You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by "csutherl (via GitHub)" <gi...@apache.org> on 2026/04/29 18:55:34 UTC
[PR] Add SECURITY.md per dev-list discussion [tomcat]
csutherl opened a new pull request, #1001:
URL: https://github.com/apache/tomcat/pull/1001
This change follows up on the dev-list discussion at https://lists.apache.org/thread/4mzg1hfp79tvjrk2mgw7oqx9ydwtd3l1 with a proposal for discussion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf commented on PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#issuecomment-4520629796
How do you propose to address the conflicts? There looks to be some useful wording in the current file we should retain.
I'm not sure about listing non-issues here and in the security model. I'd prefer not to duplicate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3751785159
##########
SECURITY.md:
##########
@@ -1,14 +1,136 @@
-# Security
+# Security Policy
-Apache Tomcat's security model and disclosure process are
-published on the project website rather than in the repository:
+## Before You Report - Required Self-Check
-- **Threat model and security policy**:
- <https://tomcat.apache.org/security-model.html>
-- **How to report a vulnerability**: see the Security section
- of <https://tomcat.apache.org/>.
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
-The project website is the authoritative source; this file
-exists so agents and tooling that look for `SECURITY.md` in
-the repository can mechanically follow the link to the
-canonical documents.
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability, or I have provided a justification as to why a JUnit test case cannot be written for this report and I have provided a minimal proof of concept
+- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output
+- [ ] I am submitting in plain text (no PDFs, archives, videos, or formatted documents)
+
+**If you cannot check all boxes, your report will be rejected.**
Review Comment:
I think that's a good idea so I updated that to require inclusion of the completed list. We can't really automatically enforce it like that though since they reports come via email rather than issues/PRs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#issuecomment-5224119620
I accidentally pushed a bad update, so I revisited this PR and think it's worth another look now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "dsoumis (via GitHub)" <gi...@apache.org>.
dsoumis commented on PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#issuecomment-4350591984
Not something crucial, but just a note from my point of view that it would be better to remove ❌ and 🔒 emojis in order to align with the tone of the rest of the docs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#issuecomment-5332194569
I've resolved the feedback here and no updates in a week, so merging and will backport to 9.0.x also.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3168206574
##########
SECURITY.md:
##########
@@ -0,0 +1,127 @@
+# Security Policy
+
+## Before You Report - Required Self-Check
+
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
+
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability
+- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output
+- [ ] I am submitting in plain text (no PDFs, archives, videos, or formatted documents)
+
+**If you cannot check all boxes, your report will be rejected.**
+
+## Where to Report
+
+**📧 security@tomcat.apache.org** - Exclusively for undisclosed security vulnerabilities in Tomcat
+
+**Not for:** Bug reports ([Bugzilla](https://bz.apache.org/bugzilla/)), configuration help ([users list](https://tomcat.apache.org/lists.html)), theoretical issues, scanner output, or application vulnerabilities.
+
+## Common Invalid Reports - Do Not Send
+
+These will be **rejected without response**:
+
+- ❌ "Tomcat allows deploying WAR files that execute code" - Web apps are trusted, this is normal
+- ❌ "I can modify server.xml to change behavior" - Config files are trusted
+- ❌ "Sending lots of data crashes Tomcat" - Generic DoS without non-linear consumption
+- ❌ "XSS/SQLi in my deployed application" - Your app's bug, not Tomcat's
+- ❌ "Manager app accessible with valid password" - Admin users are trusted
+- ❌ Scanner reports without actual testing - Must verify manually with working PoC
+- ❌ Theoretical vulnerabilities or AI-generated reports - Must include working test case
+
+**Review the [security model](https://tomcat.apache.org/security-model.html) to understand what qualifies as a Tomcat vulnerability.**
+
+## Required: Working Test Case
+
+**Every report MUST include a complete Tomcat JUnit test case that:**
+- Extends `TomcatBaseTest` or appropriate test base class
+- Compiles against Tomcat source without errors
+- Runs via `ant test` and demonstrates the vulnerability
+- Uses real Tomcat APIs (not pseudo-code)
+- Includes comments explaining the attack and impact
+
+**The test must actually work - we will run it. If it doesn't compile or doesn't reproduce the issue, your report will be rejected.**
+
+### Example Structure
+
+```java
+package org.apache.catalina.security;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.apache.catalina.startup.TomcatBaseTest;
+import org.apache.catalina.startup.Tomcat;
+import org.apache.catalina.Context;
+import org.apache.tomcat.util.buf.ByteChunk;
+
+/**
+ * Demonstrates [specific vulnerability].
