Security vulnerability testing process

Security vulnerability testing process

- דורון שמי の投稿
返信数: 6

Hi,

Is there any documentation on how and by whom extensions are systematically reviewed for potential security vulnerabilities before they are published on the Tracker? I couldn't find any discussion or documentation on the subject, only if security vulnerabilities were found after publication.

I would be happy to refer to such documentation if there is one or an explanation of how the review is performed.

Thanks!

評点平均: -
דורון שמי への返信

Re: Security vulnerability testing process

- Marcus Green の投稿
画像 Core developers 画像 Particularly helpful Moodlers 画像 Plugin developers 画像 Testers
Are you referring to the approval of 3rd party plugins to be put into the plugins directory at
https://moodle.org/plugins/
評点平均: -
דורון שמי への返信

Security vulnerability testing process

- Eduardo Kraus の投稿
画像 Particularly helpful Moodlers 画像 Plugin developers 画像 Testers

Hello, Doron! 😊

What a great question! The security and quality of extensions are essential pillars for keeping Moodle reliable and safe for all users. Let’s dive in!

The plugin approval process in Moodle undergoes a detailed review to ensure that all best practices for development and security are followed. For this, there is clear documentation on how to contribute plugins, which you can check out here: Plugin Contribution. There, you’ll find a comprehensive guide on the necessary steps to submit and review plugins.

Additionally, there is a specific checklist for validation, which analyzes various aspects such as security, functionality, and compatibility. You can review the items in this checklist here: Plugin Contribution Checklist.

If you’re interested in seeing how this process works in practice, the Moodle Tracker is an excellent place to follow plugin reviews in real time. For example, here are some recent cases that showcase how these analyses are conducted:

In these discussions, you’ll see how Moodle reviewers evaluate submissions and provide feedback for necessary adjustments to ensure the quality and security of plugins before their approval and publication.

I hope this information helps you better understand the process! If you have any questions or need further clarification, I’m here to help! 🚀

Eduardo Kraus
Teacher and programmer

評点平均:Useful (4)
Eduardo Kraus への返信

תשובה ל: Security vulnerability testing process

- דורון שמי の投稿
From what I understand, there are very specific people who are in charge of the process of reviewing the plugins, returning for correction and final approval. It is not open to a general peer review of the entire Moodle developer community. Is this true? If so, how are these people selected and who selects them?
評点平均: -
דורון שמי への返信

Re: תשובה ל: Security vulnerability testing process

- Marcus Green の投稿
画像 Core developers 画像 Particularly helpful Moodlers 画像 Plugin developers 画像 Testers

The people who do the reviews are very experienced. For example I have had feedback on my plugins from someone who is the maintainer (or possibly co-maintainer) of around 18 plugins, has contributed over 1000 commits to core Moodle and has been accessing this site since 2004, and works full time for a Moodle partner (reviewing plugins is not his main job) . Another reviewer who has looked at my code first posted on this site in 2012. 

I am not aware of any specific selection mechanism. I believe it is possible for anyone to contribute to the MDL tickets in the tracker which would make you a peer reviewer. However review requires a deep knowledge of the standards there are things that "would be nice" but are not mandatory, and there are things that break the expectations because of the history of the code.

For example standards suggest that a question editing form should be in the classes subfolder. However because of 20 years of development history it is acceptable to put them in the root of the plugin folder. My understanding is that the primary purposes of review are to ensure the quality of plugins and not to follow arbitrary standards for their own sake.

To give you an example of feedback from a review, I am an experienced developer but a recent submission caught a subtle issue with possible "namespace clashes" in the future. So the plugin was well tested and would almost certainly work on any Moodle setup within the given version name, but there was a possibility of problems with a yet unknown plugin. So of course I worked on modifications to address that issue.
評点平均:Useful (3)