Examine individual changes

This page allows you to examine the variables generated by the Abuse Filter for an individual change, and test it against filters.

Variables generated for this change

Variable	Value
Edit count of the user `(user_editcount)`	16876
Name of the user account `(user_name)`	'Maffblaster'
Age of the user account `(user_age)`	255223870
Page ID `(page_id)`	20131
Page namespace `(page_namespace)`	0
Page title (without namespace) `(page_title)`	'Auditing (project archive)'
Full page title `(page_prefixedtitle)`	'Auditing (project archive)'
Action `(action)`	'edit'
Edit summary/reason `(summary)`	'Remove Project template and other enhancements.'
Old content model `(old_content_model)`	'wikitext'
New content model `(new_content_model)`	'wikitext'
Old page wikitext, before the edit `(old_wikitext)`	'{{Project \|Name=Security Audit Project \|Description=The Security Audit Project is focused upon auditing packages for security issues. The aim of the project is to audit as many of the packages available through Gentoo Linux stable Portage tree as possible for potential flaws. \|Email=security-audit@gentoo.org \|IRC=#gentoo-security \|ParentProject=Project:Security \|PropagatesMembers=No \|LeadElectionDate=2019/04/25 \|Members={{Project Member \|Developer=User:Zx2c4 \|Role=Lead \|IsLead=Yes }} }} == Auditing methodology == === Scope === Due to the sheer size of the portage tree, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package. === Tools === There are several packages available within the portage tree which are designed to aid source code audits. Some of the these include: * {{Package\|dev-util/flawfinder}} * {{Package\|dev-util/rats}} * {{Package\|dev-util/pscan}} * {{Package\|app-forensics/examiner}} * {{Package\|dev-util/splint}} Each of the general scanning tools will include output describing the flaw detected, and possibly giving advice on how the code can be fixed. For example the following is taken from the output of RATS describing the dangers of getenv: ''"Environment variables are highly untrustable input. They may be of any length, and contain any data. Do not make any assumptions regarding content or length. If at all possible avoid using them, and if it is necessary, sanitize them and truncate them to a reasonable length."'' If you need any further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the [http://www.dwheeler.com/secure-programs/ Secure Programming for Linux and Unix HOWTO] by David A. Wheeler or the [https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard C Secure Coding Standard] by CERT (Remember that when reporting security issues a patch closing the hole is greatly appreciated). === Submitting found flaws === When you find a vulnerability, you should write a vulnerability description and submit it for peer-review as a new security bug (with "Gentoo Security" as product and "Auditing" as component, restricted to Gentoo Security). Other auditors (and security team members) will double-check what you found, ensure that it is indeed a bug with a security impact. When it has been thoroughly peer-reviewed, it will be cleared to go upstream as a "Gentoo Security Audit Subproject" sighting. Depending on its severity and how the package is common amongst distributions, it might need to be coordinated with vendor-sec for coordinated release and CVE number attribution. {{Important\|Please do not submit non-peer-reviewed vulnerabilities to any disclosure channel (including upstream) under the Gentoo name or a gentoo.org email address. Nothing hurts more our credibility than issuing Gentoo-branded bogus vulnerability reports.}}'
New page wikitext, after the edit `(new_wikitext)`	'The Gentoo security audit project [[Article description::was focused upon auditing packages for security issues.]] The aim of the project was to audit many of available the stable packages in the Gentoo ebuild repository for potential flaws. == Auditing methodology == === Scope === Due to the sheer size of ::gentoo, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package. === Tools === There are several packages available which are designed to aid source code audits. Some of the these include: * {{Package\|dev-util/flawfinder}} * {{Package\|dev-util/rats}} * {{Package\|dev-util/pscan}} * {{Package\|app-forensics/examiner}} * {{Package\|dev-util/splint}} Each of the general scanning tools will include output describing the flaw detected, and possibly giving advice on how the code can be fixed. For example the following is taken from the output of RATS describing the dangers of getenv: ''"Environment variables are highly untrustable input. They may be of any length, and contain any data. Do not make any assumptions regarding content or length. If at all possible avoid using them, and if it is necessary, sanitize them and truncate them to a reasonable length."'' For further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the [http://www.dwheeler.com/secure-programs/ Secure Programming for Linux