+ * Attack: [how it works]
+ * Impact: [security consequence]
+ */
+public class TestSecurityIssueXXXXX extends TomcatBaseTest {
+
+ @Test
+ public void testVulnerabilityName() throws Exception {
+ // Setup: Configure Tomcat to expose the vulnerability
+ Tomcat tomcat = getTomcatInstance();
+ Context ctx = tomcat.addContext("", null);
+ Tomcat.addServlet(ctx, "test", new YourTestServlet());
+ ctx.addServletMappingDecoded("/test", "test");
+ tomcat.start();
+
+ // Attack: Send malicious request
+ ByteChunk response = new ByteChunk();
+ int rc = getUrl("http://localhost:" + getPort() + "/test?malicious=payload",
+ response, null);
+
+ // Verify: Demonstrate security impact
+ Assert.assertNotEquals("Should reject malicious input", 200, rc);
+ // Or: Assert.assertFalse("Response leaked sensitive data",
+ // response.toString().contains("secret"));
+ }
+}
+```
+
+## Required Report Information
+
+Include all of the following:
+1. **Summary** - 1-2 sentences describing the vulnerability
+2. **Tomcat Version** - Exact version tested (e.g., `Apache-Tomcat/11.0.5`)
+3. **Configuration** - Non-default settings needed to reproduce (if any)
+4. **Impact** - Specific consequence (RCE, information disclosure, authentication bypass, etc.)
+5. **Test Case** - Working JUnit test as described above
+
+**Format:** Plain text only (email body or `.txt`/`.java` attachments). No `.zip`, `.pdf`, `.docx`, videos, or screenshots.
+
+## What Happens Next
+
+1. **Acknowledgment** - Usually within a few business days, if the report passes initial screening
+2. **Validation** - We run your test case and assess impact against the security model
+3. **Fix & Disclosure** - If valid, we develop a fix and coordinate public disclosure timing
+4. **Credit** - Valid reports receive acknowledgment in security advisories
+
+Allow reasonable time (typically 90+ days) for fix development. We'll work with you on disclosure timing.
+
+## Security Model Quick Reference
+
+**Trusted (not security bugs):**
+- Administrative users, configuration files, binaries
Review Comment:
I added some clarification there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "n828cl (via GitHub)" <gi...@apache.org>.
n828cl commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3163566483
##########
SECURITY.md:
##########
@@ -0,0 +1,127 @@
+# Security Policy
+
+## Before You Report - Required Self-Check
+
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
+
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability
+- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output
+- [ ] I am submitting in plain text (no PDFs, archives, videos, or formatted documents)
+
+**If you cannot check all boxes, your report will be rejected.**
+
+## Where to Report
+
+**📧 security@tomcat.apache.org** - Exclusively for undisclosed security vulnerabilities in Tomcat
+
+**Not for:** Bug reports ([Bugzilla](https://bz.apache.org/bugzilla/)), configuration help ([users list](https://tomcat.apache.org/lists.html)), theoretical issues, scanner output, or application vulnerabilities.
+
+## Common Invalid Reports - Do Not Send
+
+These will be **rejected without response**:
+
+- ❌ "Tomcat allows deploying WAR files that execute code" - Web apps are trusted, this is normal
+- ❌ "I can modify server.xml to change behavior" - Config files are trusted
+- ❌ "Sending lots of data crashes Tomcat" - Generic DoS without non-linear consumption
+- ❌ "XSS/SQLi in my deployed application" - Your app's bug, not Tomcat's
+- ❌ "Manager app accessible with valid password" - Admin users are trusted
+- ❌ Scanner reports without actual testing - Must verify manually with working PoC
+- ❌ Theoretical vulnerabilities or AI-generated reports - Must include working test case
+
+**Review the [security model](https://tomcat.apache.org/security-model.html) to understand what qualifies as a Tomcat vulnerability.**
+
+## Required: Working Test Case
+
+**Every report MUST include a complete Tomcat JUnit test case that:**
+- Extends `TomcatBaseTest` or appropriate test base class
+- Compiles against Tomcat source without errors
+- Runs via `ant test` and demonstrates the vulnerability
+- Uses real Tomcat APIs (not pseudo-code)
+- Includes comments explaining the attack and impact
+
+**The test must actually work - we will run it. If it doesn't compile or doesn't reproduce the issue, your report will be rejected.**
+
+### Example Structure
+
+```java
+package org.apache.catalina.security;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.apache.catalina.startup.TomcatBaseTest;
+import org.apache.catalina.startup.Tomcat;
+import org.apache.catalina.Context;
+import org.apache.tomcat.util.buf.ByteChunk;
+
+/**
+ * Demonstrates [specific vulnerability].
