with-a-gpg-key/) and upload their PGP fingerprint to https://login.mozilla.com\r\n- [x] Detailed logging in mozlog format (**APP-MOZLOG**)\r\n  - Business logic must be logged with app specific codes (errno)\r\n  - Access control failures must be logged at WARN level\r\n- [x] All SQL queries must be parameterized, not concatenated (**APP-SQL**)\r\n- [x] User data must be escaped for the right context prior to reflecting it (**APP-ESCAPE**)\r\n- [x] Apply sensible limits to user inputs, see [input validation](https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Input_Validation) (**APP-INPUTVAL**)\r\n- [x] Enforce Access Controls server-side (**APP-ACL**)\r\n- [x] Set the Secure flag on [Cookies](https://wiki.mozilla.org/Security/Guidelines/Web_Security#Cookies), and use sensible Expiration and HTTPOnly (**APP-SECCOOKIE**)\r\n- Keep 3rd-party libraries up to date (**APP-DEPS**)\r\n  - [ ]  Use [NSP](https://nodesecurity.io/) or [GreenKeeper](https://greenkeeper.io/ Greenkeeper) for NodeJS applications\r\n  - [ ] Use pip --outdated or [requires.io](https://requires.io/) for Python applications\r\n- [x] If handling cryptographic keys, must have a mechanism to handle monthly key rotations (**APP-KEYROT**)\r\n  - [x] All keys must be rotated quarterly.\r\n  - Keys used to sign sessions don't need a rotation mechanism if destroying all sessions is acceptable during.\r\n### Additional websites requirements\r\n\r\nThe following coding rules only apply to websites, not web apis.\r\n- [x] Never store passwords, use Firefox Accounts (**APP-IDP**)\r\n- [x] Forbid Mixed content, always use HTTPS (**APP-MIXCONTENT**)\r\n- [x] Must have a CSP with (**APP-CSP**)\r\n  - [x] a report-uri pointing to the service `/__cspreport__`\r\n  - [x] frame-options set to deny\r\n  - [x] no use of unsafe-inline or unsafe-eval\r\n- [x] Must have CSRF tokens and manually excluded specific forms (**APP-CSRF**)\r\n- [x] Should consider having checksums for 3rd-party content via SRI (**APP-SRI**).\r\n  - Trusted 3rd parties, like Google Analytics, don't need SRI. Use your best judgment to decide if a 3rd party script is trustworthy (and assume it is not).\r\n- Consider Security headers as appropriate (**APP-HEADERS**)\r\n  - [x] X-Content-Type-Options\r\n  - [x] X-Frame-Options\r\n  - [x] X-XSS-Protection\r\n## Data rules\r\n- When storing sensitive user data (like browsing history) on Mozilla servers:\r\n  - [x] Anonymize it (similar to Tiles) (**DATA-ANON**)\r\n  - [x] Encrypt it client-side (similar to Sync) (**DATA-CRYPT**)\r\n  - [x] If user data must be stored non-anonymized and in clear text, you must talk to the security and legal teams about it.\r\n- If the service pushes data to Firefox, like when distributing blacklists or pushing updates, cryptographic signatures must be used. (**DATA-SIGN**)\r\n  - [x] Addons must use standard AMO signing (**APP-SIGNING**)\r\n  - [x] Code & Conf must use Content-Signature via [Autograph](https://github.com/mozilla-services/autograph) (**DATA-SIGNING**)\r\n"},"comment":{"url":"https://api.github.com/repos/mozilla/testpilot/issues/comments/261787015","html_url":"https://github.com/mozilla/testpilot/issues/1482#issuecomment-261787015","issue_url":"https://api.github.com/repos/mozilla/testpilot/issues/1482","id":261787015,"user":{"login":"jvehent","id":415617,"avatar_url":"https://avatars.githubusercontent.com/u/415617?v=3","gravatar_id":"","url":"https://api.github.com/users/jvehent","html_url":"https://github.com/jvehent","followers_url":"https://api.github.com/users/jvehent/followers","following_url":"https://api.github.com/users/jvehent/following{/other_user}","gists_url":"https://api.github.com/users/jvehent/gists{/gist_id}","starred_url":"https://api.github.com/users/jvehent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvehent/subscriptions","organizations_url":"https://api.github.com/users/jvehent/orgs","repos_url":"https://api.github.com/users/jvehent/repos","events_url":"https://api.github.com/users/jvehent/events{/privacy}","received_events_url":"https://api.github.com/users/jvehent/received_events","type":"User","site_admin":false},"created_at":"2016-11-20T16:08:24Z","updated_at":"2016-11-20T16:08:24Z","body":">> If the service is not hosted under services.mozilla.com, it must be manually added to Firefox's preloaded pins.\r\n\r\n> I think this is out of my wheelhouse. Can we check this off?\r\n\r\nYes. Covered in [bug 1301956](https://bugzilla.mozilla.org/show_bug.cgi?id=1301956)\r\n\r\n>> Detailed logging in mozlog format (APP-MOZLOG)\r\n\r\n> We have stuff going into Sentry. Does that cover this?\r\n\r\nThis wouldn't apply to testpilot since it's a static site. Out of curiosity: what generates sentry logs?\r\n\r\n>> Enforce Access Controls server-side (APP-ACL)\r\n\r\n> I don't think I can answer this one.\r\n\r\nDoesn't apply to static sites. It applies to webapps that manage user resources with permissions.\r\n\r\n>> Forbid Mixed content, always use HTTPS (APP-MIXCONTENT)\r\n\r\n> Is this asking for a header or setting? We don't have non-ssl content, afaik, but I don't know that we do any \"forbidding\" \r\n\r\nForbid is probably the wrong term. This is really asking devs to make sure all content is served through HTTPS, which you do already.\r\n\r\nI'm impressed by how well you're doing on the security checklist, thanks for putting in the effort!\r\n\r\nThe last item, signing all commits, will probably take us some time to implement correctly."}}
{"actor":{"display_login":"jvehent"}}