close
Jump to content

Wikipedia:Bots/Requests for approval/DeadbeefBot II

Add links
From Wikipedia, the free encyclopedia
The following discussion is an archived debate. Please do not modify it. To request review of this BRFA, please start a new section at Wikipedia:Bots/Noticeboard. The result of the discussion was BERJAYA Approved.

DeadbeefBot II

[edit]

Operator: Dbeef (talk · contribs · SUL · edit count · logs · page moves · block log · rights log · ANI search)

Time filed: 02:10, Friday, May 23, 2025 (UTC)

Automatic, Supervised, or Manual: automatic

Programming language(s): Rust

Source code available: https://github.com/fee1-dead/usync

Function overview: Sync userscripts from Git(Hub/Lab) to Wikipedia.

Links to relevant discussions (where appropriate): Wikipedia:Village pump (technical)/Archive 220#Syncing user scripts from an external Git repository to Wikipedia, Wikipedia:Bots/Requests for approval/DeltaQuadBot 9, User:Novem Linguae/Essays/Linking GitHub to MediaWiki

Edit period(s): Continuous

Estimated number of pages affected: All pages that transclude Wikipedia:USync

Exclusion compliant (Yes/No): No

Already has a bot flag (Yes/No): No

Function details: The bot scans and parses the list of user scripts at this list, and they must start with the following header format:

// {{Wikipedia:USync|repo=REPO_LINK|ref=REPO_REF|path=FILE_PATH}}

so for example:

// {{Wikipedia:USync |repo=https://github.com/fee1-dead/cplus |ref=refs/heads/production |path=main.js}}

And will start syncing from the Git file to the on-wiki script.

Any user script author intending to use the bot must (1) insert the header both on-wiki, and on the Git file themselves, serving as an authorization for the bot to operate. (2) Create an application/json webhook in their Git repository pointing to https://deadbeefbot-two.toolforge.org/webhook to notify the bot of new commits that have occured on the file.

The bot will then make edits using the commit message and author information to update the user scripts.

Currently, it only supports js files in the User namespace, but its scope could be trivial expanded to cover more formats (CSS/plain wikitext) depending on usage.

This is an improvement upon the previous DeltaQuadBot task: Auditability is achieved through linking on-wiki edits to GitHub/GitLab URLs that tell you who made what changes. Webhooks are used instead of a periodic sync. Authorization must be given on-wiki to allow syncs to happen.

The code is currently a working demo. I'm planning on expanding its functionality to allow Wikimedia GitLab's webhooks, and actually deploying it. I will also apply for Interface Administrator perms as this bot requires IA permissions. Will also request 2FA on the bot when I get to it.

Discussion

[edit]
  • Just so we are aware of the alternatives here: bd808 suggested on Discord of an alternative solution to this problem which does not involve an IntAdmin bot, where script developers can create OAuth tokens and submit those tokens to a Toolforge service, and the Toolforge service would use those OAuth tokens to make edits as the script author (0xDeadbeef/GeneralNotability/etc.) instead of having the edits coming from a single bot account. There are different trade offs. I think if we're okay with a bot having IA permissions, then this solution is more convenient to setup, as the OAuth one requires going through the extra steps of creating a token. This bot also makes those edits in a centralized place when people want to inspect which scripts are maintained using this way. beef [talk] 02:34, 23 May 2025 (UTC)reply

I see a risk here in having a bot blindly copy from the github without any human verification. Interface editor rights are restricted for very good reason, as editing the site's js would be very vaulable to a potential attacker. By introducing this bot, we now also have to be concerned about the security of the github repo's the bot is copying from. Something which is external to Wikipedia. We have no control over who might be granted access to those repos, and what they might do.

In fact, it may actually hinder development of tools/scripts. Currently, as a maintainer, one can be fairly liberal in who you add to your github repo, knowing that you can review any changes when you manually move them from the GitHub to on-wiki. With this change, anyone you add to the repo, realistically should be someone the community would trust with interface admin rights. --Chris 09:49, 23 May 2025 (UTC)reply