+ * Attack: [how it works]
+ * Impact: [security consequence]
+ */
+public class TestSecurityIssueXXXXX extends TomcatBaseTest {
+
+ @Test
+ public void testVulnerabilityName() throws Exception {
+ // Setup: Configure Tomcat to expose the vulnerability
+ Tomcat tomcat = getTomcatInstance();
+ Context ctx = tomcat.addContext("", null);
+ Tomcat.addServlet(ctx, "test", new YourTestServlet());
+ ctx.addServletMappingDecoded("/test", "test");
+ tomcat.start();
+
+ // Attack: Send malicious request
+ ByteChunk response = new ByteChunk();
+ int rc = getUrl("http://localhost:" + getPort() + "/test?malicious=payload",
+ response, null);
+
+ // Verify: Demonstrate security impact
+ Assert.assertNotEquals("Should reject malicious input", 200, rc);
+ // Or: Assert.assertFalse("Response leaked sensitive data",
+ // response.toString().contains("secret"));
+ }
+}
+```
+
+## Required Report Information
+
+Include all of the following:
+1. **Summary** - 1-2 sentences describing the vulnerability
+2. **Tomcat Version** - Exact version tested (e.g., `Apache-Tomcat/11.0.5`)
+3. **Configuration** - Non-default settings needed to reproduce (if any)
+4. **Impact** - Specific consequence (RCE, information disclosure, authentication bypass, etc.)
+5. **Test Case** - Working JUnit test as described above
+
+**Format:** Plain text only (email body or `.txt`/`.java` attachments). No `.zip`, `.pdf`, `.docx`, videos, or screenshots.
+
+## What Happens Next
+
+1. **Acknowledgment** - Usually within a few business days, if the report passes initial screening
+2. **Validation** - We run your test case and assess impact against the security model
+3. **Fix & Disclosure** - If valid, we develop a fix and coordinate public disclosure timing
+4. **Credit** - Valid reports receive acknowledgment in security advisories
+
+Allow reasonable time (typically 90+ days) for fix development. We'll work with you on disclosure timing.
+
+## Security Model Quick Reference
+
+**Trusted (not security bugs):**
+- Administrative users, configuration files, binaries
Review Comment:
Might want to qualify "binaries" with something like "unmodified Tomcat binaries".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3166627255
##########
SECURITY.md:
##########
@@ -0,0 +1,127 @@
+# Security Policy
+
+## Before You Report - Required Self-Check
+
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
+
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability
Review Comment:
Maybe add "... or I have provided a justification as to why a JUnit test case cannot be written for this report and I have provided a minimal proof of concept."
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "dsoumis (via GitHub)" <gi...@apache.org>.
dsoumis commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3166353278
##########
SECURITY.md:
##########
@@ -0,0 +1,127 @@
+# Security Policy
+
+## Before You Report - Required Self-Check
+
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
+
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability
Review Comment:
There may be corner cases that wouldn't be able to be tested through unit tests. I recall some recent examples with byte manipulation..
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "ChristopherSchultz (via GitHub)" <gi...@apache.org>.
ChristopherSchultz commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3740688361
##########
SECURITY.md:
##########
@@ -1,14 +1,136 @@
-# Security
+# Security Policy
-Apache Tomcat's security model and disclosure process are
-published on the project website rather than in the repository:
+## Before You Report - Required Self-Check
-- **Threat model and security policy**:
- <https://tomcat.apache.org/security-model.html>
-- **How to report a vulnerability**: see the Security section
- of <https://tomcat.apache.org/>.
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
-The project website is the authoritative source; this file
-exists so agents and tooling that look for `SECURITY.md` in
-the repository can mechanically follow the link to the
-canonical documents.
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
Review Comment:
We might want to add "data stores" or something like that, here. I want to avoid reports of "oh, I put a serialized gadget into the session database and it exploded when Tomcat loaded it".
