diff --git a/auto_nag/scripts/configs/tools.json b/auto_nag/scripts/configs/tools.json index ba7c5bc8..ba389b14 100644 --- a/auto_nag/scripts/configs/tools.json +++ b/auto_nag/scripts/configs/tools.json @@ -617,5 +617,14 @@ "mcastelluccio@mozilla.com", "cdenizet@mozilla.com" ] + }, + "survey_sec_bugs": { + "to_reach_out": + [ + "continuation@gmail.com", + "jdemooij@mozilla.com", + "nical.bugzilla@gmail.com", + "emilio@crisal.io" + ] } } diff --git a/auto_nag/scripts/survey_sec_bugs.py b/auto_nag/scripts/survey_sec_bugs.py new file mode 100644 index 00000000..8bc7c67c --- /dev/null +++ b/auto_nag/scripts/survey_sec_bugs.py @@ -0,0 +1,82 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this file, +# You can obtain one at http://mozilla.org/MPL/2.0/. + +from auto_nag.bzcleaner import BzCleaner + + +class SurveySecurityBugs(BzCleaner): + def __init__(self): + super(SurveySecurityBugs, self).__init__() + self.changes_per_bug = {} + + def description(self): + return "Submit survey to assignee of a security bug" + + def get_bz_params(self, date): + params = { + # maybe we need more fields to do our changes (?) + "include_fields": ["assigned_to", "whiteboard"], + # find fixed bugs + "bug_status": "RESOLVED,VERIFIED", + "resolution": "FIXED", + # find bugs only in these products + "f5": "product", + "o5": "anywordssubstr", + "v5": "Core,DevTools,Firefox,GeckoView,NSPR,NSS,Toolkit,WebExtensions", + # bugs changed to RESOLVED in last month + "chfield": "bug_status", + "chfieldfrom": "-1m", + "chfieldto": "NOW", + "chfieldvalue": "RESOLVED", + # keywords has either sec-critical or sec-high + "f1": "keywords", + "o1": "anywords", + "v1": "sec-critical,sec-high", + # whiteboard does not have [sec-survey] (to avoid us asking twice) + "f2": "status_whiteboard", + "o2": "notsubstring", + "v2": "[sec-survey]", + # has at least one attachment (i.e., hopefully a patch) + "f3": "attachments.count", + "o3": "greaterthan", + "v3": "0", + # assigned to any of those we have agreed to help out + "f4": "assigned_to", + "o4": "anywords", + "v4": ",".join(self.get_config("to_reach_out", default=[])), + } + + return params + + def handle_bug(self, bug, data): + assignee = bug["assigned_to"] + bugid = str(bug["id"]) + + new_whiteboard = bug["whiteboard"] + "[sec-survey]" + self.changes_per_bug[bugid] = { + "comment": {"body": self.comment_tpl_for_bugid(bugid)}, + "whiteboard": new_whiteboard, + "flags": [ + { + "name": "needinfo", + "requestee": assignee, + "status": "?", + "new": "true", + } + ], + } + + return bug + + def get_autofix_change(self): + return self.changes_per_bug + + def comment_tpl_for_bugid(self, bugid): + URL = f"https://docs.google.com/forms/d/e/1FAIpQLSe9uRXuoMK6tRglbNL5fpXbun_oEb6_xC2zpuE_CKA_GUjrvA/viewform?usp=pp_url&entry.2124261401=https%3A%2F%2Fbugzilla.mozilla.org%2Fshow_bug.cgi%3Fid%3D{bugid}" + + return f"As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.\n\nPlease visit [this google form]({URL}) to reply." + + +if __name__ == "__main__": + SurveySecurityBugs().run() diff --git a/run_survey_sec_bugs.sh b/run_survey_sec_bugs.sh new file mode 100755 index 00000000..9fcb5f62 --- /dev/null +++ b/run_survey_sec_bugs.sh @@ -0,0 +1,23 @@ +#!/bin/bash +set -e + +export PYTHONPATH=. + +./runauto_nag_common.sh + +. venv/bin/activate + +# force the update of dependencies +pip install -r requirements.txt + +# Clean the log files +python -m auto_nag.log --clean + +# Close inactive intermittent bugs +python -m auto_nag.scripts.survey_sec_bugs + +# Send a mail if the logs are not empty +# MUST ALWAYS BE THE LAST COMMAND +python -m auto_nag.log --send + +deactivate diff --git a/templates/survey_sec_bugs.html b/templates/survey_sec_bugs.html new file mode 100644 index 00000000..f6152d7c --- /dev/null +++ b/templates/survey_sec_bugs.html @@ -0,0 +1,20 @@ + +

Here are security bugs closed in the last month where we asked for feedback about creating static analysis: + + + + + + + + + {% for i, (bugid, _) in enumerate(data) -%} + + + + {% endfor -%} + +
Bug
+ {{ bugid }} +
+

\ No newline at end of file