I think the bot task is more aimed at user scripts than gadgets. You don't need to be an interface admin to edit your own scripts. Being an opt-in system, script maintainers who don't wish to take on the risk can choose not to use the system. As for security, it should be the responsibility of the script author to ensure that they, and others who have been added to the repo, have taken adequate measures (like enabling 2FA) to secure their github/gitlab accounts. – SD0001 (talk) 10:14, 23 May 2025 (UTC)reply
For what it's worth, there are already people doing this kind of things to their own userscripts, such as User:GeneralNotability/spihelper-dev.js. However, they were never done with a bot because the bot would need to be interface admin. So they just store BotPasswords/OAuth tokens in GitHub and write a CI job that uses that to edit on-wiki.
Being someone with some fair bit of the open source process, I don't see why someone who wants to personally review any changes themselves should choose to add people liberally to the GitHub repo, and then choose to use this bot if it gets approved. They should try to move the development/approval cycle onto GitHub, appropriately using pull requests and protected branches, or just keep doing what they are doing. beef [talk] 10:22, 23 May 2025 (UTC)reply
Script maintainers might be happy to take the risk of automatically copying scripts from an external site to become active client-side scripts at Wikipedia, and they might be happy with the increased vulnerability surface area. The question here is whether the Wikipedia community thinks the risk–benefit ratio means the procedure should be adopted. Johnuniq (talk) 10:36, 23 May 2025 (UTC)reply
User scripts are an "install at your own risk" already, so feel free to avoid installing user scripts that do any automatic syncing. If the community doesn't like a bot that does this for whatever reason, I can also be fine with a "store OAuth tokens that give a toolforge service access to my account" approach which requires no community approval and no bots to run, just slightly less convenient to setup.
All I am saying is that the increased vulnerability surface area remains to be proven. WP:ULTRAVIOLET and WP:REDWARN have been doing this for years. Whether approval for code occurs on-wiki or off-wiki shouldn't matter. beef [talk] 11:00, 23 May 2025 (UTC)reply
The bot as proposed crosses a pretty major security boundary by taking arbitrary untrusted user input into something that can theoretically change common.js for all users on Wikipedia.
Has anyone looked at the security of the bot itself? Chess (talk) (please mention me on reply) 01:44, 9 June 2025 (UTC)reply
@Chess: theoretically change common.js for all users on Wikipedia - no, only common.js that link to the specified page/transclude the specified page would be in scope for the bot. dbeef [talk] 01:47, 9 June 2025 (UTC)reply
@Dbeef: I understand what's in scope, but is the authorization token actually that granular? If there's a vulnerability in the bot, I could exploit that to edit anything. Chess (talk) (please mention me on reply) 02:04, 9 June 2025 (UTC)reply
@Chess: I'm not sure what you mean.
I had thought about the security implications long before this BRFA:
  • The only public facing API of the bot is a webhook endpoint. While anyone can send in data that looks plausible, the bot will only update based on source code returned from api.github.com. So malicious actors have to be able to modify the contents of api.github.com to attack that.
  • The credentials are stored on Toolforge, standard for a majority of Wikipedia bots. Root access is only given to highly trusted users and I don't think it will be abused to obtain the bot's OAuth credentials. If you think otherwise, I can move the bot deployment to my personal server provided by Oracle.
  • The public facing part uses Actix Web, a popular and well-tested Web Framework. Toolforge provides the reverse proxy. Don't think there's anything exploitable to get RCE.
  • The bot always checks the original page for the template with the configured parameters before editing. If the sync template is removed by the original owner or any interface administrator, the bot will not edit the page.
dbeef [talk] 04:51, 9 June 2025 (UTC)reply
@Dbeef: To answer Chess about BotPasswords, there is just one checkbox for "Edit sitewide and user CSS/JS" that encompasses both. ~ Amory (u • t • c) 01:06, 10 June 2025 (UTC)reply
While anyone can send in data that looks plausible, the bot will only update based on source code returned from api.github.com. So malicious actors have to be able to modify the contents of api.github.com to attack that. How does the bot verify the contents_url field in a request made to the webhook is hosted on api.github.com in the same repository as the .js file it is synching to?
I'd be reassured by OAuth, mainly because it avoids taking untrusted user input into a bot with the permissions to edit MediaWiki:Common.js on one of the top ten most visited websites on Earth. Chess (talk) (please mention me on reply) 01:58, 10 June 2025 (UTC)reply
How does the bot verify the contents_url field in a request made to the webhook is hosted on api.github.com in the same repository as the .js file it is synching to? That's a really good point. I need to fix that. dbeef [talk] 02:10, 10 June 2025 (UTC)reply
@Dbeef: I'm uncomfortable with interface admin being granted to a bot that hasn't had anyone else do a serious code review.
Not verifying contents_url would've allowed me to modify any of the scripts managed by dbeef onwiki, to give an example.
OAuth limits the impact of any flaws to just making edits under certain user accounts. Chess (talk) (please mention me on reply) 14:34, 13 June 2025 (UTC)reply
@Chess: That is a valid concern and an oversight. It was originally not there when I queried raw.githubusercontent, but I noticed that that updated slowly. I then decided to use api.github.com but hadn't realized contents_url was user input.
That was quickly fixed two days ago.
I won't be of much help reviewing my own code, but maybe other people can take a look as well? Maybe we can ping some rust developers.. dbeef [talk] 15:17, 13 June 2025 (UTC)reply
I'm a C++ developer unfortunately. I know nothing about Rust and can't even compile the bot right now. Chess (talk) (please mention me on reply) 04:37, 14 June 2025 (UTC)reply

