page source shows all feature scopes examined [disclosure leak]

[Robert Collins]

page footers show all scopes:
' in scopes {'pageid:ProjectGroup:+milestones': False}
 '

however scopes may refer to confidential teams.

[Martin Pool (mbp)]

@lifeless iirc it only lists the scopes that were relevant to determining the active rules for this request. Therefore, once we add a team-based scope (bug 666538), you'll only see it mentioned if you are actually in the relevant team. Since you know about the teams you're in this doesn't seem like a problem.

The risks seem to be:

 * if you paste the page contents to somebody else - but then there are bigger risks
 * if we add a scope that says "not_in_team:super_sekret" then that may be shown to many people

Absent a specific problem I think having it always present is good for debuggability. We could limit it to ~launchpad or similar, but then it may be hard to debug user-specific problems.

[Robert Collins (lifeless)]

On Wed, Oct 27, 2010 at 3:48 AM, Martin Pool <email address hidden> wrote:
> @lifeless iirc it only lists the scopes that were relevant to
> determining the active rules for this request.  Therefore, once we add a
> team-based scope (bug 666538), you'll only see it mentioned if you are
> actually in the relevant team.  Since you know about the teams you're in
> this doesn't seem like a problem.

It lists too many - the example I gave was from /.

> The risks seem to be:
>
>  * if you paste the page contents to somebody else - but then there are bigger risks
>  * if we add a scope that says "not_in_team:super_sekret" then that may be shown to many people

The second one concerns me greatly.

> Absent a specific problem I think having it always present is good for
> debuggability.  We could limit it to ~launchpad or similar, but then it
> may be hard to debug user-specific problems.

Still, there are tradeoffs to make :)

_Rob

[Martin Pool (mbp)]

What's the constraint here? That we only report scopes that are both relevant and actually active?

If so that should be just a matter of adding an 'if'.

[Robert Collins (lifeless)]

Showing only the scopes that matched would be a good step. I'm not
sure if its sufficient, but its clearly better than showing every
consulted scope.

[Martin Pool (mbp)]

I'll just hide them from the comment altogether; if people need to debug it we can add logging or to the timeline or add it back in conditionally.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r14512 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/14512>.