(tooling-agents) branch main updated: ASVS L1 audit: 1.5.1 (web_input_validation)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new d0736c1  ASVS L1 audit: 1.5.1 (web_input_validation)
d0736c1 is described below

commit d0736c19a7f7a096e7ee9cfce158799cef37336a
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue Apr 21 10:11:19 2026 +0200

    ASVS L1 audit: 1.5.1 (web_input_validation)
---
 .../steve/d0aa7e9/web_input_validation/1.5.1.md    | 248 +++++++++++++++++++++
 1 file changed, 248 insertions(+)

diff --git a/repos/apache/ASVS/reports/steve/d0aa7e9/web_input_validation/1.5.1.md b/repos/apache/ASVS/reports/steve/d0aa7e9/web_input_validation/1.5.1.md
new file mode 100644
index 0000000..f1a7f12
--- /dev/null
+++ b/repos/apache/ASVS/reports/steve/d0aa7e9/web_input_validation/1.5.1.md
@@ -0,0 +1,248 @@
+# ASVS 1.5.1 Security Audit Report
+
+## Executive Summary
+
+- **Repository:** apache/steve
+- **Audit Date:** Apr 21, 2026
+- **Auditor:** Tooling Agents
+- **ASVS Requirement:** 1.5.1 — Verify that the application configures XML parsers to use a restrictive configuration and that unsafe features such as resolving external entities are disabled to prevent XML eXternal Entity (XXE) attacks.
+- **ASVS Level:** 1
+- **Section:** Safe Deserialization
+- **Files Analyzed:** 20 relevant out of 20 total, 0 skipped
+
+### Finding Summary
+
+| Severity | Count |
+|----------|-------|
+| Critical | 0 |
+| High | 0 |
+| Medium | 0 |
+| Low | 0 |
+| **Total** | **0** |
+
+**Audit Result:** ✅ **NO CRITICAL FINDINGS** — ASVS 1.5.1 requirement is satisfied.
+
+---
+
+## Security Controls Inventory
+
+### XML Parsing Analysis — Coverage Map
+
+| File | XML Imports | XML Parsing Calls | Data Formats Used | Coverage Status |
+|------|-------------|-------------------|-------------------|-----------------|
+| `v3/server/api.py` | None | None | N/A | ✅ No XML exposure |
+| `v3/server/pages.py` | None | None | JSON (`get_json()`), HTML forms (`request.form`), EZT templates | ✅ No XML exposure |
+| `v3/steve/election.py` | None | None | JSON (`json.dumps`, `json.loads`), SQLite via `asfpy.db` | ✅ No XML exposure |
+| `v3/steve/persondb.py` | None | None | SQLite via `asfpy.db` | ✅ No XML exposure |
+| `v3/server/templates/*.ezt` | None | None | EZT (non-XML templating) | ✅ No XML exposure |
+
+**Purpose:** Identify all XML parsing operations and verify secure configuration.
+
+**Coverage Assessment:** Complete — all 20 files analyzed, zero XML parsing operations detected.
+
+---
+
+### Entry Point Data Parsing Inventory
+
+| Entry Point | HTTP Method | Input Parsing Method | XML Risk | Security Control |
+|-------------|-------------|----------------------|----------|------------------|
+| `/do-set-open_at/<eid>` | POST | `quart.request.get_json()` | None — JSON parser | ✅ JSON-only |
+| `/do-set-close_at/<eid>` | POST | `quart.request.get_json()` | None — JSON parser | ✅ JSON-only |
+| `/do-vote/<eid>` | POST | `quart.request.form` | None — form parser | ✅ Form data only |
+| `/do-create-election` | POST | `quart.request.form` | None — form parser | ✅ Form data only |
+| `/do-add-issue/<eid>` | POST | `quart.request.form` | None — form parser | ✅ Form data only |
+| `/do-edit-issue/<eid>/<iid>` | POST | `quart.request.form` | None — form parser | ✅ Form data only |
+| `/do-delete-issue/<eid>/<iid>` | POST | `quart.request.form` | None — form parser | ✅ Form data only |
+
+**Purpose:** Map all user input deserialization points to verify no XML processing occurs.
+
+**Coverage Assessment:** All HTTP endpoints reviewed — no XML content-type handling detected.