Has there been a discussion establishing community consensus for this task, per WP:ADMINBOT? I don't see one linked here, nor one from Wikipedia:Bots/Requests for approval/DeltaQuadBot 9. The community might also decide whether the OAuth route is preferable to the interface-admin route. Anomie⚔ 11:13, 23 May 2025 (UTC)reply

Good idea, I'll post a summary to WP:VPT soon. beef [talk] 11:16, 23 May 2025 (UTC)reply
See Wikipedia:Village pump (technical)#Syncing user scripts from an external Git repository to Wikipedia beef [talk] 12:18, 23 May 2025 (UTC)reply
{{BotOnHold}} This is just until the discussion concludes (feel free to comment out when it has). Primefac (talk) 23:48, 25 May 2025 (UTC)reply
The discussion was archived at Wikipedia:Village pump (technical)/Archive 220#Syncing user scripts from an external Git repository to Wikipedia with a rough consensus to implement the bot. dbeef [talk] 03:31, 8 June 2025 (UTC)reply
BERJAYA Approved for trial (30 edits or 30 days, whichever happens first). Please provide a link to the relevant contributions and/or diffs when the trial is complete. I will be cross-posting this to both WP:AN and WP:BN for more eyes. Primefac (talk) 13:23, 8 June 2025 (UTC)reply
I will be deploying the bot in a few days and do some deliberate test edits to get this started. If any user script authors are willing to try this for trial please let me know :) dbeef [talk] 13:37, 8 June 2025 (UTC)reply
The linked discussion seemed to settle pretty quickly on using OAuth rather than interface editor permissions. Is that still the plan? Anomie⚔ 03:07, 9 June 2025 (UTC)reply
That's not how I read it. It was explored as an alternative but to me it looks like more editors expressed support for the interface editor bot. dbeef [talk] 03:37, 9 June 2025 (UTC)reply
On reviewing again, it looks like I misremembered and misread. The subdiscussion that concluded in OAuth was about the possible alternative to interface editor. OTOH I'm not seeing much support for the conclusion that interface editor was preferred over (normal) OAuth either; the few supporting statements may have been considering only interface editor versus password sharing. Anomie⚔ 11:31, 9 June 2025 (UTC)reply
It isn't necessarily an either/or thing. Both solutions can co-exist. If some people prefer the OAuth-based approach, they can of course implement that – it doesn't even need a BRFA. What's relevant is whether the discussion had a consensus against the interface editor approach – I don't think it does. – SD0001 (talk) 11:39, 9 June 2025 (UTC)reply
What's relevant is whether the discussion had a consensus against the interface editor approach – I don't think it does. As I said, I misremembered and misread. OTOH, dbeef claimed but to me it looks like more editors expressed support for the interface editor bot which I don't unambiguously see in the discussion either.
If some people prefer the OAuth-based approach, they can of course implement that – it doesn't even need a BRFA. I don't see any exception in WP:BOTPOL for fully automated bots using OAuth from the requirement for a BRFA. WP:BOTEXEMPT applies to the owner's userspace, not anyone who authorizes the bot via OAuth. WP:ASSISTED requires human interaction for each edit. WP:BOTMULTIOP does not contain any exemption from a BRFA. Anomie⚔ 12:00, 9 June 2025 (UTC)reply
That's a fair observation. I do see support for an interface admin bot and I believe there are no substantial concerns that would make a blocker. I continue to think of interface admin bot as the easier solution but I am not opposed to figuring out the OAuth piece also at a later time. It is just that I don't have truckloads of time to focus on stuff that seems on its surface a bit redundant. dbeef [talk] 12:46, 9 June 2025 (UTC)reply
With OAuth, the edits would be from the users' own accounts. No bot account is involved as edits are WP:SEMIAUTOMATED with each push/merge to the external repo being the required human interaction. – SD0001 (talk) 13:43, 9 June 2025 (UTC)reply
I look at WP:SEMIAUTOMATED as having the user approve the actual edit, not just do something external to Wikipedia that results in an edit that they've not looked at. But this discussion is getting offtopic for this BRFA; if you think this is worth pursuing, WP:BON or WT:BOTPOL would probably be better places. Anomie⚔ 12:01, 10 June 2025 (UTC)reply
Instead of requiring it to be linked and followed by some text in an arbitrary sequence, I'd suggest to use a transclusion for clarity, like: {{Wikipedia:AutoScriptSync|repo=<>|branch=<>|path=<>}} (perhaps also better to put the page in project space). – SD0001 (talk) 15:52, 8 June 2025 (UTC)reply
that's a little harder to parse but I suppose not too hard to implement, if parsoid can do it (hand-parsing is an option too). I'll take a look in the next few days. dbeef [talk] 16:02, 8 June 2025 (UTC)reply

