(tooling-agents) branch main updated: ASVS audit: 14.2.3.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 3b1cc41  ASVS audit: 14.2.3.md (redacted)
3b1cc41 is described below

commit 3b1cc414c95ea5031434d995211ddc8d8344243b
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:03:55 2026 +0200

    ASVS audit: 14.2.3.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/14.2.3.md | 118 ++++++++++++++++++++++++++++
 1 file changed, 118 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/14.2.3.md b/ASVS/reports/steve/v3/d0aa7e9/all/14.2.3.md
new file mode 100644
index 0000000..08a3d8a
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/14.2.3.md
@@ -0,0 +1,118 @@
+# Security Audit Report: ASVS 14.2.3
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 14.2.3 |
+| **Files Analyzed** | 9 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that defined sensitive data is not sent to untrusted parties (e.g., user trackers) to prevent unwanted collection of data outside of the application's control.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 1 |
+
+---
+
+## ASVS-14.2.3: Sensitive Data Not Sent to Untrusted Parties
+
+### Findings for 14.2.3
+
+No findings detected at CRITICAL or HIGH severity.
+
+### [LOW]
+
+**Finding ID:** ASVS-1423-LOW-001
+
+**Title:** Email Addresses Sent via External Mail Service Without Explicit Data Processing Agreement Documentation
+
+**File:** `v3/server/bin/mail-voters.py`, lines 66-75  
+**Function:** `main`
+
+**Vulnerable Code:**
+```python
+# Send the email
+asfpy.messaging.mail(
+    sender='Apache Election Platform <vo...@apache.org>',
+    recipient=voter.email,
+    subject=f'Vote in Election: {metadata.title}',
+    message=rendered_body,
+)
+```
+
+**Data Flow:** PersonDB (email addresses) → `asfpy.messaging.mail()` → external mail transport → voter inbox.
+
+**Impact:** Voter email addresses and election titles are transmitted through the mail system. While `asfpy.messaging` is an internal ASF library, the underlying mail transport infrastructure (SMTP relay) processes voter PII. The impact is low because this is the intended functionality and uses an organizationally trusted service.
+
+**Remediation:** Document the mail transport as a trusted party in data processing documentation. Ensure the SMTP relay is covered by the organization's data handling policies.
+
+### Security Controls Inventory for 14.2.3
+
+| Control | Location | Status |
+|---------|----------|--------|
+| Local hosting of third-party JS | `vote-on.ezt` (SortableJS from `/static/js/`) | **PRESENT** ✓ |
+| Subresource Integrity (SRI) | `vote-on.ezt` line (integrity attribute) | **PRESENT** ✓ |
+| Referrer Policy | `vote-on.ezt` (`referrerpolicy="no-referrer"`) | **PRESENT** ✓ |
+| No external analytics/tracking | All templates | **CONFIRMED** ✓ |
+| No CDN dependencies | All templates | **CONFIRMED** ✓ |
+
+### Positive Patterns for 14.2.3
+
+- **SortableJS served locally** with SRI integrity hash: `integrity="sha384-DgmC6Xe2bSN2WjTDXzWYbUbxyhNP+NNkGDR/g78pCXV7E7rcVTGxVg0uIVCUUcBc"` prevents loading of tampered scripts.
+- **`referrerpolicy="no-referrer"`** on the script tag prevents leaking the page URL (which contains the election ID) to any origin.
+- **`crossorigin="anonymous"`** ensures no credentials are sent with the script request.
+- No third-party tracking pixels, analytics services, or user trackers detected in any template or server code.
+- The mail service (`asfpy.messaging`) is an internal organizational tool, not a third-party user tracker.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Security Control Consistency Gap**: The application has strong cryptographic controls (Argon2, Fernet encryption, BLAKE2b, CSPRNG for IDs and shuffling) but lacks fundamental HTTP-layer security headers (Cache-Control, X-Content-Type-Options). This suggests the security design focused on cryptographic vote integrity but did not address transport/caching layer concerns.
+
+2. **Internal vs. External API Surface**: The `Election._all_metadata()` method is documented as "INTERNAL ONLY" and returns sensitive fields (salt, opened_key), while `get_metadata()` is the safe public API. This separation is correct but relies on convention rather than enforcement (no access modifier, just naming convention with underscore prefix).
+
+3. **Authorization Gap (Cross-cutting)**: Multiple endpoints have `### check authz` placeholder comments. While authentication is enforced via decorators, fine-grained authorization (e.g., only election owner can open/close/manage) is not implemented. This affects multiple ASVS requirements indirectly — if an unauthorized user can access management endpoints, they could view sensitive election data that should be minimized.
+
+4. **Data Flow Segregation**: The system properly segregates sensitive cryptographic material (salt, opened_key) from public-facing queries at the SQL level (separate queries for internal vs. external use). This is a strong architectural pattern.
+
+5. **Template Security**: The EZT templating engine used for HTML rendering requires careful attention to output encoding. The `vote-on.ezt` template includes a client-side `escapeHtml()` function for JavaScript-rendered content, but server-side rendering relies on EZT's default behavior.
+
+6. **Operational Tooling**: The `mail-voters.py` script runs as a standalone process with direct database access. It accesses voter PII (email addresses) without the web application's session/auth layer, relying instead on OS-level access controls to the script and database file.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (Within Sprint)
+
+1. **Remove debug print statements** (`pages.py` lines 481, 497) — Direct PII/data exposure risk.
+2. **Add `Cache-Control: no-store, private` header** to all authenticated responses via an `@APP.after_request` handler.
+3. **Add `X-Content-Type-Options: nosniff` header** globally.
+
+### Short-term (Within Quarter)
+
+4. **Implement authorization checks** at all `### check authz` placeholder locations — verify the authenticated user is the election owner or in the authorized group before allowing management operations.
+5. **Document data retention policy** — classify each data type (elections, votes, persons) with explicit retention periods and deletion triggers.
+6. **Implement CSRF token validation** — replace the placeholder token with a real per-session token and validate on all POST endpoints.
+7. **Validate `docname` parameter** in `serve_doc()` — restrict to safe filename characters.
+
+### Long-term (Within Year)
+
+8. **Implement automated data purge** — scheduled job to delete closed elections past retention period and purge superseded votes after tally certification.
+9. **Complete migration to XChaCha20-Poly1305** with AAD binding vote ciphertext to vote_token.
+10. **Implement log classification** — ensure logs containing user-action mappings have appropriate retention limits and access controls distinct from application data.
+11. **Add per-response caching policy** — static assets should have appropriate cache headers (`max-age`), while dynamic authenticated content should have `no-store`.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org