(tooling-agents) branch main updated: ASVS audit: 3.7.5.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new ed28b14  ASVS audit: 3.7.5.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
ed28b14 is described below

commit ed28b144259e22451bfe8069d75faedc3055217a
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:56:09 2026 +0200

    ASVS audit: 3.7.5.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/3.7.5.md | 171 +++++++++++++++++++++++++++++
 1 file changed, 171 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/3.7.5.md b/ASVS/reports/steve/v3/d0aa7e9/all/3.7.5.md
new file mode 100644
index 0000000..0df5ff9
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/3.7.5.md
@@ -0,0 +1,171 @@
+# Security Audit Report: ASVS 3.7.5
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 3.7.5 |
+| **Files Analyzed** | 9 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the application behaves as documented (such as warning the user or blocking access) if the browser used to access the application does not support the expected security features.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 1 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-3.7.5: Browser Security Feature Detection
+
+### Findings for 3.7.5
+
+### [MEDIUM] ASVS-375-MED-001
+**Finding: No Browser Security Feature Detection or Fallback Mechanism**
+
+- **File:** `v3/server/templates/vote-on.ezt`, `v3/server/static/js/steve.js`, and all template files
+- **Location:** Client-side code across all templates
+
+**Vulnerable code quote:**
+```html
+<!-- vote-on.ezt: SortableJS loaded with no feature detection -->
+<script src="/static/js/Sortable.min.js"
+        integrity="sha384-DgmC6Xe2bSN2WjTDXzWYbUbxyhNP+NNkGDR/g78pCXV7E7rcVTGxVg0uIVCUUcBc"
+        crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+```
+
+```javascript
+// steve.js - Uses modern APIs without feature checks
+function showModal(modalId) {
+  const modal = new bootstrap.Modal(document.getElementById(modalId));
+  modal.show();
+  return modal;
+}
+```
+
+```javascript
+// vote-on.ezt - Uses drag-and-drop, Array.from, template literals without checks
+window.openSTVModal = function (iid) {
+    // ...
+    const alreadyRanked = hidden.value
+      ? hidden.value.split(',').map(s => s.trim()).filter(Boolean)
+      : [];
+    // ...
+};
+```
+
+- **Data flow:** User accesses voting page with older browser → JavaScript fails silently → User cannot submit votes or interact with STV ranking → No warning displayed → Potential disenfranchisement
+- **Proof of concept:** A user accessing the application with IE11 or an older mobile browser would see a broken voting interface (no drag-and-drop, no modals) with no explanation of why features are unavailable.
+- **Impact:** For a voting application, this is particularly serious. Users may be silently unable to cast votes, potentially affecting election outcomes. The application's critical function (secure voting) depends on JavaScript features (SortableJS drag-and-drop, Bootstrap modals, `fetch()` API) without any graceful degradation or user notification.
+- **Gap Type:** Type A — No feature detection control exists.
+
+**Remediation:**
+```html
+<!-- Add to header.ezt or a base template -->
+<noscript>
+  <div class="alert alert-danger">
+    This application requires JavaScript to function. Please enable JavaScript in your browser.
+  </div>
+</noscript>
+
+<script>
+(function() {
+  'use strict';
+  // Check for required features
+  var requiredFeatures = {
+    'Fetch API': typeof window.fetch !== 'undefined',
+    'ES6 Classes': typeof Symbol !== 'undefined',
+    'CSS Grid': CSS.supports && CSS.supports('display', 'grid'),
+    'Drag and Drop': 'draggable' in document.createElement('div'),
+  };
+  
+  var missing = [];
+  for (var feature in requiredFeatures) {
+    if (!requiredFeatures[feature]) missing.push(feature);
+  }
+  
+  if (missing.length > 0) {
+    document.body.innerHTML = '<div class="alert alert-danger m-4">' +
+      '<h4>Unsupported Browser</h4>' +
+      '<p>Your browser does not support the following required features:</p>' +
+      '<ul>' + missing.map(function(f) { return '<li>' + f + '</li>'; }).join('') + '</ul>' +
+      '<p>Please update your browser to use this voting system.</p></div>';
+  }
+})();
+</script>
+```
+
+### Security Controls Inventory for 3.7.5
+
+| Control | Location | Coverage Status |
+|---------|----------|----------------|
+| Browser Feature Detection | Not found | **MISSING** |
+| Unsupported Browser Warning | Not found | **MISSING** |
+| Graceful Degradation | Not found | **MISSING** |
+| `<noscript>` Fallback | Not found | **MISSING** |
+| SRI on External Scripts | `vote-on.ezt` line with SortableJS | Present (positive) |
+
+### Positive Patterns for 3.7.5
+
+- Subresource Integrity (SRI) is used for SortableJS: `integrity="sha384-..."` — this ensures the loaded script hasn't been tampered with.
