Webpagemakerapi - Revision history

Varmaa: /* Risk considerations */ changed from rel=nofollow to x-robots-tag

2012-05-17T19:25:39Z

Risk considerations: changed from rel=nofollow to x-robots-tag

← Older revision		Revision as of 19:25, 17 May 2012
Line 59:		Line 59:
	\| Documents hosted via the API could be used as link farms		\| Documents hosted via the API could be used as link farms
	\|		\|
	* ~~nofollow attributes~~ will be ~~inserted in all "~~a~~" tags via Bleach~~		* Documents will be delivered with a <code>X-Robots-Tag: noindex, nofollow</code> header.
	\|-		\|-
	\| Javascript could be used in a multitude of ways to compromise client machines		\| Javascript could be used in a multitude of ways to compromise client machines

2012-05-10T21:18:26Z

API Methods: point to api readme.

@@ Line 39: / Line 39: @@
 == API Methods ==
-These are all anonymous calls -- no auth is needed.
+These are documented in the [https://github.com/mozilla/webpagemaker/tree/development/webpagemaker/api#readme API README].
 == Stored Data ==

2012-04-23T21:23:28Z

API Methods

← Older revision		Revision as of 21:23, 23 April 2012
Line 54:		Line 54:
	<td>POST</td>		<td>POST</td>
	<td>Raw Post Data (HTML)</td>		<td>Raw Post Data (HTML)</td>
	<td>Relative Short URL id (eg. "/ja5bn")</td>		<td>Relative Short URL KEY id (eg. "ja5bn") which can be appended to the app index (eg. "http://webpagemakerapi.vcap.mozillalabs.com/ja5bn")</td>
	</tr>		</tr>
	<tr>		<tr>

2012-04-19T00:36:52Z

Document Overview

← Older revision		Revision as of 00:36, 19 April 2012
Line 6:		Line 6:
	\|'''Projected Freeze Date:''' \|\| <Placeholder>		\|'''Projected Freeze Date:''' \|\| <Placeholder>
	\|-		\|-
	\|'''Product Champions:''' \|\| [https://mozillians.org/simonwex Simon Wex], [[User:davida\|David Ascher]]		\|'''Product Champions:''' \|\| [https://mozillians.org/simonwex Simon Wex], [[User:davida\|David Ascher]], Michelle Levesque
	\|-		\|-
	\|'''Privacy Champions:''' \|\|		\|'''Privacy Champions:''' \|\|

2012-04-18T23:01:15Z

API Methods

← Older revision		Revision as of 23:01, 18 April 2012
Line 38:		Line 38:

	== API Methods ==		== API Methods ==

			These are all anonymous calls -- no auth is needed.

	<table>		<table>

2012-04-18T23:00:46Z

Risk considerations

← Older revision		Revision as of 23:00, 18 April 2012
Line 67:		Line 67:
	End-user created HTML documents are stored in MySQL.		End-user created HTML documents are stored in MySQL.

	=== Risk considerations ===		== Risk considerations ==

	{\| class="wikitable"		{\| class="wikitable"

2012-04-18T23:00:29Z

Stored Data

← Older revision		Revision as of 23:00, 18 April 2012
Line 66:		Line 66:

	End-user created HTML documents are stored in MySQL.		End-user created HTML documents are stored in MySQL.

			=== Risk considerations ===

	{\| class="wikitable"		{\| class="wikitable"

2012-04-18T21:51:15Z

← Older revision		Revision as of 21:51, 18 April 2012
Line 6:		Line 6:
	\|'''Projected Freeze Date:''' \|\| <Placeholder>		\|'''Projected Freeze Date:''' \|\| <Placeholder>
	\|-		\|-
	\|'''Product Champions:''' \|\| [~~[User;~~simonwex\|Simon Wex]], [[User:davida\|David Ascher]]		\|'''Product Champions:''' \|\| [https://mozillians.org/simonwex Simon Wex], [[User:davida\|David Ascher]]
	\|-		\|-
	\|'''Privacy Champions:''' \|\|		\|'''Privacy Champions:''' \|\|
Line 64:		Line 64:

	== Stored Data ==		== Stored Data ==

			End-user created HTML documents are stored in MySQL.

	{\| class="wikitable"		{\| class="wikitable"
	\|-		\|-
	! ~~What~~		! Risk
	! ~~Where~~		! Mitigation Strategy
			\|-
			\| Copyrighted work can be stored and distributed through the API
			\|
			* Documents will require DOCTYPE definitions and syntactically correct HTML
			* Documents will be limited to 10,000 characters
			\|-
			\| Documents hosted via the API could be used as link farms
			\|
			* nofollow attributes will be inserted in all "a" tags via Bleach
			\|-
			\| Javascript could be used in a multitude of ways to compromise client machines
			\|
			* All Javascript will be stripped using Bleach before it is served
	\|-		\|-
	\| ~~End-User Created HTML Documents~~		\| Database insertion could be used as a DOS attack vector
	\| ~~In MySQL~~		\|
			* Rate limiting will be implemented along with above size limitations
	\|}		\|}

2012-04-18T18:59:15Z

← Older revision		Revision as of 18:59, 18 April 2012
Line 35:		Line 35:
	= WebPageMakerAPI Overview =		= WebPageMakerAPI Overview =

	The API is a two-endpoint HTTP API that accepts (via POST) HTML documents and serves those documents via a short url. The HTML documents are cleaned by [http://pypi.python.org/pypi/bleach Bleach] before being served.		The API is a two-endpoint HTTP API that accepts (via POST) HTML documents and serves those documents via a short url. The HTML documents are cleaned by [http://pypi.python.org/pypi/bleach Bleach] before being served. [https://github.com/mozilla/playdoh Playdoh] is the planned implementation framework.

	== API Methods ==		== API Methods ==

2012-04-18T18:56:52Z

← Older revision		Revision as of 18:56, 18 April 2012
Line 37:		Line 37:
	The API is a two-endpoint HTTP API that accepts (via POST) HTML documents and serves those documents via a short url. The HTML documents are cleaned by [http://pypi.python.org/pypi/bleach Bleach] before being served.		The API is a two-endpoint HTTP API that accepts (via POST) HTML documents and serves those documents via a short url. The HTML documents are cleaned by [http://pypi.python.org/pypi/bleach Bleach] before being served.

	= API Methods =		== API Methods ==

	<table>		<table>
Line 62:		Line 62:
	</tr>		</tr>
	</table>		</table>

			== Stored Data ==

			{\| class="wikitable"
			\|-
			! What
			! Where
			\|-
			\| End-User Created HTML Documents
			\| In MySQL
			\|}