public inbox for [email protected]  

help / color / mirror / Atom feed

From: Daniel Gustafsson <[email protected]>
To: Akshat Jaimini <[email protected]>
Cc: [email protected]
Cc: Magnus Hagander <[email protected]>
Subject: Re: Permission to allow testing harness to send error reports for pgweb directly to mailing list.
Date: Fri, 6 Oct 2023 14:38:35 +0200
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAMaW3VhQ-tfc6cHx=QxLgDsWHYFccZPz=JOq87frnkaANmPggw@mail.gmail.com>
References: <CAMaW3VhRaUvSi_mR+_th7b=LQ3NZ-=Kg_aqTmAQpRXhC9zoDJg@mail.gmail.com>
	<CABUevEyiDjSY3iR6V-3EWqRmpgX490uVoxKWzCFXJUD5NOUvKQ@mail.gmail.com>
	<CAMaW3VgFmQH6Qz_5rE3mmGrSqNXk-0T0z_czufZOnMai2Yo61w@mail.gmail.com>
	<[email protected]>
	<CAMaW3VhQ-tfc6cHx=QxLgDsWHYFccZPz=JOq87frnkaANmPggw@mail.gmail.com>

> On 6 Oct 2023, at 08:05, Akshat Jaimini <[email protected]> wrote:
> 
> > Publishing this report to a website would handle that I think.
> I had sent a proposal/tried to start a discussion for this a few days earlier

It would probably help if you could link to a report from a run of the test
suite.  I clicked through the linked repo but I was unable to see an example
testrun.

> > One question, would this test harness detect and report potential security issues like XSS?
> Security related tests were not added in the Gsoc timeline but we are planning to add them. Maybe when we add those tests we can create a separate section on the proposed website only available to some 'admins' with all these sensitive reports being displayed there.

For tests like that we must really think about scope, limiting the report isn't
useful if we publish the tests for anyone to run themselves and thus generate
the report.  Malicious actors are no doubt probing the website continuously
regardless of this, but we don't necessarily need to do the job for them.

--
Daniel Gustafsson

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected]
  Subject: Re: Permission to allow testing harness to send error reports for pgweb directly to mailing list.
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox