[go: up one dir, main page]

Page MenuHomePhabricator

Security Readiness Review For mapbox-gl-leaflet
Closed, ResolvedPublic

Description

Project Information

Description of the tool/project:
This project is a Leaflet plugin that will be used to integrate MaplibreGL and the Maps (Kartographer) extension. MaplibreGL review is a subtask of this task because the Leaflet plugin depends on MaplibreGL and Leaflet to work

Description of how the tool will be used at WMF:
The tool will be used alongside Leaflet, which we already use as Map client-side framework for dynamic maps display, and MaplibreGL which will be reviewed T274356: Security Readiness Review For maplibre-gl-js. The intention is to move the tile rendering to the client and simplify the server-side architecture as part of the following epic T263854: [Maps] Modernize Vector Tile Infrastructure. This library will be packaged and deployed in the Kartographer extension as part of its assets.

Dependencies

List dependencies, or upstream projects that this project relies on.

No dependencies listed, but the project depends on MaplibreGL and Leaflet to work.

Has this project been reviewed before?
No

Working test environment

Please link or describe setup process for setting up a test environment.

Post-deployment

Name of team responsible for tool/project after deployment and primary contact.

#product-infrastructure-team-backlog is the official maintainer of the extension and will continue it afterwards.

Event Timeline

sbassett changed the task status from Open to Stalled.Feb 17 2021, 3:57 PM
sbassett subscribed.

Added to Q4 planning column for Q4 review.

Hey @MSantos - we're looking at having an external vendor complete this review. Whether or not that happens, or we perform the review internally, we'll plan to have an update for you within two weeks (2021-04-28).

@MSantos - We had one of our vendors (ROS) perform a security audit of mapbox-gl-leaflet. They found no obvious vulnerabilities with this code, so the risk level is low, which is automatically accepted. Please let us know if you have any questions or concerns.

sbassett claimed this task.
sbassett moved this task from Vendor Confirmed to Our Part Is Done on the secscrum board.