(tooling-agents) branch main updated: ASVS audit: 15.2.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 7f1729b  ASVS audit: 15.2.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
7f1729b is described below

commit 7f1729b24cff322394ef3c4b69286c447341378b
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:53:46 2026 +0200

    ASVS audit: 15.2.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/15.2.2.md | 188 ++++++++++++++++++++++++++++
 1 file changed, 188 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/15.2.2.md b/ASVS/reports/steve/v3/d0aa7e9/all/15.2.2.md
new file mode 100644
index 0000000..e40815e
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/15.2.2.md
@@ -0,0 +1,188 @@
+# Security Audit Report: ASVS 15.2.2
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 15.2.2 |
+| **Files Analyzed** | 14 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the application has implemented defenses against loss of availability due to functionality which is time-consuming or resource-demanding, based on the documented security decisions and strategies for this.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 1 |
+| 🟡 Medium | 1 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-15.2.2: Security Architecture and Dependencies - Availability Defenses
+
+### Findings for 15.2.2
+
+### [HIGH]
+
+**Finding ID**: ASVS-1522-HIGH-001
+**Location**: `v3/server/pages.py` — `do_vote_endpoint()` (line 372), `do_open_endpoint()` (line 431)
+**Issue**: No implemented defenses against availability loss from resource-demanding web endpoints
+
+**Evidence**:
+
+The vote submission endpoint triggers Argon2 operations with no rate limiting or queue:
+```python
+@APP.post('/do-vote/<eid>')
+@asfquart.auth.require({R.committer})
+@load_election
+async def do_vote_endpoint(election):
+    # ...
+    for iid, votestring in votes.items():
+        # Each call triggers Argon2 key derivation
+        election.add_vote(result.uid, iid, votestring)
+```
+
+The election open endpoint generates salts for ALL voters (potentially hundreds):
+```python
+@APP.get('/do-open/<eid>')
+@asfquart.auth.require({R.committer})
+@load_election
+async def do_open_endpoint(election):
+    # ...
+    election.open(pdb)  # Generates Argon2 salt for EVERY mayvote row
+```
+
+In `election.py`, `add_salts()` iterates all mayvote rows:
+```python
+def add_salts(self):
+    self.db.conn.execute('BEGIN TRANSACTION')
+    self.q_all_issues.perform(self.eid)
+    for mayvote in self.q_all_issues.fetchall():
+        salt = crypto.gen_salt()
+        self.c_salt_mayvote.perform(salt, mayvote.rowid)
+    self.db.conn.execute('COMMIT')
+```
+
+**Data flow**: User request → web endpoint → multiple Argon2 operations → blocking response
+
+**Attack scenario**: An authenticated committer submits votes for an election with many issues. Each vote triggers an Argon2 KDF. With 20 issues per request and Argon2's deliberate slowness (~100ms+ per operation), the request could take 2+ seconds. Multiple concurrent requests could exhaust server resources.
+
+**Missing defenses**:
+- No per-user rate limiting
+- No request timeout handling
+- No async/background processing for `open()` with many voters
+- No queue for vote submissions
+- No maximum batch size for vote submissions
+- No documentation of the availability strategy
+
+**Impact**: Availability loss through resource exhaustion. While authentication limits the attack surface, any authenticated committer could degrade service.
+
+**Remediation**:
+```python
+# Example: Rate limiting decorator
+from quart_rate_limiter import rate_limit
+
+@APP.post('/do-vote/<eid>')
+@asfquart.auth.require({R.committer})
+@rate_limit(5, timedelta(minutes=1))  # 5 vote submissions per minute per user
+@load_election
+async def do_vote_endpoint(election):
+    # Limit batch size
+    MAX_VOTES_PER_REQUEST = 50
+    if len(votes) > MAX_VOTES_PER_REQUEST:
+        quart.abort(400, 'Too many votes in single request')
+    # ...