+
+---
+
+## Critical File Review
+
+### Core Application Files — Security-Sensitive Function Analysis
+
+| File | Functions Reviewed | XML Operations | Deserialization Methods | Security Status |
+|------|-------------------|----------------|-------------------------|-----------------|
+| `v3/server/pages.py` | `do_set_open_at()`, `do_set_close_at()`, `do_vote()`, `do_create_election()`, `do_add_issue()`, `do_edit_issue()`, `do_delete_issue()` | None | `get_json()` (lines ~200), `request.form` (multiple) | ✅ Secure |
+| `v3/steve/election.py` | `load()`, `save()`, `get_issue()`, `add_issue()`, `update_issue()`, `delete_issue()` | None | `json.loads()` (line ~302), `json.dumps()` (line ~308) | ✅ Secure |
+| `v3/steve/persondb.py` | Database query operations | None | SQLite via `asfpy.db` with YAML queries (line 22) | ✅ Secure |
+
+**All security-sensitive deserialization operations reviewed — no XML parsing detected.**
+
+---
+
+## Findings
+
+### Critical Severity
+**No critical findings identified.**
+
+### High Severity
+**No high severity findings identified.**
+
+### Medium Severity
+**No medium severity findings identified.**
+
+### Low Severity
+**No low severity findings identified.**
+
+---
+
+## Positive Security Patterns
+
+### 1. Complete Elimination of XML Attack Surface
+
+**Location:** Entire codebase  
+**Pattern:** Architecture uses exclusively non-XML data formats
+
+The application demonstrates defense-in-depth through attack surface elimination:
+
+- **API data exchange:** JSON via `quart.request.get_json()` (`v3/server/pages.py`, line ~200)
+- **Form submission:** URL-encoded form data via `quart.request.form` (`v3/server/pages.py`, multiple endpoints)
+- **Templating:** EZT engine — a non-XML template system (all `.ezt` files in `v3/server/templates/`)
+- **Database queries:** YAML-defined queries via `asfpy.db` with `queries.yaml` (`v3/steve/election.py`, line 30; `v3/steve/persondb.py`, line 22)
+- **Serialization:** `json.dumps()` / `json.loads()` for KV storage (`v3/steve/election.py`, lines ~302-308)
+
+**Security Impact:** This architecture eliminates XXE attack surface entirely — the strongest possible defense.
+
+---
+
+### 2. JSON-Only API Endpoints
+
+**Location:** `v3/server/pages.py`, lines ~200  
+**Pattern:** Structured data endpoints exclusively use JSON parsing
+
+The two endpoints accepting structured body data use Quart's JSON parser (based on Python's `json` module):
+
+```python
+# pages.py, line ~200
+data = await quart.request.get_json()
+date_str = data.get('date')
+```
+
+**Security Impact:** Python's `json` module is not vulnerable to XXE attacks. Even if an attacker sends `Content-Type: application/xml`, Quart's `get_json()` will not invoke an XML parser.
+
+---
+
+### 3. YAML for Configuration (Not XML)
+
+**Location:** `v3/steve/election.py`, line 30; `v3/steve/persondb.py`, line 22  
+**Pattern:** Query definitions use YAML format
+
+Database query definitions avoid XML entirely:
+
+```python
+# election.py, line 30
+QUERIES = THIS_DIR.parent / 'queries.yaml'
+```
+
+**Security Impact:** YAML parsers are not vulnerable to XXE attacks. This design choice prevents entire classes of XML-based vulnerabilities.
+
+---
+
+## Architecture Observations
+
+### 1. XML-Free Architecture
+The application has **zero dependencies** on XML parsing libraries (`xml.etree`, `xml.dom`, `xml.sax`, `lxml`, `defusedxml`, etc.). No XML-related imports were found in any of the 20 files analyzed. This represents the gold standard for XXE prevention — complete elimination of the attack vector.
+
+### 2. Framework-Level Protection
+The Quart framework does not automatically parse XML request bodies. The framework's content negotiation only handles:
+- JSON via `get_json()` 
+- Form data via `.form`
+- Raw bytes via `.data`
+
+Even if an attacker sends `Content-Type: application/xml`, no XML parser will be invoked by the application.