After reading comments here, I'm unsure. (1) Why do we need a bot for this? Is there a need to perform this task repeatedly over a significant period of time? (Probably this is answered in the VPT discussion linked above, but it's more technical than I can understand.) (2) Imagine that a normal bot copies content from github to a normal userspace page, and then a human moves it to the appropriate page, e.g. first the bot puts a script at User:Nyttend/pagefordumping, and then I move it to User:Nyttend/script. This should avoid the security issue, since there's no need for the bot to have any rights beyond autoconfirmed. Would this work, or is this bot's point to avoid the work involved in all those pagemoves? (3) On the other hand, before interface admin rights were created, and normal admins could handle this kind of thing, do we know of any adminbots that were working with scripts of any sort, and if so, how did the security process work out? Nyttend (talk) 10:17, 9 June 2025 (UTC)reply

(1) Yes, because platforms like GitHub give better experiences when developing user scripts, instead of having people copy from their local code editor and paste to Wikipedia each time. This includes CI and allowing transpiled languages such as TypeScript to work. (2) is this bot's point to avoid the work involved in all those pagemoves - Yeah. (3) I don't think there was any bot that did this. dbeef [talk] 10:34, 9 June 2025 (UTC)reply
  • How are you handling licensing? When you, via your bot, publish a revision here you are doing so under CCBYSA4 and GFDL. What are you doing to ensure that the source content you are publishing is available under those licenses? — xaosflux Talk 10:07, 13 June 2025 (UTC)reply
    I think I could put a section on WP:USync that says "by inserting the header you assert that any code you submit through the Git repository is licensed under CCBYSA4/GFDL or another compatible license", but that's the best I can do.
    Would you want me to parse SPDX licenses or something? I think the responsibility is largely on the people who use the bot and not the bot itself when it comes to introducing potential copyvios. dbeef [talk] 15:09, 13 June 2025 (UTC)reply
    Is a compatible license even common on that upstream? You can't delegate authority, whoever publishes a revision is the one issuing the license on the derivative work. — xaosflux Talk 18:31, 13 June 2025 (UTC)reply
    This appears that it may end up whitewashing licenses. Anyone that reads any page from our project should be able to confidentially trust the CCBYSA license we present, including required elements such as the list of authors. — xaosflux Talk 00:56, 14 June 2025 (UTC)reply
    SPDX is an industry standard and is meant for automatically verifying the licence of a source file. Would that be inappropriate here? Chess (talk) (please mention me on reply) 04:36, 14 June 2025 (UTC)reply
    I was just wondering how exactly we should be doing it.
    For example, we can require that one must use something like {{Wikipedia:USync|authors=Foo|license=MIT}}, with license being a manually approved list. dbeef [talk] 04:39, 14 June 2025 (UTC)reply
    Including it in a template in the userscript makes sense, since then the list of authors' preferred attribution can be maintained on the repo instead of onwiki, while still being replicated onwiki.
    The "license" field should probably be SPDX if that makes it easier to parse.
    Specifically, the "licence" field should contain CC-BY-SA-4.0 OR GFDL-1.3-or-later since that matches the requirements for contributing to Wikipedia, which is that all content must be available under both licences. I don't think allowing MIT-only (or other arbitrary permissive licences) makes sense right now under the assumption it's compatible with CC-BY-SA/GFDL. We might have to maintain the MIT licence text, and the only people using this bot would be those writing userscripts specifically for Wikipedia. Multiply that by the many variants of licences that exist.
    I think it's a good idea to keep the amount of parsing in the bot as small as possible given its permissions and impact. Chess (talk) (please mention me on reply) 02:30, 15 June 2025 (UTC)reply
    We can't take content in incompatible licenses and copy them to Wikipedia. Any page published needs to be available to those reading it CCBYSA and GFDL. Additionally, if the remote site uses a -BY- license, we need to ensure that the remote authors continue to be properly attributed when republishing here. — xaosflux Talk 12:59, 17 June 2025 (UTC)reply
    I don't see a problem. All edits are implicitly released under those licenses, whether done from the UI or through some script. All you've to do is to declare in the bot documentation that "you agree to release all code you deploy to the wiki via the bot under CC-BY-SA and GFDL". – SD0001 (talk) 13:45, 17 June 2025 (UTC)reply
    this scheme is what i had in mind as well. I am not entirely sure whether a mandatory license field is needed. The assertion that content is compatibly licensed should ideally come from the very edit that inserts the WP:USync header (and we should assume such), and it's not that inserting a license field will be any different from it. dbeef [talk] 10:58, 18 June 2025 (UTC)reply
    I've added a note for licensing at Wikipedia:USync#Licensing note. dbeef [talk] 05:54, 4 July 2025 (UTC)reply
If it matters, I can vouch that CI/CD is a basic requirement now for much of software development, so I'm generally supportive of the intent of this proposal. It's better because it creates a single source of truth for what is currently deployed to the Wiki. Chess (talk) (please mention me on reply) 16:35, 13 June 2025 (UTC)reply

