(tooling-agents) branch main updated: ASVS audit: 12.1.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new e849a2b  ASVS audit: 12.1.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
e849a2b is described below

commit e849a2be82b60a05fb01121c2d21cbde2b24a9cf
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:52:23 2026 +0200

    ASVS audit: 12.1.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/12.1.1.md | 167 ++++++++++++++++++++++++++++
 1 file changed, 167 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/12.1.1.md b/ASVS/reports/steve/v3/d0aa7e9/all/12.1.1.md
new file mode 100644
index 0000000..b5a089e
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/12.1.1.md
@@ -0,0 +1,167 @@
+# Security Audit Report: ASVS 12.1.1
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 12.1.1 |
+| **Files Analyzed** | 8 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that only the latest recommended versions of the TLS protocol are enabled, such as TLS 1.2 and TLS 1.3. The latest version of the TLS protocol must be the preferred option.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 1 |
+| 🟡 Medium | 1 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-12.1.1: General TLS Security Guidance - TLS Protocol Versions
+
+### Findings for 12.1.1
+
+### [HIGH]
+
+**Finding ID**: ASVS-1211-HIGH-001
+
+**File**: `v3/server/main.py`, function `run_standalone()`, lines 75-78
+
+**Vulnerable code:**
+```python
+kwargs = {}
+if app.cfg.server.certfile:
+    kwargs['certfile'] = CERTS_DIR / app.cfg.server.certfile
+    kwargs['keyfile'] = CERTS_DIR / app.cfg.server.keyfile
+    extra_files.update((kwargs['certfile'], kwargs['keyfile']))
+
+# Spool up the app!
+app.runx(port=app.cfg.server.port, extra_files=extra_files, **kwargs)
+```
+
+**Data flow**: config.yaml → `app.cfg.server.certfile` / `app.cfg.server.keyfile` → passed directly to `app.runx()` without any TLS protocol version constraints
+
+**Proof of concept**: The application starts with whatever TLS versions the underlying framework (Quart/Hypercorn) defaults to. Without explicit configuration, older TLS versions (TLS 1.0, TLS 1.1) may be negotiable depending on the runtime environment and library versions:
+```
+# An attacker can attempt handshake with deprecated TLS versions:
+openssl s_client -connect localhost:58383 -tls1_1
+```
+
+**Impact**: If the underlying TLS library allows deprecated TLS versions (TLS 1.0, TLS 1.1), the application may be vulnerable to known protocol-level attacks (BEAST, POODLE, etc.). Without explicit minimum version enforcement, there is no guarantee that only TLS 1.2+ is used. TLS 1.3 is not explicitly preferred.
+
+**Remediation**: Explicitly configure minimum TLS protocol version and prefer TLS 1.3. For Hypercorn (the ASGI server used in `run_asgi()`), configure via `hypercorn.toml` or programmatically:
+
+```python
+import ssl
+
+def create_ssl_context(certfile, keyfile):
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
+    ctx.maximum_version = ssl.TLSVersion.TLSv1_3
+    ctx.load_cert_chain(certfile, keyfile)
+    return ctx
+```
+
+For `config.yaml`, add:
+```yaml
+server:
+    min_tls_version: "1.2"
+```
+
+---
+
+### [MEDIUM]
+
+**Finding ID**: ASVS-1211-MED-001
+
+**File**: `v3/server/config.yaml.example`, lines 6-12
+
+**Vulnerable code:**
+```yaml
+server:
+    # Specify the .pem files to serve using TLS, or leave these two
+    # fields blank for plain HTTP. These files are relative to the
+    # "certs" subdirectory of main.py (the app), or they can be absolute
+    # paths to their installed location.
+    certfile: localhost.apache.org+3.pem
+    keyfile: localhost.apache.org+3-key.pem
+```
+
+**Impact**: The configuration template provides no guidance or fields for specifying TLS protocol versions. Administrators deploying this application have no documented mechanism to enforce TLS 1.2+ or prefer TLS 1.3.
