2023-01-12 Meeting notes

Date

12 Jan 2023

Attendees

Name	Present
Craig McNally	Y
Julian Ladisch	Y
Axel Dörrer	N
Ryan Berger	Y
Chris Rutledge
Jakub Skoczen
John Coburn	Y
Skott Klebe

Discussion items

Time	Item	Who	Notes
0 min	Kafka security	Team	The topic of Kafka security was raised as part of a conversation at the TC yesterday. The Security Team should be aware of this and probably should weigh in on the topic, or even generate proposals if we have ideas for how to solve the problem. See https://wiki.folio.org/download/attachments/96404444/Another%20Look%20At%20Kafka%20Topics%20Per%20Tenant.pdf?api=v2 for additional context. It may make sense to wait until Olamide's RFC for the tenant-specific topics is created/discussed/etc. Today: On hold until the RFC is available for review.
1 min	OWASP/SNYK	Team	Epic: FOLIO-3582 OWASP checks, reviews, and fitness functions Feature: FOLIO-3583 OWASP Zed Attack Proxy (ZAP) User Story: FOLIO-3584 SPIKE - investigate OWASP Zed Attack Proxy (ZAP) Progress on FOLIO-3584? Skott ran a scan against MG Bugfest Skott Klebe and Craig McNally to review results... weed out false positives, then bring results to next week's meeting. Scan stopped at 95% (OOM issue in Firefox) Any other features/stories we want to create? Not related to OWASP, but I think Skott Klebe suggested that our SNYK could be tuned/adjusted to better suit our needs. Maybe make the Epic more generic – "Security Fitness Functions" or Create another epic to track the non-OWASP stuff? SNYK Should define JIRAs Spike to investigate how we can tune snyk to better suit our needs – Craig McNally to create this. Provided some background/history about SNYK in the FOLIO community Stripes architecture reviews dependencies every other flower release (1-2x/year) Currently only looking at platform level (with package.json/lock files) Avoids a lot of the dev/peer dependency false alarms Skott Klebe will have limited time to spend on SG activities but will have some time to spend on the TBD Snyk spike in mid-December. It sounds like he's seeking help from someone more familiar with snyk ... either to have a conversation or provide documentation links. All this means is the spike JIRA should contain documentation links Also need to clarify which repos are integrated with Snyk, and what the process looks like for managing this. TODO: look at the FOLIO documentation on Snyk. Today: Spike still hasn't been created yet.
1 min	Cumulative upload problem	Team	Regarding file upload size issues (See FOLIO-3317 - Spike - investigate possible file upload vulnerability OPEN ), let's brainstorm ideas for mitigating the cumulative upload problem, not just the large file upload size problem. Some APIs are more vulnerable to this than others, such as those not protected by permissions - e.g. mod-login, edge APIs, etc. Axel provided some background/context. We still need to give this some thought and possibly suggest a solution Use case 1: Some script unintentionally sends endless data to some API. This is caught by a maximum upload size. Use case 2: Denial of service. Difficult to address in Okapi. Might be better handled in other tools like nginx or firewalls that can limit requests. Unlikely that a denial of service attack has a valid login / access token. TODO: For use case 2: Only add documentation that implementers should use an external firewall (or external nginx) to limit requests. Some investigation is required, let's capture this in a spike (JIRA). Axel Dörrer to help define this. – Started, not finished yet. We can review together and find someone to work on this... maybe have a champion on this team work with someone in the Sys-ops SIG/community. Created FOLIO-3615 - Getting issue details... STATUS Chris Rutledge and Axel Dörrer to look at it and ask sysops folks to chime in Let's create a wiki page to capture ideas/feedback - Axel Dörrer → done Page created Possible protection mechanisms on web server or network traffic level Will engage the Sys-Ops SIG to see if they have any ideas/feedback. Reached out to Ingolf Kuss: Axel Dörrer to present the topic in next weeks sysops meeting Raised at the SysOps meeting A small working group was formed, but has not yet met. Network Traffic Control Working Group Group is meeting on Fridays... See link above for meeting notes, etc. Will be creating a test env. to aid in the investigation A similar issue was discovered in folio-vertx-lib... linked the issue to FOLIO_3317 Wrapping up definition of test cases. essentially on pause until next year. Today: No progress yet. Will meet tomorrow
1 min