+
+### 3. REST-Only API Design
+The application exclusively uses REST-style endpoints with JSON and form data. No SOAP, XML-RPC, or other XML-based service protocols are implemented, further reducing attack surface.
+
+### 4. Secure Templating Engine
+EZT (Easy Templating) is used instead of XML-based templating engines (like XSLT). This prevents template injection attacks that could lead to XXE exploitation.
+
+---
+
+## Recommendations Summary
+
+### Immediate Actions (0-30 days)
+**No immediate actions required.** The application fully satisfies ASVS 1.5.1.
+
+### Short-term Improvements (1-3 months)
+**No short-term improvements required** for ASVS 1.5.1 compliance.
+
+### Long-term Strategic Initiatives (3-12 months)
+
+#### Maintain XML-Free Posture
+**Priority:** Medium (preventive)  
+**Effort:** Low (policy/review)
+
+**Recommendation:** Establish development guidelines to prevent introduction of XML parsing:
+
+1. **Code review checklist:** Flag any imports of `xml.*`, `lxml`, or XML-related libraries
+2. **Dependency monitoring:** Alert on addition of XML parsing dependencies
+3. **If XML is ever required** (e.g., for SAML integration, document processing, or SVG handling):
+   - Use `defusedxml` library instead of Python's standard `xml` libraries
+   - Configure parsers with external entity resolution disabled:
+     ```python
+     from defusedxml import ElementTree as ET
+     parser = ET.XMLParser()
+     parser.entity = {}  # Disable entity resolution
+     ```
+   - Validate all XML against strict schemas (XSD)
+   - Implement input size limits
+
+**Rationale:** Proactive prevention is more cost-effective than reactive remediation.
+
+---
+
+## Conclusion
+
+**ASVS 1.5.1 Compliance Status:** ✅ **FULLY COMPLIANT**
+
+The apache/steve application demonstrates exemplary security posture regarding XXE prevention through **complete elimination of XML processing**. All data deserialization uses JSON (`json` module) and URL-encoded form data (Quart built-in), neither of which is vulnerable to XXE attacks.
+
+**No remediation required.**
+
+The application's architecture represents the strongest possible defense against XXE vulnerabilities — not through configuration or filtering, but through complete absence of the attack vector.
+
+---
+
+## Appendix: Files Analyzed
+
+<details>
+<summary>Click to expand full file list (20 files)</summary>
+
+### Application Core
+- `v3/server/api.py` (relevance: 10/10)
+- `v3/server/pages.py` (relevance: 10/10)
+- `v3/steve/election.py` (relevance: 10/10)
+- `v3/steve/persondb.py` (relevance: 10/10)
+
+### Templates
+- `v3/server/templates/about.ezt` (relevance: 10/10)
+- `v3/server/templates/admin.ezt` (relevance: 10/10)
+- `v3/server/templates/e_bad_eid.ezt` (relevance: 10/10)
+- `v3/server/templates/e_bad_iid.ezt` (relevance: 10/10)
+- `v3/server/templates/e_bad_pid.ezt` (relevance: 10/10)
+- `v3/server/templates/flashes.ezt` (relevance: 10/10)
+- `v3/server/templates/footer.ezt` (relevance: 10/10)
+- `v3/server/templates/header.ezt` (relevance: 10/10)
+- `v3/server/templates/home.ezt` (relevance: 10/10)
+- `v3/server/templates/manage-stv.ezt` (relevance: 10/10)
+- `v3/server/templates/manage.ezt` (relevance: 10/10)
+- `v3/server/templates/privacy.ezt` (relevance: 10/10)
+- `v3/server/templates/profile.ezt` (relevance: 10/10)
+- `v3/server/templates/settings.ezt` (relevance: 10/10)
+- `v3/server/templates/vote-on.ezt` (relevance: 10/10)
+- `v3/server/templates/voter.ezt` (relevance: 10/10)
+
+**Analysis Methodology:** Static code analysis focusing on XML parsing library imports, deserialization operations, and data format handling across all application entry points and core business logic.
+
+</details>
+
+---
+
+**Report Generated:** Apr 21, 2026  
+**Audit Framework:** OWASP ASVS 4.0  
+**Analysis Scope:** ASVS 1.5.1 (XML Parser Configuration / XXE Prevention)
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org