Security/Web Bug Rotation

From MozillaWiki
Jump to: navigation, search

Web Bug Verification

Web security bugs are reported to mailbox or in a Bugzilla component, a member of Mozilla Security verifies the reported vulnerability before passing the bug on to developers. This verification work is shared by several members of the security team. The following pages meant to document the procedures for verification and to serve as a reminder for those "on call for the week"as to the procedures that need to be completed. In general bugs will have an attempt to verify them in approximately 1 working day.


Day On-call IRC handle
Monday Adam Muntner adamm
Tuesday Julien Vehent ulfr
Wednesday Julien Vehent ulfr
Thursday Jonathan Claudius claudijd
Friday April King April

Verification process

The procedure below is performed by the on-call individual.

  1. If the issue was reported to the security@ alias, create a bug for it
  2. Determine if the issue reported is NEW, INVALID, or DUPLICATE
  3. For NEW bugs
    1. Find an owner (typically a dev or the product manager) to assign the bug to, and needinfo her/him. Change status to ASSIGNED.
    2. Set the right keywords
      1. sec-{critical,high,moderate,low,other}, see severity ratings
      2. wsec-{authentication,cookie,xss,sqli,...}, see vulnerability types
    3. If the reporter is eligible for bounties (non-staff, non-sg), Set "sec-bounty" flag to "?"
    4. Block the appropriate meta-bug
    5. Edit "Assigned To" and check the box for "Reset Assignee to default"
  4. If the verification shows that the issue is invalid, close the bug as INVALID
  5. For DUPLICATE bugs, set dupe against old bug. Set keywords & whiteboard for the new duped bug

Follow up on a NEW bug until you get the assurance that it will be fixed, the urgency of which depends on the vulnerability and the target.


Under bug 835475 (web-bounty), you will find a list metabugs for different Mozilla web properties. The list is ad-hoc and likely needs to be expanded. There is currently a catch all bug 836522 (other-bounty) to cover bugs that do not fit into any of the other trackers.

For NEW bugs


For NEW bugs that have been verified, simply set the "sec-bounty" flag to "?"


If the bug is a duplicate of an existing bug

  1. Set "sec-bounty" flag to "-" on new bug since it was a dupe.
  2. Set the new bug blocking the appropriate metabug(s)
    • For older bugs duped against that do not have the current flags
    1. If the old bug has the attachment 'bounty non-qual' or similar then set sec-bounty- on the old bug
    2. If the old bug has the attachment 'bounty awarded X' or 'bounty paid X', then set sec-bounty+ on the old bug
    3. If no duplicate is found and the issue is not verified the bug shall be RESOLVED - INVALID and the whiteboard tag removed.