and Unix HOWTO] by David A. Wheeler or the [https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard C Secure Coding Standard] by CERT. Remember: when reporting security issues a patch closing the hole is greatly appreciated. === Submitting found flaws === When you find a vulnerability, you should write a vulnerability description and submit it for peer-review as a new security bug (with "Gentoo Security" as product and "Auditing" as component, restricted to Gentoo Security). Other auditors (and security team members) will double-check what you found, ensure that it is indeed a bug with a security impact. When it has been thoroughly peer-reviewed, it will be cleared to go upstream as a "Gentoo Security Audit Subproject" sighting. Depending on its severity and how the package is common amongst distributions, it might need to be coordinated with vendor-sec for coordinated release and CVE number attribution. {{Important\|Please do not submit non-peer-reviewed vulnerabilities to any disclosure channel (including upstream) under the Gentoo name or a gentoo.org email address. Nothing hurts more our credibility than issuing Gentoo-branded bogus vulnerability reports.}}'
Unified diff of changes made by edit `(edit_diff)`	'@@ -1,25 +1,13 @@ -{{Project -\|Name=Security Audit Project -\|Description=The Security Audit Project is focused upon auditing packages for security issues. The aim of the project is to audit as many of the packages available through Gentoo Linux stable Portage tree as possible for potential flaws. -\|Email=security-audit@gentoo.org -\|IRC=#gentoo-security -\|ParentProject=Project:Security -\|PropagatesMembers=No -\|LeadElectionDate=2019/04/25 -\|Members={{Project Member -\|Developer=User:Zx2c4 -\|Role=Lead -\|IsLead=Yes -}} -}} +The Gentoo security audit project [[Article description::was focused upon auditing packages for security issues.]] The aim of the project was to audit many of available the stable packages in the Gentoo ebuild repository for potential flaws. + == Auditing methodology == === Scope === -Due to the sheer size of the portage tree, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package. +Due to the sheer size of ::gentoo, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package. === Tools === -There are several packages available within the portage tree which are designed to aid source code audits. Some of the these include: +There are several packages available which are designed to aid source code audits. Some of the these include: * {{Package\|dev-util/flawfinder}} @@ -31,5 +19,5 @@ Each of the general scanning tools will include output describing the flaw detected, and possibly giving advice on how the code can be fixed. For example the following is taken from the output of RATS describing the dangers of getenv: ''"Environment variables are highly untrustable input. They may be of any length, and contain any data. Do not make any assumptions regarding content or length. If at all possible avoid using them, and if it is necessary, sanitize them and truncate them to a reasonable length."'' -If you need any further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the [http://www.dwheeler.com/secure-programs/ Secure Programming for Linux and Unix HOWTO] by David A. Wheeler or the [https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard C Secure Coding Standard] by CERT (Remember that when reporting security issues a patch closing the hole is greatly appreciated). +For further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the [http://www.dwheeler.com/secure-programs/ Secure Programming for Linux and Unix HOWTO] by David A. Wheeler or the [https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard C Secure Coding Standard] by CERT. Remember: when reporting security issues a patch closing the hole is greatly appreciated. === Submitting found flaws === '
Old page size `(old_size)`	3030
Lines added in edit `(added_lines)`	[ 0 => 'The Gentoo security audit project [[Article description::was focused upon auditing packages for security issues.]] The aim of the project was to audit many of available the stable packages in the Gentoo ebuild repository for potential flaws.', 1 => '', 2 => 'Due to the sheer size of ::gentoo, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package.', 3 => 'There are several packages available which are designed to aid source code audits. Some of the these include: ', 4 => 'For further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the [http://www.dwheeler.com/secure-programs/ Secure Programming for Linux and Unix HOWTO] by David A. Wheeler or the [https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard C Secure Coding Standard] by CERT. Remember: when reporting security issues a patch closing the hole is greatly appreciated.' ]
