mozilla / tracking-protection-issues

Flask server that powers and endpoint for reporting private tracking protection issues.

Tracking Protection Issues

Repo used to host the code for filing private tracking protection issues.

Local installation

We're using pipenv for this project. Be sure to install it first.

0. clone the repo
1. pipenv sync --dev
2. pipenv run flask run

Note: If you're trying to use this in production, it will expect a lot of environment variables. Check out config.py.

🚨 Please don't ever add any to the .env file and check it in. 🚨

How it works

This server exposes a /new endpoint that expects the following multipart/form-data payload via POST, represented here in some kind of pseudo-schema:

{
  "body": the issue body (required)
  "title": the issue title (required),
  "labels": 'one, two, three' (optional)
}

A GitHub issue will be created, assuming all the credentials are correct.

For privacy and security reasons, the GitHub repo and its issues are private and locked down to a small team of Mozilla employees within the @mozilla GitHub org. If you think you need access, ping [email protected].

tracking-protection-issues's Issues

Wiki changes

FYI: The following changes were made to this repository's wiki:

• defacing spam has been removed

• Restricting write access to contributors is strongly encouraged. Please make that change (documentation).

These were made as the result of a recent automated defacement of publically writeable wikis.

Make sure we don't record IP addresses.

Fix failing test

Oops. I merged too eagerly. :)

🐓 pipenv run nose2
Loading .env environment variables...
E....
======================================================================
ERROR: test_create_issue (tests.test_endpoints.TestEndpoints)
Test new issue endpoint.
----------------------------------------------------------------------
Traceback (most recent call last):
  File "<string>", line 3, in wrapper
  File "/Users/miket/dev/tracking-protection-issues/tests/test_endpoints.py", line 60, in test_create_issue
    '/new', data=dict(title='hi', body='dude')
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/werkzeug/test.py", line 1039, in post
    return self.open(*args, **kw)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/testing.py", line 200, in open
    follow_redirects=follow_redirects
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/werkzeug/test.py", line 993, in open
    response = self.run_wsgi_app(environ.copy(), buffered=buffered)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/werkzeug/test.py", line 884, in run_wsgi_app
    rv = run_wsgi_app(self.application, environ, buffered=buffered)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/werkzeug/test.py", line 1119, in run_wsgi_app
    app_rv = app(environ, start_response)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 2309, in __call__
    return self.wsgi_app(environ, start_response)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 2295, in wsgi_app
    response = self.handle_exception(e)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 1741, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 2292, in wsgi_app
    response = self.full_dispatch_request()
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 1815, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 1718, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 1813, in full_dispatch_request
    rv = self.dispatch_request()
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/flask/app.py", line 1799, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/Users/miket/dev/tracking-protection-issues/app/endpoints/issues.py", line 45, in new_issue
    rv = create_issue(body, title, labels)
  File "/Users/miket/dev/tracking-protection-issues/app/helpers.py", line 40, in create_issue
    rv = find_issue(title)
  File "/Users/miket/dev/tracking-protection-issues/app/helpers.py", line 25, in find_issue
    return requests.get(uri, headers=HEADERS)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/requests/api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/requests/api.py", line 60, in request
    return session.request(method=method, url=url, **kwargs)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/requests/sessions.py", line 524, in request
    resp = self.send(prep, **send_kwargs)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/requests/sessions.py", line 637, in send
    r = adapter.send(request, **kwargs)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/responses.py", line 600, in unbound_on_send
    return self._on_request(adapter, request, *a, **kwargs)
  File "/Users/miket/.local/share/virtualenvs/tracking-protection-issues-MGe0Zt1T/lib/python2.7/site-packages/responses.py", line 575, in _on_request
    raise response
ConnectionError: Connection refused: GET https://api.github.com/search/issues?q='hi'+type:issue+repo:test/test-repo+created:%3E=2019-10-19&sort=created&order=desc

Seems like an instance of getsentry/responses#148, perhaps, since before we didn't have any query strings. Or we need to tell responses to mock out the request to this API endpoint, rather than actually hit google.

Investigate 422

Reported at https://bugzilla.mozilla.org/show_bug.cgi?id=1514246

13:45:28.329 XHRPOSThttps://tracking-protection-issues.herokuapp.com/new[HTTP/1.1 422 UNPROCESSABLE ENTITY 2882ms] 
HeadersCookiesParamsResponseTimingsStack TraceSecurityRequest URL:https://tracking-protection-issues.herokuapp.com/newRequest method:POSTRemote address:54.236.166.251:443Status code:422Edit and ResendRaw headersVersion:HTTP/1.1Response headers (199 B)Connectionkeep-aliveContent-Length40Content-Typetext/html; charset=utf-8DateFri, 14 Dec 2018 15:45:29 GMTServergunicorn/19.9.0Via1.1 vegurRequest headers (404 B)Accept*/*Accept-Encodinggzip, deflate, brAccept-Languageen-US,en;q=0.5Connectionkeep-aliveContent-Length1039content-typemultipart/form-data; boundary=…39755485020227936031255584007DNT1Hosttracking-protection-issues.herokuapp.comOriginnullUser-AgentMozilla/5.0 (X11; Linux x86_64…) Gecko/20100101 Firefox/66.0

Links in README for pipenv are no longer valid.

Links in readme pipenv are no longer valid.
https://docs.pipenv.org/
and
https://docs.pipenv.org/#install-pipenv-today

Update requests

CODE_OF_CONDUCT.md file missing

As of January 1 2019, Mozilla requires that all GitHub projects include this CODE_OF_CONDUCT.md file in the project root. The file has two parts:

1. Required Text - All text under the headings Community Participation Guidelines and How to Report, are required, and should not be altered.
2. Optional Text - The Project Specific Etiquette heading provides a space to speak more specifically about ways people can work effectively and inclusively together. Some examples of those can be found on the Firefox Debugger project, and Common Voice. (The optional part is commented out in the raw template file, and will not be visible until you modify and uncomment that part.)

If you have any questions about this file, or Code of Conduct policies and procedures, please see Mozilla-GitHub-Standards or email [email protected].

(Message COC001)

Escape input

http://flask.pocoo.org/docs/1.0/api/#flask.escape