Post trial discussion

[edit]
  • @BAG: and Novem Linguae (sorry for the mass-ping, but IA for a bot is kind of a "big deal"), do any of you see issue with this bot getting indefinite IA (i.e. "task approved")? I'm not seeing any issues but I'd like at least 1-2 other folk to sign off on this. Primefac (talk) 12:20, 12 July 2025 (UTC)reply
    I don't see any issues with this. – SD0001 (talk) 13:35, 12 July 2025 (UTC)reply
    I have fairly major security concerns with this. What prevents me from going to GitHub, maliciously replace the userscript with a "Find Image.img --> Replace with Very_Gross_Image.img" type of script instead? This Bot would then sync Wikipiedia and GitHub, uploading my malicious script on Wikipedia, all this without anyone doing any review at any point.
    I'm open to being convinced I'm not understanding the situation clearly, but an OAuth "upon request by the script maintainer" type of solution seems better to me. Headbomb {t · c · p · b} 13:57, 12 July 2025 (UTC)reply
    You'd need collaborator or member access to that GitHub repo. I imagine the user script creator would be aware and in control of who they add, and would only add people they trust. –Novem Linguae (talk) 14:00, 12 July 2025 (UTC)reply
    Hi @Headbomb: the bot will only use content from the GitHub repo that you specify when inserting the header. Everything won't work unless you insert the header that contains the link to the GitHub repo on the Wikipedia script page first.
    If you mean that, you yourself insert the malware to your own user script, but do it through the bot - I don't see how you'd evade scrutiny or force the bot to take responsibility in that situation. dbeef [talk] 15:19, 12 July 2025 (UTC)reply
    Testing - I was one of the testers. Looked good in testing. Was useful and not buggy. The bot responded very fast (like 5 seconds).
    For security reasons, we should probably also scrutinize the security algorithm, and the security code. Dbeef, please correct me if I get anything wrong, or feel free to expand on thie below.
    Security algorithm - Detailed at Wikipedia::USync. The bot checks for 1) an authorization string on the onwiki .js page, and 2) an authorization string in the GitHub repo. The authorization string contains the exact GitHub repo, and must be present in both places. So you need access to edit 1 and 2 in order to set up and authorize the bot. Access to edit 1 is obtained by a) that .js file being in your userspace, or b) being an interface administrator. Access to edit 2 is obtained by being a collaborator or member on that GitHub repo. The user script user picks which GitHub repo. The assumption is that the user script owner will own the repo, and will only grant access to the repo to people that they trust. The repo is specifically spelled out in the onwiki edit (1).
    Everything in this chain of security checks starts with the edit to the .js page, and the edit contains the specific GitHub repo to link. So anyone who can edit that .js page has control over all this. The folks that can edit a .js page are the user if it's one of their subpages, and interface administrators. Those users are all trusted, so this should be fine.
    Security code - Here's one of the more important lines of code for security. It takes the string it found onwiki specifying which GitHub repo is to be linked, and compares it to the GitHub page to make sure they're identical. parse_js_header() also looks important. Other eyes encouraged to make sure I didn't miss anything. –Novem Linguae (talk) 14:17, 12 July 2025 (UTC)reply
    Attack vector 1 - Social engineering attacks. If a user script writer can be convinced to add a [[Wikipedia:USync]] that points to a repo they don't own, that could be an issue. However, I don't see that as a deal breaker. I can think of a worse social engineering vector that involves user scripts, and we still allow that.
    Attack vector 2 - Adding someone to your GitHub repo who later goes rogue or gets hacked. It's a risk, but in my opinion not worth blocking this over. Multiple people being able to collaborate on a repo that has continuous deployment set up, which is what this bot enables, is worth it, in my opinion. –Novem Linguae (talk) 14:24, 12 July 2025 (UTC)reply
    Attack vector 3 - Can this bot be tricked into updating a non-js page? If so, someone could trick it into spamming mainspace or something. Dbeef, can you talk a bit more about the bot's page whitelist algorithm? Things to think about... Could someone get the bot to edit a page that doesn't end in .js? Could someone get the bot to edit a page that ends in .js but isn't content model = javascript? –Novem Linguae (talk) 14:28, 12 July 2025 (UTC)reply
    Thanks for the great summary, @Novem Linguae. I plan to elaborate a bit more with a walkthrough of the code on this, but to answer your question first, the bot's page allowlisting happens at parser.rs or the search function in particular. Only pages that (1) transclude the WP:USync page and (2) have the javascript contentmodel will be stored in an in-memory map.
    This in-memory map is the source of truth for any incoming webhooks, and only pages stored in the in-memory map (that is, already known tranclusions) will be considered for further processing. dbeef [talk] 14:47, 12 July 2025 (UTC)reply