Lines removed in edit `(removed_lines)`	[ 0 => '{{Project', 1 => '\|Name=Security Audit Project', 2 => '\|Description=The Security Audit Project is focused upon auditing packages for security issues. The aim of the project is to audit as many of the packages available through Gentoo Linux stable Portage tree as possible for potential flaws.', 3 => '\|Email=security-audit@gentoo.org', 4 => '\|IRC=#gentoo-security', 5 => '\|ParentProject=Project:Security', 6 => '\|PropagatesMembers=No', 7 => '\|LeadElectionDate=2019/04/25', 8 => '\|Members={{Project Member', 9 => '\|Developer=User:Zx2c4', 10 => '\|Role=Lead', 11 => '\|IsLead=Yes', 12 => '}}', 13 => '}}', 14 => 'Due to the sheer size of the portage tree, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package. ', 15 => 'There are several packages available within the portage tree which are designed to aid source code audits. Some of the these include: ', 16 => 'If you need any further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the [http://www.dwheeler.com/secure-programs/ Secure Programming for Linux and Unix HOWTO] by David A. Wheeler or the [https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard C Secure Coding Standard] by CERT (Remember that when reporting security issues a patch closing the hole is greatly appreciated).' ]
New page text, stripped of any markup `(new_text)`	'The Gentoo security audit project was focused upon auditing packages for security issues. The aim of the project was to audit many of available the stable packages in the Gentoo ebuild repository for potential flaws. Contents 1 Auditing methodology 1.1 Scope 1.2 Tools 1.3 Submitting found flaws Auditing methodology[edit \| edit source] Scope[edit \| edit source] Due to the sheer size of ::gentoo, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package. Tools[edit \| edit source] There are several packages available which are designed to aid source code audits. Some of the these include: dev-util/flawfinder dev-util/rats dev-util/pscan app-forensics/examiner dev-util/splint Each of the general scanning tools will include output describing the flaw detected, and possibly giving advice on how the code can be fixed. For example the following is taken from the output of RATS describing the dangers of getenv: "Environment variables are highly untrustable input. They may be of any length, and contain any data. Do not make any assumptions regarding content or length. If at all possible avoid using them, and if it is necessary, sanitize them and truncate them to a reasonable length." For further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the Secure Programming for Linux and Unix HOWTO by David A. Wheeler or the C Secure Coding Standard by CERT. Remember: when reporting security issues a patch closing the hole is greatly appreciated. Submitting found flaws[edit \| edit source] When you find a vulnerability, you should write a vulnerability description and submit it for peer-review as a new security bug (with "Gentoo Security" as product and "Auditing" as component, restricted to Gentoo Security). Other auditors (and security team members) will double-check what you found, ensure that it is indeed a bug with a security impact. When it has been thoroughly peer-reviewed, it will be cleared to go upstream as a "Gentoo Security Audit Subproject" sighting. Depending on its severity and how the package is common amongst distributions, it might need to be coordinated with vendor-sec for coordinated release and CVE number attribution. ImportantPlease do not submit non-peer-reviewed vulnerabilities to any disclosure channel (including upstream) under the Gentoo name or a gentoo.org email address. Nothing hurts more our credibility than issuing Gentoo-branded bogus vulnerability reports.'
Parsed HTML source of the new revision `(new_html)`	'<div class="mw-parser-output"><p>The Gentoo security audit project was focused upon auditing packages for security issues. The aim of the project was to audit many of available the stable packages in the Gentoo ebuild repository for potential flaws. </p> <div id="toc" class="toc" role="navigation" aria-labelledby="mw-toc-heading"><input type="checkbox" role="button" id="toctogglecheckbox" class="toctogglecheckbox" style="display:none" /><div class="toctitle" lang="en" dir="ltr"><h2 id="mw-toc-heading">Contents</h2><span class="toctogglespan"><label class="toctogglelabel" for="toctogglecheckbox"></label></span></div> <ul> <li class="toclevel-1 tocsection-1"><a href="#Auditing_methodology"><span class="tocnumber">1</span> <span class="toctext">Auditing methodology</span></a> <ul> <li class="toclevel-2 tocsection-2"><a href="#Scope"><span class="tocnumber">1.1</span> <span class="toctext">Scope</span></a></li> <li class="toclevel-2 tocsection-3"><a href="#Tools"><span class="tocnumber">1.2</span> <span class="toctext">Tools</span></a></li> <li class="toclevel-2 tocsection-4"><a href="#Submitting_found_flaws"><span class="tocnumber">1.3</span> <span class="toctext">Submitting found flaws</span></a></li> </ul> </li> </ul> </div> <h2><span class="mw-headline" id="Auditing_methodology">Auditing