(tooling-agents) branch main updated: ASVS audit: 12.2.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 69df1f7  ASVS audit: 12.2.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
69df1f7 is described below

commit 69df1f79c039119426c48d78468ebb918e0d47d8
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:52:32 2026 +0200

    ASVS audit: 12.2.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/12.2.2.md | 188 ++++++++++++++++++++++++++++
 1 file changed, 188 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/12.2.2.md b/ASVS/reports/steve/v3/d0aa7e9/all/12.2.2.md
new file mode 100644
index 0000000..7e9625a
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/12.2.2.md
@@ -0,0 +1,188 @@
+# Security Audit Report: ASVS 12.2.2
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 12.2.2 |
+| **Files Analyzed** | 10 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that external facing services use publicly trusted TLS certificates.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 2 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-12.2.2: HTTPS Communication with External Facing Services
+
+### Findings for 12.2.2
+
+#### [MEDIUM]
+**Finding ID**: ASVS-1222-MED-001
+
+**Title**: Self-signed certificates used with no pathway to publicly trusted certificates for external-facing services
+
+**File**: `v3/server/config.yaml.example` (lines 25-31), `v3/docs/quickstart.md` (lines 49-53)
+
+**Vulnerable Configuration**:
+```yaml
+# config.yaml.example
+server:
+    certfile: localhost.apache.org+3.pem
+    keyfile: localhost.apache.org+3-key.pem
+```
+
+```markdown
+# quickstart.md
+Then, follow the instructions in [`server/certs/README.md`](../server/certs/README.md) 
+to create self-signed certificates for development purposes.
+```
+
+**Data flow**: Configuration → Server startup → TLS handshake with browsers/clients → Self-signed certificate presented
+
+**Analysis**: The example configuration and documentation exclusively reference self-signed certificates. While the architecture document mentions "Typical usage is that a proxy sits in front of this server," there is:
+1. No production configuration example with publicly trusted certificates
+2. No documentation on deploying with publicly trusted TLS certs
+3. No validation that configured certificates are publicly trusted
+4. The `certs/` directory structure implies certificate storage alongside code
+
+**Impact**: External-facing clients (voters, administrators) connecting directly to this service would encounter certificate warnings or be vulnerable to MITM attacks if self-signed certificates are used in production.
+
+**Remediation**: 
+- Provide a production configuration example using Let's Encrypt or other CA-signed certificates
+- Add deployment documentation requiring publicly trusted certificates for production
+- Consider integrating ACME (Let's Encrypt) certificate provisioning
+```yaml
+# config.yaml.production.example
+server:
+    port: 443
+    certfile: /etc/letsencrypt/live/voting.example.org/fullchain.pem
+    keyfile: /etc/letsencrypt/live/voting.example.org/privkey.pem
+```
+
+---
+
+#### [MEDIUM]
+**Finding ID**: ASVS-1222-MED-002
+
+**Title**: TLS is optional in server configuration — no enforcement of HTTPS for external-facing traffic
+
+**File**: `v3/server/config.yaml.example` (lines 25-31), `v3/server/main.py` (lines 80-84)
+
+**Vulnerable Code**:
+```python
+# main.py lines 80-84
+kwargs = {}
+if app.cfg.server.certfile:
+    kwargs['certfile'] = CERTS_DIR / app.cfg.server.certfile
+    kwargs['keyfile'] = CERTS_DIR / app.cfg.server.keyfile
+    extra_files.update((kwargs['certfile'], kwargs['keyfile']))
+```
+
+```yaml
+# config.yaml.example comments
+    # Specify the .pem files to serve using TLS, or leave these two
+    # fields blank for plain HTTP.
+```
+
+**Data flow**: Empty `certfile` config → No TLS kwargs → `app.runx()` starts plain HTTP → All traffic unencrypted
+
+**Proof of concept**: Set `certfile:` and `keyfile:` to empty strings in config.yaml, and the server starts in plain HTTP mode, serving all election data (votes, authentication tokens) over unencrypted connections.
+
+**Impact**: If deployed without TLS configuration (or if configuration is accidentally cleared), the election system would expose all communications in plaintext, including authentication credentials, vote submissions, and administrative actions.