    (note that CSS support may be added in the future, which will result in a check for the css content model when that has been implemented) dbeef [talk] 14:48, 12 July 2025 (UTC)reply
    "Access to edit 2 is obtained by being a collaborator or member on that GitHub repo."
    This is my fear/contention. On Wikipedia, we tightly control who can edit userscripts. The user themselves, or an IA. On GitHub, it's whoever the script maintainer decides. You might say "but that's the same as trusting the script coder on wiki", but really is not. If, on wikipeda, ScriptCoder31's account get taken over, we block them. On GitHub... now we're depending on a third party deciding to get involved in a credentials fight. Or maybe I trust ScriptCoder31 to be a sane coder, but they have poor judgment on granting codebase access and grants their high school sibling access because they think it'll be a good learning experience and said high school sibling decides that replacing all images on wikipedia with VERY_GROSS_IMAGE.IMG would be very funny. Or they run into an issue, ask for help on stack exchange and a rando asks to have access because they want to optimize the code / can fix a problem / makes up whatever excuse to gain code access.
    Headbomb {t · c · p · b} 17:52, 12 July 2025 (UTC)reply
    @Headbomb: I have trouble understanding why it is all different. The responsibility of using the tool lies always at the person using the tool. If ScriptCoder31's account gets taken over, we will block them. If ScriptCoder31 inserts an authorization to their own userscript then the Git repository publishes malware, we block ScriptCoder31 for introducing malware.
    Said careless ScriptCoder31 must face any consequences for the edits the bot makes on behalf of them. It isn't different from an OAuth scheme where the script owner provides authorization via OAuth, then the automated system will use the OAuth authorization to still sync Git (potentially malware) to Wikipedia.
    Why do you think people who use the bot to make proxied edits will suddenly now get away with ignorance/bad decisions? dbeef [talk] 12:57, 14 July 2025 (UTC)reply
    The difference here is that if you, dbeef, have a script on Wikipedia, I can trust that only you, dbeef, can make changes to it. So if your coding friend suggest a gross image replacer on April 1st, you go "haha funny, but no, I'm not uploading that".
    Whereas on github, while you may control who has access, I must trust that you and all those you grant access to are not nefarious actors.
    That is a significant difference. Headbomb {t · c · p · b} 16:48, 14 July 2025 (UTC)reply
    Of course, nothing would stop dbeef from modifying the script in his userspace to load a script in someone else's userspace. Or letting someone else log in to his account, for that matter. I, for one, think Headbomb's concerns are overblown. All trust is by definition delegable in a system or set of systems that doesn't rely on some sort of external unforgable proof of identity. * Pppery * it has begun... 02:00, 15 July 2025 (UTC)reply
  • Security Overview. To make sure that we trust this bot enough, here are three points to cover:
    1. Make sure that the account itself is secure.
    2. Make sure that the bot does not edit outside of pages that we want them to edit.
    3. Make sure that the bot does not insert bad content (only the content we want them to insert)
  • And here's my summary:
    1. The bot is run on Toolforge. The bot's OAuth secret is stored in a file: 
      -rw-------    1 tools.deadbeefbot-two tools.deadbeefbot-two   1312 Jun  9 04:34 secrets.toml
      This means only people with access to the deadbeefbot-two tool (only me) plus people with root access (WMCS team plus a few trusted volunteers) have access to the account. The account is additionally enrolled with 2FA and with a strong password (note that using the OAuth token does not require 2FA).
    2. All titles that end up being edited have to (1) transclude the WP:USync page, (2) have the javascript contentmodel (may change in the future to include CSS), (3) have the header as described on WP:USync successfully parsed for the bot to have a chance of editing them. This means any attacker wanting to direct the bot to a different page than expected would be extremely difficult
    3. We use GitHub webhooks as a trigger but not as a source of truth. The webserver that accepts GitHub webhooks is open to the public so all sorts of requests can come through. It is hard to do validation (whether the webhook content is actually coming from GitHub) but we don't need to. The link we use to fetch the content from GitHub is hardcoded to be in the format https://api.github.com/repos/{repo}/contents/{path} (may change in the future to allow Wikimedia GitLab as an alternative option). So any requests received by the webserver only acts as a notification for the bot to check the content from actual authoritative sources. The webhook content affects nothing except for the edit summary that the bot uses (which is pointless in attacking - an attacker needs to race with GitHub itself for scripts that are setup to use GitHub webhooks properly to get their malicious version to our server - we can also just stop using the webhook content entirely but I thought it was better in the current scheme) You also can't change the header from Git - the bot will error if the header (parameters containing repo, path, and refspec for Git) on the Git side has different content than the header on Wikipedia - so you can only change the header from Wikipedia.