methodology</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Auditing_(project_archive)&veaction=edit&section=1" class="mw-editsection-visualeditor" title="Edit section: Auditing methodology">edit</a><span class="mw-editsection-divider"> \| </span><a href="/index.php?title=Auditing_(project_archive)&action=edit&section=1" title="Edit section: Auditing methodology">edit source</a><span class="mw-editsection-bracket">]</span></span></h2> <h3><span class="mw-headline" id="Scope">Scope</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Auditing_(project_archive)&veaction=edit&section=2" class="mw-editsection-visualeditor" title="Edit section: Scope">edit</a><span class="mw-editsection-divider"> \| </span><a href="/index.php?title=Auditing_(project_archive)&action=edit&section=2" title="Edit section: Scope">edit source</a><span class="mw-editsection-bracket">]</span></span></h3> <p>Due to the sheer size of ::gentoo, it is infeasible for this project to be able to audit all the packages. The system of prioritizing is based on the time, risk factor, motivation and skills necessary to audit a given package. </p> <h3><span class="mw-headline" id="Tools">Tools</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Auditing_(project_archive)&veaction=edit&section=3" class="mw-editsection-visualeditor" title="Edit section: Tools">edit</a><span class="mw-editsection-divider"> \| </span><a href="/index.php?title=Auditing_(project_archive)&action=edit&section=3" title="Edit section: Tools">edit source</a><span class="mw-editsection-bracket">]</span></span></h3> <p>There are several packages available which are designed to aid source code audits. Some of the these include: </p> <ul><li><a rel="nofollow" class="external text" href="https://packages.gentoo.org/packages/dev-util/flawfinder">dev-util/flawfinder</a></li> <li><a rel="nofollow" class="external text" href="https://packages.gentoo.org/packages/dev-util/rats">dev-util/rats</a></li> <li><a rel="nofollow" class="external text" href="https://packages.gentoo.org/packages/dev-util/pscan">dev-util/pscan</a></li> <li><a rel="nofollow" class="external text" href="https://packages.gentoo.org/packages/app-forensics/examiner">app-forensics/examiner</a></li> <li><a rel="nofollow" class="external text" href="https://packages.gentoo.org/packages/dev-util/splint">dev-util/splint</a></li></ul> <p>Each of the general scanning tools will include output describing the flaw detected, and possibly giving advice on how the code can be fixed. For example the following is taken from the output of RATS describing the dangers of getenv: <i>"Environment variables are highly untrustable input. They may be of any length, and contain any data. Do not make any assumptions regarding content or length. If at all possible avoid using them, and if it is necessary, sanitize them and truncate them to a reasonable length."</i> </p><p>For further advice on how to correct a hole which has been reported you should study a book on programming securely, such as the <a rel="nofollow" class="external text" href="http://www.dwheeler.com/secure-programs/">Secure Programming for Linux and Unix HOWTO</a> by David A. Wheeler or the <a rel="nofollow" class="external text" href="https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard">C Secure Coding Standard</a> by CERT. Remember: when reporting security issues a patch closing the hole is greatly appreciated. </p> <h3><span class="mw-headline" id="Submitting_found_flaws">Submitting found flaws</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Auditing_(project_archive)&veaction=edit&section=4" class="mw-editsection-visualeditor" title="Edit section: Submitting found flaws">edit</a><span class="mw-editsection-divider"> \| </span><a href="/index.php?title=Auditing_(project_archive)&action=edit&section=4" title="Edit section: Submitting found flaws">edit source</a><span class="mw-editsection-bracket">]</span></span></h3> <p>When you find a vulnerability, you should write a vulnerability description and submit it for peer-review as a new security bug (with "Gentoo Security" as product and "Auditing" as component, restricted to Gentoo Security). Other auditors (and security team members) will double-check what you found, ensure that it is indeed a bug with a security impact. </p><p>When it has been thoroughly peer-reviewed, it will be cleared to go upstream as a "Gentoo Security Audit Subproject" sighting. Depending on its severity and how the package is common amongst distributions, it might need to be coordinated with vendor-sec for coordinated release and CVE number attribution. </p> <div class="alert alert-warning gw-box" style="padding-top: 8px; padding-bottom: 8px;"><strong><i class="fa fa-exclamation-circle"></i> Important</strong><br />Please do not submit non-peer-reviewed vulnerabilities to any disclosure channel (including upstream) under the Gentoo name or a gentoo.org email address. Nothing hurts more our credibility than issuing Gentoo-branded bogus vulnerability reports.</div> '
Unix timestamp of change `(timestamp)`	1650322835