MIME-Version: 1.0
References: 
 <CAMaW3VhRaUvSi_mR+_th7b=LQ3NZ-=Kg_aqTmAQpRXhC9zoDJg@mail.gmail.com>
 <CABUevEyiDjSY3iR6V-3EWqRmpgX490uVoxKWzCFXJUD5NOUvKQ@mail.gmail.com>
 <CAMaW3VgFmQH6Qz_5rE3mmGrSqNXk-0T0z_czufZOnMai2Yo61w@mail.gmail.com>
 <7F99AF5A-8D5D-47A3-B238-4E34004C3DFE@yesql.se>
In-Reply-To: <7F99AF5A-8D5D-47A3-B238-4E34004C3DFE@yesql.se>
From: Akshat Jaimini <destrex271@gmail.com>
Date: Fri, 6 Oct 2023 11:35:01 +0530
Message-ID: 
 <CAMaW3VhQ-tfc6cHx=QxLgDsWHYFccZPz=JOq87frnkaANmPggw@mail.gmail.com>
Subject: Re: Permission to allow testing harness to send error reports for
 pgweb directly to mailing list.
To: Daniel Gustafsson <daniel@yesql.se>, pgsql-www@lists.postgresql.org,
	Magnus Hagander <magnus@hagander.net>
Content-Type: multipart/alternative; boundary="0000000000000c64610607060601"
Archived-At: 
 <https://www.postgresql.org/message-id/CAMaW3VhQ-tfc6cHx%3DQxLgDsWHYFccZPz%3DJOq87frnkaANmPggw%40mail.gmail.com>
Precedence: bulk

--0000000000000c64610607060601
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

> Publishing this report to a website would handle that I think.
I had sent a proposal/tried to start a discussion for this a few days
earlier :
https://www.postgresql.org/message-id/CAMaW3Vg%2BGoQ3JPNo%2BfbLk9ajQv%3D4g4=
J-bzSAH0OJL7S71_qMig%40mail.gmail.com
It would actually make the reporting mechanism a lot easier if we can
publish the results to a website. I am currently working on a small
prototype in golang. Currently the reports are being stored as artifacts on
Github actions(only available for 90 days) but we can use services like
Supabase etc to store our reports and present them on the website. Once we
integrate supabase we can get rid of Github artifacts for good.

> One question, would this test harness detect and report potential
security issues like XSS?
Security related tests were not added in the Gsoc timeline but we are
planning to add them. Maybe when we add those tests we can create a
separate section on the proposed website only available to some 'admins'
with all these sensitive reports being displayed there.

We can actually benefit with some more discussion on this.

Regards,
Akshat Jaimini


On Thu, Oct 5, 2023 at 8:32=E2=80=AFPM Daniel Gustafsson <daniel@yesql.se> =
wrote:

> > On 3 Oct 2023, at 21:30, Akshat Jaimini <destrex271@gmail.com> wrote:
>
> > > That is, if it finds the same issue on a later run, it must not
> re-send the same thing. How does it work in regards to that today?
> >
> > As per the current flow whenever a new commit is pushed to the pgweb
> repo, the tests are executed. If some tests fail, an error report is sent
> with the information of all the failed tests. So if that particular issue
> has been resolved, the same report won't be sent but if some other commit
> is pushed without resolving that particular issue then that particular
> error will be reported again.
>
> That doesn't seem terribly great, while bugs and errors should be fixed
> when
> found, sending reports of them repeatedly risk reporting-fatigue.
> Publishing
> this report to a website would handle that I think.
>
> One question, would this test harness detect and report potential securit=
y
> issues like XSS?  If so we should probably limit the audience of the
> report..
>
>
> --
> Daniel Gustafsson
>
>

--0000000000000c64610607060601
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>&gt; Publishing this report to a website would handle=
 that I think.</div><div>I had sent a proposal/tried to start a discussion =
for this a few days earlier : <a href=3D"https://www.postgresql.org/message=
-id/CAMaW3Vg%2BGoQ3JPNo%2BfbLk9ajQv%3D4g4J-bzSAH0OJL7S71_qMig%40mail.gmail.=
com">https://www.postgresql.org/message-id/CAMaW3Vg%2BGoQ3JPNo%2BfbLk9ajQv%=
3D4g4J-bzSAH0OJL7S71_qMig%40mail.gmail.com</a> <br></div><div>It would actu=
ally make the reporting mechanism a lot easier if we can publish the result=
s to a website. I am currently working on a small prototype in golang. Curr=
ently the reports are being stored as artifacts on Github actions(only avai=
lable for 90 days) but we can use services like Supabase etc to store our r=
eports and present them on the website. Once we integrate supabase we can g=
et rid of Github artifacts for good.<br></div><div><br></div><div>&gt; One =
question, would this test harness detect and report potential security issu=
es like XSS?</div><div>Security related tests were not added in the Gsoc ti=
meline but we are planning to add them. Maybe when we add those tests we ca=
n create a separate section on the proposed website only available to some =
&#39;admins&#39; with all these sensitive reports being displayed there.<br=
></div><div><br></div><div>We can actually benefit with some more discussio=
n on this.<br></div><div><br></div><div>Regards,</div><div>Akshat Jaimini</=
div><div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" cl=
ass=3D"gmail_attr">On Thu, Oct 5, 2023 at 8:32=E2=80=AFPM Daniel Gustafsson=
 &lt;<a href=3D"mailto:daniel@yesql.se">daniel@yesql.se</a>&gt; wrote:<br><=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo=
rder-left:1px solid rgb(204,204,204);padding-left:1ex">&gt; On 3 Oct 2023, =
at 21:30, Akshat Jaimini &lt;<a href=3D"mailto:destrex271@gmail.com" target=
=3D"_blank">destrex271@gmail.com</a>&gt; wrote:<br>
<br>
&gt; &gt; That is, if it finds the same issue on a later run, it must not r=
e-send the same thing. How does it work in regards to that today?<br>
&gt; <br>
&gt; As per the current flow whenever a new commit is pushed to the pgweb r=
epo, the tests are executed. If some tests fail, an error report is sent wi=
th the information of all the failed tests. So if that particular issue has=
 been resolved, the same report won&#39;t be sent but if some other commit =
is pushed without resolving that particular issue then that particular erro=
r will be reported again. <br>
<br>
That doesn&#39;t seem terribly great, while bugs and errors should be fixed=
 when<br>
found, sending reports of them repeatedly risk reporting-fatigue.=C2=A0 Pub=
lishing<br>
this report to a website would handle that I think.<br>
<br>
One question, would this test harness detect and report potential security<=
br>
issues like XSS?=C2=A0 If so we should probably limit the audience of the r=
eport..<br>
<br>
<br>
--<br>
Daniel Gustafsson<br>
<br>
</blockquote></div>

--0000000000000c64610607060601--