+- The `crossorigin="anonymous"` and `referrerpolicy="no-referrer"` attributes show security awareness for external resource loading.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **CSRF Protection is Completely Non-Functional:** The `basic_info()` function sets `basic.csrf_token = 'placeholder'` (line 83). This value is rendered in templates and sent in `X-CSRFToken` headers, but **no server-side validation exists**. This is a Type B gap (control exists in UI but is never validated), creating false confidence. All state-changing endpoints are vulnerable to CSRF, compounded by the GET-method issue on open/close.
+
+2. **Authorization Gaps (Pervasive):** Multiple `### check authz` placeholders indicate that fine-grained authorization (e.g., "is this user the owner of this election?") is NOT implemented. Any authenticated committer can manage/open/close any election. This is explicitly acknowledged in code comments but represents a critical security gap for a voting system.
+
+3. **Defense-in-Depth Layers Missing:** The application lacks:
+   - Security response headers (CSP, X-Content-Type-Options, X-Frame-Options)
+   - Rate limiting
+   - Request size limits
+   - Audit trail integrity
+
+4. **Deployment Architecture Dependency:** The config comment "a proxy sits in front of this server" means some controls (HSTS, HTTP→HTTPS redirect, proxy header trust) might be implemented at the infrastructure layer. However, the application provides no documentation, verification, or enforcement of these assumptions.
+
+5. **Template vs API Endpoint Confusion:** The application mixes template-rendered pages with JSON API endpoints (`/do-set-open_at`, `/do-set-close_at`) without clear architectural separation. This makes it difficult to apply appropriate security policies (Content-Type, redirect behavior, CORS) per endpoint type.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical — must fix before production)
+1. **Implement CSRF protection:** Replace `'placeholder'` token with a cryptographically random token tied to the session. Validate on all POST endpoints. Consider using `quart-csrf` or similar library.
+2. **Change `/do-open` and `/do-close` to POST methods** to prevent CSRF via GET and accidental triggering by prefetchers/crawlers.
+3. **Add HSTS header with preload directive** and submit domain to hstspreload.org.
+4. **Add charset to all responses:** Fix `raise_404()` and add an `after_request` handler ensuring all `text/*` responses include `; charset=utf-8`.
+
+### Short-term (High — fix within current sprint)
+5. **Configure trusted proxy headers:** Add Hypercorn `forwarded_allow_ips` or application-level middleware to prevent header spoofing.
+6. **Implement HTTP rejection for API endpoints:** Non-browser endpoints should return 403 on HTTP rather than redirecting.
+7. **Add browser feature detection:** Implement client-side checks that warn users if their browser cannot support the voting interface.
+8. **Add security headers via `after_request` middleware:**
+   ```python
+   @app.after_request
+   async def security_headers(response):
+       response.headers['X-Content-Type-Options'] = 'nosniff'
+       response.headers['X-Frame-Options'] = 'DENY'
+       response.headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload'
+       response.headers['Content-Security-Policy'] = "default-src 'self'"
+       return response
+   ```
+
+### Long-term (Medium — plan for next release)
+9. **Implement fine-grained authorization** (replace all `### check authz` placeholders) — verify election ownership before allowing management operations.
+10. **Architectural separation:** Create distinct middleware chains for browser-facing pages vs. JSON API endpoints with different security policies.
+11. **Document deployment requirements:** Create a security deployment guide specifying required proxy configuration, TLS requirements, and header trust settings.
+12. **Add integration tests** that verify security headers, method restrictions, and CSRF protection are functioning correctly in the deployed configuration.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org