  • Hopefully this resolves concerns people may have, let me know if people have additional questions or concerns. dbeef [talk] 15:15, 12 July 2025 (UTC)reply
    Good callout on setting the Toolforge password file to 0600. That is easy to forget for someone used to non-Linux systems, or someone used to mainstream PaaS web hosting where your files are all kept private for you. –Novem Linguae (talk) 15:23, 12 July 2025 (UTC)reply
    Okay, it turns out we can actually bulletproof this bad boy. GitHub's "ooOh let's validate your webhooks" suggestion is absolutely bonkers. If it was a simple secret parameter that gets attached to every request, at least we can store the hash of that secret to allow us to actually have it configurable per person on-wiki without any middleperson/database/web interface shenanigans. But GitHub choose to hash the entire request for whatever reason - something that GitLab has not decided to do (FOSS projects keep winning).
    But it turns out we can use a way simpler method - only allow GitHub's IPs. I'll debug this a bit to see if there are any interactions with Toolforge proxying requests to us and write up a CIDR check tomorrow. dbeef [talk] 15:39, 12 July 2025 (UTC)reply
    Toolforge uses an anonymizing reverse proxy that scrubs out IPs from the request. – SD0001 (talk) 19:11, 12 July 2025 (UTC)reply
    I was wondering whether there are any X-Forwarded-For, but this is a little discouraging. I don't see it as very important for the BRFA to pass though. So I'll try to investigate later. dbeef [talk] 10:31, 14 July 2025 (UTC)reply
    Anonymizing proxies by design don't pass XFF headers. I agree though that webhooks don't really need to be validated. (GitHub hashing the entire request seems more secure as it makes it harder for the secret key to get leaked in logs. And Gitlab is certainly no paragon of FOSS; its development is non-inclusive and code is intentionally structured to reduce customizability, to promote their paid services.) – SD0001 (talk) 13:20, 14 July 2025 (UTC)reply
    GitHub hashing the entire request seems more secure as it makes it harder for the secret key to get leaked in logs - yeah there are reasons for doing that but it can't work for us because then we'd need to store it somewhere instead of having it rely on all public information (just put a hash as parameter to WP:USync and be done)
    development is non-inclusive and code is intentionally structured to reduce customizability, to promote their paid services should have figured. forgejo appears to be better. dbeef [talk] 13:27, 14 July 2025 (UTC)reply
  • BERJAYA A user has requested the attention of a member of the Bot Approvals Group. Once assistance has been rendered, please deactivate this tag by replacing it with {{t|BAG assistance needed}}. Looks like discussion has mostly concluded. Please move forward with whatever actions you deem necessary here. cc @Primefac dbeef [talk] 18:04, 21 July 2025 (UTC)reply
    Would just like to reiterate my support for this. I presented some security scenarios above as part of my due diligence / thorough review, but I do not see those as blockers. I think this bot would be a net positive. –Novem Linguae (talk) 03:10, 22 July 2025 (UTC)reply
    I'm pretty happy with the general concept of this BRFA (updating userscripts via GitHub). But I'm not sure why the preferred approach isn't either OAuth (to make the edits on the user's account), or creating a standardised GitHub Action (like GeneralNotability's) to have users set this up easily themselves?
    Both of those options prevent having an intadmin bot account. The latter option seems ideal as it's also decentralised and doesn't rely on a central service, but would be limited to GitHub and other platforms with action runners. My main concern here is future security risks. While I'm happy to assume there's no security issues currently, BAG don't really review bots after their approval and bot development typically doesn't have code review standards, so bugs could be introduced later.
    This isn't an 'oppose' per se and I don't want to scupper the effort to get some solution to the script problem out (as I agree the developer experience is currently incoherent), but I figure I may as well raise the above questions now as it's unlikely we'll revisit them after an approval. ProcrastinatingReader (talk) 15:33, 22 July 2025 (UTC)reply
    @ProcrastinatingReader: I'm not sure why you think this won't be revisited. Finding ways to sync Git with Wikipedia script pages is a recurring problem for developers on this website.
    On one hand, I am sympathetic to your concern about future security issues, but I also have self-serving biases that tell me I don't think there will be future security issues. On the other hand, I'm trying hard to get us a solution that we can use for now.
