Launchpad news, March 2019 – July 2019
Published by Colin Watson August 6, 2019 in General
Here’s a brief changelog of what we’ve been up to since our last general update.
Launchpad news, February 2019
Published by Colin Watson March 7, 2019 in General
Here’s a brief changelog for this month.
Launchpad news, July 2018 – January 2019
Published by Colin Watson February 21, 2019 in General
Here’s a brief changelog of what we’ve been up to since our last general update.
Git per-branch permissions
Published by Colin Watson January 10, 2019 in Code
We’ve had Git hosting support in Launchpad for a few years now. One thing that some users asked for, particularly larger users such as the Ubuntu kernel team, was the ability to set up per-branch push permissions for their repositories. Today we rolled out the last piece of this work.
Launchpad’s default behaviour is that repository owners may push anything to their own repositories, including creating new branches, force-pushing (rewriting history), and deleting branches, while nobody else may push anything. Repository owners can now also choose to protect branches or tags, either individually or using wildcard rules. If a branch is protected, then by default repository owners can only create or push it but cannot force-push or delete; if a tag is protected, then by default repository owners can create it but cannot move or delete it.
You can also allow selected contributors to push to protected branches or tags, so if you’re collaborating with somebody on a branch and just want to be able to quickly pair-program via git push, or you want a merge robot to be able to land merge proposals in your repository without having to add it to the team that owns the repository and thus give it privileges it doesn’t need, then this feature may be for you.
There’s some initial documentation on our help site, and here’s a screenshot of a repository that’s been set up to give a contributor push access to a single branch:
Launchpad news, June 2018
Published by Colin Watson July 6, 2018 in General
Here’s a brief changelog for this month.
Launchpad news, May 2018
Published by Colin Watson June 2, 2018 in General
Here’s a brief changelog for this month.
Launchpad news, June 2017 – April 2018
Published by Colin Watson May 1, 2018 in General
Once again it’s been a while since we posted a general update, so here’s a changelog-style summary of what we’ve been up to. As usual, this changelog preserves a reasonable amount of technical detail, but I’ve omitted changes that were purely internal refactoring with no externally-visible effects.
Launchpad security advisory: cross-site-scripting in site search
Published by Colin Watson April 11, 2018 in General
Summary
Mohamed Alaa reported that Launchpad’s Bing site search implementation had a cross-site-scripting vulnerability. This was introduced on 2018-03-29, and fixed on 2018-04-10. We have not found any evidence of this bug being actively exploited by attackers; the rest of this post is an explanation of the problem for the sake of transparency.
Details
Some time ago, Google announced that they would be discontinuing their Google Site Search product on 2018-04-01. Since this served as part of the backend for Launchpad’s site search feature (“Search Launchpad” on the front page), we began to look around for a replacement. We eventually settled on Bing Custom Search, implemented appropriate support in Launchpad, and switched over to it on 2018-03-29.
Unfortunately, we missed one detail. Google Site Search’s XML API returns excerpts of search results as pre-escaped HTML, using <b> tags to indicate where search terms match. This makes complete sense given its embedding in XML; it’s hard to see how that API could do otherwise. The Launchpad integration code accordingly uses TAL code along these lines, using the structure keyword to explicitly indicate that the excerpts in question do not require HTML-escaping (like most good web frameworks, TAL’s default is to escape all variable content, so successful XSS attacks on Launchpad have historically been rare):
<div class="summary" tal:content="structure page/summary" />
However, Bing Custom Search’s JSON API returns excerpts of search results without any HTML escaping. Again, in the context of the API in question, this makes complete sense as a default behaviour (though a textFormat=HTML switch is available to change this); but, in the absence of appropriate handling, this meant that those excerpts were passed through to the TAL code above without escaping. As a result, if you could craft search terms that match a portion of an existing page on Launchpad that shows scripting tags (such as a bug about an XSS vulnerability in another piece of software hosted on Launchpad), and convince other people to follow a suitable search link, then you could cause that code to be executed in other users’ browsers.
The fix was, of course, to simply escape the data returned by Bing Custom Search. Thanks to Mohamed Alaa for their disclosure.
Launchpad news, May 2017
Published by Colin Watson May 31, 2017 in General
Here’s a brief changelog for this month.
Launchpad news, November 2015 – April 2017
Published by Colin Watson April 28, 2017 in General
Well, it’s been a while! Since we last posted a general update, the Launchpad team has become part of Canonical’s Online Services department, so some of our efforts have gone into other projects. There’s still plenty happening with Launchpad, though, and here’s a changelog-style summary of what we’ve been up to.
