You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:27:01 UTC
[I] Make test email address conditional on test environment (tooling-trusted-releases)
andrewmusselman opened a new issue, #728:
URL: https://github.com/apache/tooling-trusted-releases/issues/728
**ASVS Reference:** 6.3.2 (Finding 3)
### Description
A test email address (`user-tests@tooling.apache.org`) is unconditionally included in permitted voting and announcement recipients in `atr/util.py` (line 91, lines ~531–550):
```python
USER_TESTS_ADDRESS: Final[str] = "user-tests@tooling.apache.org"
def permitted_voting_recipients(asf_uid: str, committee_name: str) -> list[str]:
return [
f"dev@{committee_name}.apache.org",
f"private@{committee_name}.apache.org",
USER_TESTS_ADDRESS, # Always included regardless of environment
f"{asf_uid}@apache.org",
]
```
This means sensitive vote information could be sent to the test address in production.
### Recommendation
Gate inclusion of `USER_TESTS_ADDRESS` behind `config.get().ALLOW_TESTS` for `alpha`-only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Make test email address conditional on test environment (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #728:
URL: https://github.com/apache/tooling-trusted-releases/issues/728#issuecomment-3930366425
The inclusion needs its own gate. It's not `ALLOW_TESTS`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Make test email address conditional on test environment (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #728: Make test email address conditional on test environment
URL: https://github.com/apache/tooling-trusted-releases/issues/728
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org