+
+**Remediation**: Add TLS version configuration to the example config:
+```yaml
+server:
+    certfile: localhost.apache.org+3.pem
+    keyfile: localhost.apache.org+3-key.pem
+    min_tls_version: "1.2"  # Minimum TLS version (1.2 or 1.3)
+```
+
+### Security Controls Inventory for 12.1.1
+
+| Control | Location | Status |
+|---------|----------|--------|
+| TLS certificate loading | `main.py:75-78` | Present but incomplete |
+| TLS protocol version enforcement | N/A | **NOT PRESENT** |
+| TLS 1.3 preference configuration | N/A | **NOT PRESENT** |
+| SSL context creation | N/A | **NOT PRESENT** — relies on framework defaults |
+
+### Positive Patterns for 12.1.1
+
+- TLS is configured by default in the example configuration (cert/key specified)
+- Development quickstart guide directs users to use HTTPS (`https://localhost:58383/`)
+- Certificate files are stored in a dedicated `certs/` directory
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **TLS Configuration is Entirely Application-Agnostic**: The application treats TLS as an optional transport layer concern, passing cert/key paths to the framework without any security controls around protocol versions, cipher suites, or enforcement. This is a systemic design gap.
+
+2. **Dual Deployment Modes Create Inconsistency**: The standalone mode (`run_standalone()`) accepts TLS configuration via `config.yaml`, while the ASGI mode (`run_asgi()`) delegates all TLS to Hypercorn's external configuration. Neither mode enforces TLS or validates its presence.
+
+3. **No Security Headers Infrastructure**: There is no middleware or after-request hook for setting security-critical HTTP headers (HSTS, X-Content-Type-Options, etc.). This suggests TLS enforcement at the application layer has not been considered.
+
+4. **Development vs. Production Gap**: The development setup uses self-signed certificates (mkcert-generated `localhost.apache.org+3.pem`), which is appropriate for development but provides no path toward production TLS hardening (OCSP, ECH, cipher suite restrictions).
+
+5. **Proxy Assumption Undocumented**: The config comment mentions "a proxy sits in front of this server," but there is no documentation of required proxy TLS configuration, no `X-Forwarded-Proto` validation, and no deployment hardening guide.
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical/High Priority)
+
+1. **Enforce TLS as mandatory**: Remove the option to run without TLS. If plain HTTP is needed for development behind a proxy, require an explicit `--insecure` flag or environment variable.
+
+2. **Add TLS protocol version enforcement**: Create an SSL context with `minimum_version = TLSv1_2` for standalone mode. Document required Hypercorn TLS configuration for ASGI mode.
+
+3. **Implement HSTS**: Add `Strict-Transport-Security` header via after-request middleware to prevent protocol downgrade attacks.
+
+4. **Configure cipher suites**: Restrict to AEAD cipher suites with forward secrecy (ECDHE+AESGCM, ECDHE+CHACHA20).
+
+### Short-term (Medium Priority)
+
+5. **Document production TLS requirements**: Create a deployment guide specifying required TLS configuration for both standalone and proxy-fronted deployments.
+
+6. **Add HTTP→HTTPS redirect**: If port 80 is accessible, redirect all traffic to HTTPS.
+
+7. **Configure OCSP stapling**: For production deployments, configure either at the application level (if possible) or document proxy-level OCSP stapling requirements.
+
+8. **Add secure cookie attributes**: Ensure session cookies have `Secure`, `HttpOnly`, and `SameSite=Strict` flags.
+
+### Long-term (Low Priority)
+
+9. **Implement ECH**: Once Python/Hypercorn gains native ECH support, or document proxy-level ECH configuration (e.g., via Cloudflare or nginx with ECH patches).
+
+10. **Automated TLS testing**: Integrate TLS configuration testing (e.g., testssl.sh, sslyze) into CI/CD pipeline to detect configuration regressions.
+
+11. **Certificate management**: Implement automated certificate rotation, separate certificates per environment (as noted in the ASVS section description about wildcard certificates), and certificate expiry monitoring.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org