Page MenuHomePhabricator

Security Readiness Review For Datatables
Closed, DeclinedPublic

Description

Project Information

Description of the tool/project:

Client-side library to display fully-featured tables at the client side.

I'm filling this request for DataTables jQuery plugin, as that's what I use in WMCZ-Tracker (finance-tracking app used by Wikimedia Czech Republic). But, I'm willing to accept suggestions about different plugins doing similar work that would be more prefered by the Security team, because they are maybe easier to review (or maybe there already _is_ a reviewed code I could use?).

I basically need a client-side library that allows me to create a table that supports:

  • On-the-fly filtering with custom logic (for instance, "user is newcomer", meaning "user tenure < 3 weeks", etc.)
  • Loading data directly from a JSON blob provided by the server

Description of how the tool will be used at WMF:

The plugin will be used as part of mentor dashboard, which is currently developed by the Growth-Team. Precisely, it will be used to facilitate the mentee overview module, see T278971 for details.

Dependencies

List dependencies, or upstream projects that this project relies on.

DataTables' only dependency is jQuery, which is already used by prodiction.

Has this project been reviewed before?

Please link to tasks or wiki pages of previous reviews.

I'm unaware of a Security-team conducted review of DataTables' code. However, it is used in numerous Wikimedia-affiliated tools and even production-deployed code (similar-users service), see https://codesearch.wmcloud.org/deployed/?q=datatables&i=nope&files=&excludeFiles=&repos= and https://codesearch.wmcloud.org/search/?q=dataTables&i=fosho&files=&excludeFiles=&repos=.

Working test environment

Please link or describe setup process for setting up a test environment.

https://datatables.net/manual/installation are upstream docs for getting DataTables ready.

Post-deployment

Name of team responsible for tool/project after deployment and primary contact.

The Mentor dashboard will be supported and maintained by the Growth-Team post-deployment.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Hi @Urbanecm_WMF - can you please let us know what your target deployment date is? It will help us to resource this appropriately. Please know that next quarter (Q1) would be the soonest we'd be able to get you in queue for review. Thank you!

sbassett changed the task status from Open to Stalled.May 6 2021, 9:27 PM
sbassett triaged this task as Low priority.

Taking this back. Won't be necessary on second thought.