(tooling-agents) branch main updated: ASVS audit: 15.2.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new d30e632  ASVS audit: 15.2.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
d30e632 is described below

commit d30e632ed5c5cc115cdb165a2c5df55fe6cff3d3
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:53:44 2026 +0200

    ASVS audit: 15.2.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/15.2.1.md | 141 ++++++++++++++++++++++++++++
 1 file changed, 141 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/15.2.1.md b/ASVS/reports/steve/v3/d0aa7e9/all/15.2.1.md
new file mode 100644
index 0000000..482af7e
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/15.2.1.md
@@ -0,0 +1,141 @@
+# Security Audit Report: ASVS 15.2.1
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 15.2.1 |
+| **Files Analyzed** | 14 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the application only contains components which have not breached the documented update and remediation time frames.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 1 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-15.2.1: Security Architecture and Dependencies - Update Timeframes
+
+### Findings for 15.2.1
+
+### [HIGH]
+
+**Finding ID**: ASVS-1521-HIGH-001
+**Location**: Project-wide (`v3/pyproject.toml`, `v3/ARCHITECTURE.md`)
+**Issue**: No documented update or remediation timeframes for third-party components
+
+**Evidence**:
+
+The `ARCHITECTURE.md` states:
+```markdown
+- **Dependencies**: Managed via `uv` (Python package manager); includes Quart, asfpy, etc.
+```
+
+And the ASVS section description specifies:
+> This section also emphasizes the importance of defining appropriate timeframes for addressing vulnerabilities in third-party components.
+
+**No document in the codebase** defines:
+- Maximum acceptable age for dependencies
+- Timeframe for applying security patches (e.g., critical: 24h, high: 7d, medium: 30d)
+- Process for monitoring dependency vulnerabilities
+- Criteria for when a component must be updated or replaced
+
+The `pyproject.toml` uses version constraints:
+```toml
+"cryptography>=46.0.5,<47",
+"argon2-cffi>=25.1.0,<26",
+```
+
+Without a documented policy, there is no way to verify whether current component versions are within acceptable timeframes. The version constraints show some management but no documented cadence.
+
+**Impact**: Without defined timeframes, vulnerability remediation becomes ad-hoc. Critical vulnerabilities in dependencies may persist beyond acceptable risk windows because there's no SLA for patching.
+
+**Remediation**: Create a `SECURITY-POLICY.md` or add to `ARCHITECTURE.md`:
+```markdown
+## Dependency Update Policy
+
+### Remediation Timeframes
+| Severity | Timeframe | Action |
+|----------|-----------|--------|
+| Critical (CVSS 9.0+) | 48 hours | Immediate patch/upgrade |
+| High (CVSS 7.0-8.9) | 7 days | Scheduled patch |
+| Medium (CVSS 4.0-6.9) | 30 days | Next release cycle |
+| Low (CVSS < 4.0) | 90 days | Planned maintenance |
+
+### Monitoring
+- Automated vulnerability scanning via GitHub Dependabot/Safety
+- Monthly manual review of dependency health
+
+### Current Component Status
+All dependencies verified within timeframes as of: [DATE]
+```
+
+---
+
+### Security Controls Inventory for 15.2.1
+
+| Control | Location | Coverage |
+|---------|----------|----------|
+| Version pinning with upper bounds | `pyproject.toml` | Applied to security-critical libs only |
+| Dependency vulnerability scanning | N/A | **NOT DOCUMENTED** |
+| Update/remediation timeframe policy | N/A | **MISSING** |
+| Component freshness tracking | N/A | **MISSING** |
+
+### Positive Patterns for 15.2.1
+
+- Upper-bound version constraints on `cryptography` and `argon2-cffi` prevent unintentional major version jumps
+- Use of `uv` package manager enables reproducible builds and lock files
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Documentation Maturity Gap**: The project has good inline code documentation (`ARCHITECTURE.md`, `schema.md`, `tally.md`) but lacks formal security architecture documentation. Security decisions are documented in comments and TODOs rather than dedicated security documents.
+
+2. **Development vs. Production Boundary**: Multiple indicators suggest the codebase is in an active development state being deployed (or ready to deploy) with development artifacts still present. The `TODO.md` essentially serves as both a bug tracker and security audit log.
+
+3. **Authentication vs. Authorization**: The project correctly implements authentication (via ASF OAuth/session), but authorization (ownership checks, per-election access control) is consistently marked with placeholder comments (`### check authz`). This creates a Type B gap — the decorator exists but fine-grained authorization is not implemented.
+
+4. **Cryptographic Design is Strong**: The vote encryption/anonymization design (Argon2 KDF, per-voter salts, encrypted ballots, anti-tamper hashing) is well-implemented. However, the deliberate slowness of these operations creates availability concerns that are only partially addressed.
+
+5. **Dependency Management Awareness**: Version constraints show intentional dependency management, but no formal vulnerability tracking or update policy exists.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (0-7 days)
+1. **Remove debug prints** from `pages.py` (`do_add_issue_endpoint`, `do_edit_issue_endpoint`) — trivial fix
+2. **Remove/fix placeholder `issue_count = 5`** — incorrect data shown to users
+3. **Remove `_REMAP` hack** from `create-election.py` — test code in production tool
+
+### Short-term (1-4 weeks)
+4. **Create Security Architecture Document** addressing:
+   - Dangerous functionality registry (ASVS 15.1.5)
+   - Risky component assessment (ASVS 15.1.4)
+   - Resource-demanding functionality inventory with mitigations (ASVS 15.1.3)
+   - Dependency update policy with timeframes (ASVS 15.2.1)
+5. **Implement rate limiting** on Argon2-heavy endpoints (`/do-vote/<eid>`, `/do-open/<eid>`)
+6. **Implement real CSRF tokens** — replace placeholder, add validation middleware
+
+### Long-term (1-3 months)
+7. **Implement authorization layer** — replace all `### check authz` placeholders with ownership/permission verification
+8. **Establish CI/CD pipeline** with:
+   - Automated dependency vulnerability scanning (e.g., `pip-audit`, `safety`)
+   - Linting for debug prints and placeholder code
+   - Separation of dev/test scripts from production distribution
+9. **Add async/queue processing** for election `open()` operations with many voters
+10. **Document and enforce consumer timeout strategy** for all web endpoints interacting with Argon2
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org