    The problem was that I had just enough energy to develop this solution. An OAuth solution would involve running a server with a front end, allowing users to manage their syncs (which would need a database), talking with Wikimedia OAuth, figuring out the stuff with refresh tokens, applying for the OAuth application, etc. A GitHub Action solution is harder to setup for script authors, it also has some drawbacks that an IntAdmin bot doesn't have which I mention in the VPT thread (Auditability, Ease of use, Efficiency).
    If we have consensus to support the IntAdmin bot solution, then it's a good solution to the problem. If anyone wants to develop a better solution, then we can all switch to that. I don't want us to make perfect be the enemy of good. dbeef [talk] 14:19, 23 July 2025 (UTC)reply
    The bot approval wouldn't necessarily mean this is the preferred approach. We just started using OAuth to deploy Twinkle and AfC-helper, with more gadgets along the way, and a GitHub Action already exists for user script deployments. But many folks don't want to learn to use Github actions, or entrust their login credentials with GitHub. (Also, note that GeneralNotability's GitHub action looks too simple – it only works because they are an admin. Others won't be able to use the same approach as Github IPs are hardblocked. Deploy-action works around this by proxying the edits via Toolforge.) – SD0001 (talk) 16:31, 23 July 2025 (UTC)reply
    I wonder if the issue is that action isn't well advertised? A quick search shows no backlinks, but my wiki-search skills perhaps have gotten rusty. I'd definitely be in favour of advertising that action more widely, as IMO that's the idiomatic way to deploy scripts.
    or entrust their login credentials with GitHub I presume isn't a common concern, GitHub Actions manages a lot more sensitive secrets than a GitHub BotPassword. Alternatively one could use Wikimedia Gitlab, presumably . ProcrastinatingReader (talk) 09:53, 24 July 2025 (UTC)reply
    One weakness of a GitHub secrets based approach (where you give GitHub your own account's credentials, let it log in, and edit as you) is that anyone else with member/collaborator access to your repo could 1) write a script to dump your secrets, or 2) change the GitHub Actions workflow to make edits using your account. I guess this could be mitigated by using a BotPassword that can only edit certain pages. But the edits would still be in your name.
    An interface administrator bot solves these issues. The GitHub repo members/collaborators have no way to get the IA bot's credentials, and the IA bot makes it very clear who is making the edit in its edit summary. Even though an IA bot has more access, it does permissions checks to narrow this access, and it hides its secrets better. I find the IA bot approach more secure here.
    P.S. To elaborate on the GeneralNotability example above, this edit says it was made by GeneralNotability, but was actually made by TheresNoTime. This edit made some folks at GN's talk page think he came out of retirement when GN did not. –Novem Linguae (talk) 10:19, 24 July 2025 (UTC)reply
    Can use CODEOWNERS to prevent edits to certain files, so you can limit the creation and modification of Actions to the repository owner, hence also preventing secret leaks. These best practices could be encapsulated in a wiki-page on how to setup actions for your scripts. But the edits would still be in your name. Attribution-y issues exist with the IA approach as well IMO. On a repository without compulsory GPG commit signing, any user with push access can write commits and 'impersonate' another user as the author and committer, which then gets reflected in the edit summary.
    To be clear, I don't view as any of these issues as problematic enough to make either approach unsuitable for usage, as they're obviously surmountable with correct configuration of the GitHub repository. ProcrastinatingReader (talk) 10:35, 24 July 2025 (UTC)reply
    Attribution-y issues exist with the IA approach as well IMO. On a repository without compulsory GPG commit signing, any user with push access can write commits and 'impersonate' another user as the author and committer, which then gets reflected in the edit summary. I think these are two different problems. GitHub actions makes impersonation the default and proper attribution the harder thing to do. The sync approach we have taken here makes proper attribution the default (as most people correctly configure their commit names), and impersonation the harder thing to do. dbeef [talk] 15:13, 24 July 2025 (UTC)reply

BERJAYA Approved. We have a working product, and right now I think the conversation above, while good, is forcing perfect to be the enemy of done. If there are issues with the implementation or we find that the plan as it has been tested has issues, we can (and should) revisit the task and its specifics. Primefac (talk) 17:17, 27 July 2025 (UTC)reply

The above discussion is preserved as an archive of the debate. Please do not modify it. To request review of this BRFA, please start a new section at Wikipedia:Bots/Noticeboard.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Bots/Requests_for_approval/DeadbeefBot_II&oldid=1302827093"