+
+**Remediation**:
+```python
+# main.py - enforce TLS
+if not app.cfg.server.certfile or not app.cfg.server.keyfile:
+    _LOGGER.critical('TLS certificates MUST be configured. '
+                     'Set server.certfile and server.keyfile in config.yaml')
+    sys.exit(1)
+
+kwargs['certfile'] = CERTS_DIR / app.cfg.server.certfile
+kwargs['keyfile'] = CERTS_DIR / app.cfg.server.keyfile
+```
+
+### Security Controls Inventory for 12.2.2
+
+| Control | Location | Coverage Status |
+|---------|----------|-----------------|
+| TLS certificate configuration | `config.yaml.example` lines 25-31 | DEFINED but OPTIONAL (Gap Type B) |
+| TLS loading at startup | `main.py` lines 80-84 | CONDITIONAL on config, no enforcement |
+| HSTS headers | Not found | ABSENT |
+| HTTP→HTTPS redirect | Not found | ABSENT |
+
+### Positive Patterns for 12.2.2
+
+- The server *does* support TLS configuration with certificate files
+- HTTPS URLs are used for OAuth integration (`https://oauth.apache.org/...` in `main.py`)
+- The architecture explicitly mentions a proxy layer in front for production deployments
+- The server uses a non-standard port (58383), suggesting it's designed to sit behind a reverse proxy that handles TLS termination
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Monolithic Architecture Reduces TLS Surface**: The application uses SQLite (local file) and runs as a single process, meaning most "internal communication" happens in-process. The primary TLS concern is the external-facing server endpoint and the proxy-to-app connection.
+
+2. **Proxy-Dependent Security Model**: The architecture explicitly states "a proxy sits in front of this server." This means TLS termination and certificate management may be delegated to the proxy layer (e.g., Apache httpd, nginx, HAProxy), which is not represented in this codebase. This is a common and valid pattern but creates an implicit dependency that isn't enforced.
+
+3. **Optional TLS is the Primary Risk**: The most significant cross-cutting issue is that TLS is conditional on configuration. The server can run in plain HTTP mode, which violates multiple requirements simultaneously (12.2.2, 12.3.1, 12.3.3).
+
+4. **External Dependencies Not Auditable**: The `asfquart` framework handles OAuth HTTP clients and potentially TLS configuration. Without access to this code, certificate validation behavior cannot be fully verified.
+
+5. **Development vs. Production Gap**: The documentation and configuration examples target development (self-signed certs, localhost). There is no production deployment guide addressing TLS requirements.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical/High Priority)
+
+1. **Enforce TLS at Startup**: Modify `main.py` to require TLS configuration and fail with a clear error if certificates are missing or invalid. Allow an explicit `--insecure` flag for development only:
+   ```python
+   if not app.cfg.server.certfile and not os.environ.get('STEVE_DEV_MODE'):
+       _LOGGER.critical('TLS is required. Set certfile/keyfile or STEVE_DEV_MODE=1')
+       sys.exit(1)
+   ```
+
+2. **Add HSTS Headers**: Configure Strict-Transport-Security headers to prevent protocol downgrade:
+   ```python
+   @APP.after_request
+   async def add_security_headers(response):
+       response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
+       return response
+   ```
+
+### Short-term (Within 1-2 Sprints)
+
+3. **Production Deployment Guide**: Create documentation for production TLS deployment covering:
+   - Publicly trusted certificate acquisition (Let's Encrypt/ACME)
+   - Reverse proxy TLS configuration
+   - Internal communication encryption requirements
+
+4. **Verify OAuth Client TLS**: Audit the `asfquart` library to confirm certificate validation is enabled and cannot be accidentally disabled.
+
+5. **Certificate Validation for LDAP**: Ensure `asf-load-ldap.py` uses LDAPS or StartTLS with certificate validation.
+
+### Long-term (Architecture Level)
+
+6. **Internal CA Infrastructure**: If the deployment grows beyond a single-host model, establish an internal CA for service-to-service TLS with proper certificate lifecycle management.
+
+7. **Consider mTLS for Proxy-App Communication**: Implement mutual TLS between the reverse proxy and the application server for defense-in-depth.
+
+8. **Automated Certificate Rotation**: Integrate certificate rotation mechanisms (e.g., cert-manager, ACME) to prevent certificate expiry-related outages.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org