+```
+
+---
+
+### [MEDIUM]
+
+**Finding ID**: ASVS-1522-MED-001
+**Location**: `v3/server/pages.py` — `voter_page()` (line 133)
+**Issue**: Multiple database queries performed synchronously without timeout protection
+
+```python
+async def voter_page():
+    with asfpy.stopwatch.Stopwatch():
+        election = steve.election.Election.open_to_pid(DB_FNAME, result.uid)
+        owned = steve.election.Election.owned_elections(DB_FNAME, result.uid)
+    result.upcoming_elections = [
+        postprocess_election(e)
+        for e in steve.election.Election.upcoming_to_pid(DB_FNAME, result.uid)
+    ]
+```
+
+Three separate database connections/queries are opened without timeout protection. While SQLite operations are typically fast, with large datasets and JOINs, these could become slow.
+
+**Impact**: Page load times could degrade under large data sets, potentially causing consumer timeouts without graceful handling.
+
+---
+
+### Security Controls Inventory for 15.2.2
+
+| Control | Location | Coverage |
+|---------|----------|----------|
+| Performance monitoring (Stopwatch) | `pages.py` line 147 | Monitoring only, no enforcement |
+| CLI-only tally (not web-exposed) | `tally.py` | Effective for tally operations |
+| Authentication requirement | All vote endpoints | Limits unauthenticated abuse |
+| Rate limiting | N/A | **MISSING** |
+| Request timeouts | N/A | **MISSING** |
+| Async/queue processing | N/A | **MISSING** |
+| Batch size limits | N/A | **MISSING** |
+
+### Positive Patterns for 15.2.2
+
+- The tally operation (most resource-intensive) is correctly isolated as a CLI tool, not exposed via web endpoints
+- `asfpy.stopwatch.Stopwatch()` provides performance visibility, even if not enforcing limits
+- Authentication on all resource-intensive endpoints limits the anonymous attack surface
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Documentation Maturity Gap**: The project has good inline code documentation (`ARCHITECTURE.md`, `schema.md`, `tally.md`) but lacks formal security architecture documentation. Security decisions are documented in comments and TODOs rather than dedicated security documents.
+
+2. **Development vs. Production Boundary**: Multiple indicators suggest the codebase is in an active development state being deployed (or ready to deploy) with development artifacts still present. The `TODO.md` essentially serves as both a bug tracker and security audit log.
+
+3. **Authentication vs. Authorization**: The project correctly implements authentication (via ASF OAuth/session), but authorization (ownership checks, per-election access control) is consistently marked with placeholder comments (`### check authz`). This creates a Type B gap — the decorator exists but fine-grained authorization is not implemented.
+
+4. **Cryptographic Design is Strong**: The vote encryption/anonymization design (Argon2 KDF, per-voter salts, encrypted ballots, anti-tamper hashing) is well-implemented. However, the deliberate slowness of these operations creates availability concerns that are only partially addressed.
+
+5. **Dependency Management Awareness**: Version constraints show intentional dependency management, but no formal vulnerability tracking or update policy exists.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (0-7 days)
+1. **Remove debug prints** from `pages.py` (`do_add_issue_endpoint`, `do_edit_issue_endpoint`) — trivial fix
+2. **Remove/fix placeholder `issue_count = 5`** — incorrect data shown to users
+3. **Remove `_REMAP` hack** from `create-election.py` — test code in production tool
+
+### Short-term (1-4 weeks)
+4. **Create Security Architecture Document** addressing:
+   - Dangerous functionality registry (ASVS 15.1.5)
+   - Risky component assessment (ASVS 15.1.4)
+   - Resource-demanding functionality inventory with mitigations (ASVS 15.1.3)
+   - Dependency update policy with timeframes (ASVS 15.2.1)
+5. **Implement rate limiting** on Argon2-heavy endpoints (`/do-vote/<eid>`, `/do-open/<eid>`)
+6. **Implement real CSRF tokens** — replace placeholder, add validation middleware
+
+### Long-term (1-3 months)
+7. **Implement authorization layer** — replace all `### check authz` placeholders with ownership/permission verification
+8. **Establish CI/CD pipeline** with:
+   - Automated dependency vulnerability scanning (e.g., `pip-audit`, `safety`)
+   - Linting for debug prints and placeholder code
+   - Separation of dev/test scripts from production distribution
+9. **Add async/queue processing** for election `open()` operations with many voters
+10. **Document and enforce consumer timeout strategy** for all web endpoints interacting with Argon2
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org