##########
SECURITY.md:
##########
@@ -1,14 +1,136 @@
-# Security
+# Security Policy
-Apache Tomcat's security model and disclosure process are
-published on the project website rather than in the repository:
+## Before You Report - Required Self-Check
-- **Threat model and security policy**:
- <https://tomcat.apache.org/security-model.html>
-- **How to report a vulnerability**: see the Security section
- of <https://tomcat.apache.org/>.
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
-The project website is the authoritative source; this file
-exists so agents and tooling that look for `SECURITY.md` in
-the repository can mechanically follow the link to the
-canonical documents.
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability, or I have provided a justification as to why a JUnit test case cannot be written for this report and I have provided a minimal proof of concept
+- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output
+- [ ] I am submitting in plain text (no PDFs, archives, videos, or formatted documents)
+
+**If you cannot check all boxes, your report will be rejected.**
Review Comment:
Should we require this checklist to be included in any submitted report? My corporate gitlab instance has a template for all MRs including checklists similar to this.
##########
SECURITY.md:
##########
@@ -1,14 +1,136 @@
-# Security
+# Security Policy
-Apache Tomcat's security model and disclosure process are
-published on the project website rather than in the repository:
+## Before You Report - Required Self-Check
-- **Threat model and security policy**:
- <https://tomcat.apache.org/security-model.html>
-- **How to report a vulnerability**: see the Security section
- of <https://tomcat.apache.org/>.
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
-The project website is the authoritative source; this file
-exists so agents and tooling that look for `SECURITY.md` in
-the repository can mechanically follow the link to the
-canonical documents.
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability, or I have provided a justification as to why a JUnit test case cannot be written for this report and I have provided a minimal proof of concept
+- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output
Review Comment:
Should we also add "the most recent release of a supported Tomcat version" to this?
I'm not saying we wouldn't accept a CVE against an older version (e.g. 8.5.last), though we obviously wouldn't fix it. But filing a CVE against 9.0.25 isn't helpful to anyone.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3751769684
##########
SECURITY.md:
##########
@@ -1,14 +1,136 @@
-# Security
+# Security Policy
-Apache Tomcat's security model and disclosure process are
-published on the project website rather than in the repository:
+## Before You Report - Required Self-Check
-- **Threat model and security policy**:
- <https://tomcat.apache.org/security-model.html>
-- **How to report a vulnerability**: see the Security section
- of <https://tomcat.apache.org/>.
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
-The project website is the authoritative source; this file
-exists so agents and tooling that look for `SECURITY.md` in
-the repository can mechanically follow the link to the
-canonical documents.
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
Review Comment:
Sounds good. I added "data stores" to both the self-check checklist and Security Model reference trusted list to cover the scenario mentioned.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3168209506
##########
SECURITY.md:
##########
@@ -0,0 +1,127 @@
+# Security Policy
+
+## Before You Report - Required Self-Check
+
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
+
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability
Review Comment:
True, I incorporated Mark's suggested text in both the checklist and added an exception section to the POC requirements section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#issuecomment-4520069465
I incorporated the changes from the brief SECURITY.md that was recently added into the proposal. I only made one small tweak to what I had already done since the current SECURITY.md topics are covered in this proposed change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl commented on code in PR #1001:
URL: https://github.com/apache/tomcat/pull/1001#discussion_r3751773962
##########
SECURITY.md:
##########
@@ -1,14 +1,136 @@
-# Security
+# Security Policy
-Apache Tomcat's security model and disclosure process are
-published on the project website rather than in the repository:
+## Before You Report - Required Self-Check
-- **Threat model and security policy**:
- <https://tomcat.apache.org/security-model.html>
-- **How to report a vulnerability**: see the Security section
- of <https://tomcat.apache.org/>.
+**Complete this checklist. If you answer "No" to any question, do not submit a report:**
-The project website is the authoritative source; this file
-exists so agents and tooling that look for `SECURITY.md` in
-the repository can mechanically follow the link to the
-canonical documents.
+- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces
+- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability, or I have provided a justification as to why a JUnit test case cannot be written for this report and I have provided a minimal proof of concept
+- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output
Review Comment:
I reworded this to explicitly require the most recent, supported version of tomcat.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Add SECURITY.md per dev-list discussion [tomcat]
Posted by "csutherl (via GitHub)" <gi...@apache.org>.
csutherl merged PR #1001:
URL: https://github.com/apache/tomcat/pull/1001
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org