Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.3\))
Subject: Re: Permission to allow testing harness to send error reports for
 pgweb directly to mailing list.
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: 
 <CAMaW3VhQ-tfc6cHx=QxLgDsWHYFccZPz=JOq87frnkaANmPggw@mail.gmail.com>
Date: Fri, 6 Oct 2023 14:38:35 +0200
Cc: pgsql-www@lists.postgresql.org,
 Magnus Hagander <magnus@hagander.net>
Content-Transfer-Encoding: quoted-printable
Message-Id: <433F3C16-B91E-45D1-8C5A-E1AAEAA2541C@yesql.se>
References: 
 <CAMaW3VhRaUvSi_mR+_th7b=LQ3NZ-=Kg_aqTmAQpRXhC9zoDJg@mail.gmail.com>
 <CABUevEyiDjSY3iR6V-3EWqRmpgX490uVoxKWzCFXJUD5NOUvKQ@mail.gmail.com>
 <CAMaW3VgFmQH6Qz_5rE3mmGrSqNXk-0T0z_czufZOnMai2Yo61w@mail.gmail.com>
 <7F99AF5A-8D5D-47A3-B238-4E34004C3DFE@yesql.se>
 <CAMaW3VhQ-tfc6cHx=QxLgDsWHYFccZPz=JOq87frnkaANmPggw@mail.gmail.com>
To: Akshat Jaimini <destrex271@gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/433F3C16-B91E-45D1-8C5A-E1AAEAA2541C%40yesql.se>
Precedence: bulk

> On 6 Oct 2023, at 08:05, Akshat Jaimini <destrex271@gmail.com> wrote:
>=20
> > Publishing this report to a website would handle that I think.
> I had sent a proposal/tried to start a discussion for this a few days =
earlier

It would probably help if you could link to a report from a run of the =
test
suite.  I clicked through the linked repo but I was unable to see an =
example
testrun.

> > One question, would this test harness detect and report potential =
security issues like XSS?
> Security related tests were not added in the Gsoc timeline but we are =
planning to add them. Maybe when we add those tests we can create a =
separate section on the proposed website only available to some 'admins' =
with all these sensitive reports being displayed there.

For tests like that we must really think about scope, limiting the =
report isn't
useful if we publish the tests for anyone to run themselves and thus =
generate
the report.  Malicious actors are no doubt probing the website =
continuously
regardless of this, but we don't necessarily need to do the job for =
them.

--
Daniel Gustafsson=