(tooling-agents) branch main updated: ASVS L1 audit: issues (redacted) [source: apache/logging-log4net @ f57d7b3]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 20258e1  ASVS L1 audit: issues (redacted) [source: apache/logging-log4net @ f57d7b3]
20258e1 is described below

commit 20258e13acf6baf0a06befec348f68eb62e7e13c
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 19 19:04:48 2026 +0200

    ASVS L1 audit: issues (redacted) [source: apache/logging-log4net @ f57d7b3]
---
 ASVS/reports/logging-log4net/f57d7b3/issues.md | 289 +++++++++++++++++++++++++
 1 file changed, 289 insertions(+)

diff --git a/ASVS/reports/logging-log4net/f57d7b3/issues.md b/ASVS/reports/logging-log4net/f57d7b3/issues.md
new file mode 100644
index 0000000..6f8ac35
--- /dev/null
+++ b/ASVS/reports/logging-log4net/f57d7b3/issues.md
@@ -0,0 +1,289 @@
+# Security Issues
+
+---
+## Issue: FINDING-002 - Runtime Log Event Data Flows into SQL Command Text Without Parameterization in Fallback Path
+**Labels:** bug, security, priority:high
+**Description:**
+### Summary
+Untrusted runtime log data (LoggingEvent.Message, Exception, ThreadName, etc.) flows through Layout.Format() into logStatement string which is set as dbCmd.CommandText and executed via ExecuteNonQuery() with no parameterization or sanitization.
+
+### Details
+- **CWE:** CWE-89 (SQL Injection)
+- **ASVS Section:** 2.2.1 (Level L1)
+- **Affected File:** `src/log4net/Appender/AdoNetAppender.cs`
+
+This vulnerability occurs specifically in the fallback path when CommandText is null or empty. The GetLogStatement method constructs SQL from log data without any validation or parameterization controls.
+
+### Remediation
+- Add validation to warn or block the unsafe path
+- Consider deprecating the GetLogStatement fallback path
+- Mark it [Obsolete] with guidance to use the parameterized CommandText + AddParameter approach
+- Implement runtime checks that prevent execution of unparameterized SQL containing user data
+
+### Acceptance Criteria
+- [ ] Fixed - Fallback path secured or removed
+- [ ] Test added - Validation tests for input handling
+- [ ] Migration guide provided for users currently using Layout-based SQL
+
+### References
+- Related Finding: FINDING-001
+- Source Report: 2.2.1.md
+
+### Priority
+**High** - Active input validation bypass leading to SQL injection
+
+---
+## Issue: FINDING-003 - PatternLayout performs no context-aware output encoding for user-controlled data
+**Labels:** bug, security, priority:medium
+**Description:**
+### Summary
+PatternLayout performs no context-aware output encoding for user-controlled data rendered into structured output formats (HTML, XML, JSON). This violates ASVS 1.2.1 requirements for context-appropriate output encoding.
+
+### Details
+- **CWE:** CWE-116 (Improper Encoding or Escaping of Output)
+- **ASVS Section:** 1.2.1 (Level L1)
+- **Affected File:** `src/log4net/Layout/PatternLayout.cs`
+
+Exploitation requires:
+- Deployment manager to configure HTML-structured patterns
+- Untrusted external input to be logged
+- Log output consumed by HTML-rendering systems
+
+Risk is limited in Apache Airflow's threat model where DAG authors are trusted, but creates vulnerability in edge cases with external untrusted input.
+
+### Remediation
+- Add a ContentEncoding property to PatternLayout
+- Provide encoding-aware pattern converters that encode output based on target context (HTML, XML, JSON, etc.)
+- Implement context-specific encoding functions for:
+  - HTML elements
+  - HTML attributes
+  - HTML comments
+  - CSS
+  - HTTP header fields
+
+### Acceptance Criteria
+- [ ] Fixed - Context-aware encoding implemented
+- [ ] Test added - Encoding tests for each supported context
+- [ ] Documentation includes configuration examples for safe HTML/XML/JSON output
+
+### References
+- Related Finding: FINDING-004
+- Source Report: 1.2.1.md
+
+### Priority
+**Medium** - Output encoding vulnerability with limited exploitation scope
+
+---
+## Issue: FINDING-004 - SmtpAppender does not explicitly control IsBodyHtml
+**Labels:** bug, security, priority:low
+**Description:**
+### Summary
+SmtpAppender does not explicitly set IsBodyHtml, relying on .NET default (false). This creates ambiguity when administrators configure HTML-producing layouts, as some email clients perform content sniffing and may render detected HTML regardless of MIME type.
+
+### Details
+- **CWE:** CWE-116 (Improper Encoding or Escaping of Output)
+- **ASVS Section:** 1.2.1 (Level L1)
+- **Affected File:** `src/log4net/Appender/SmtpAppender.cs`
+
+The mismatch between declared MIME type (text/plain) and actual content (HTML) creates a risk that output encoding expectations may not align with actual rendering behavior, potentially allowing HTML injection if log messages contain untrusted data.
+
+### Remediation
+- Explicitly set IsBodyHtml = false in SmtpAppender.SendEmail()
+- Expose IsBodyHtml as a configuration property
+- When IsBodyHtml is true, ensure that the layout performs appropriate HTML encoding
+- Document the relationship between IsBodyHtml and layout encoding requirements to prevent misconfiguration
+
+### Acceptance Criteria
+- [ ] Fixed - IsBodyHtml property exposed and explicitly controlled
+- [ ] Test added - Configuration tests for HTML vs plain text modes
+- [ ] Documentation clarifies encoding requirements for each mode
+
+### References
+- Related Finding: FINDING-003
+- Source Report: 1.2.1.md
+
+### Priority
+**Low** - Configuration ambiguity with potential security implications
+
+---
+## Issue: FINDING-005 - MaxFileSize Property Accepts Zero or Negative Values Without Validation
+**Labels:** bug, security, priority:low
+**Description:**
+### Summary
+Setting MaxFileSize to 0 via configuration causes RollOverSize() to be called on every single log event, creating a file for each log message and potentially exhausting directory entries or file handles.
+
+### Details
+- **CWE:** CWE-1284 (Improper Validation of Specified Quantity in Input)
+- **ASVS Section:** 2.2.1 (Level L1)
+- **Affected File:** `src/log4net/Appender/RollingFileAppender.cs`
+
+Since Count >= 0 is always true after any write, a MaxFileSize of 0 causes pathological rolling behavior that can lead to resource exhaustion.
+
+### Remediation
+Add lower-bound validation for MaxFileSize in ActivateOptions() to:
+- Reject zero or negative values
+- Set a reasonable minimum threshold (e.g., 1KB)
+- Log a warning if configured value is below recommended minimum
+- Provide clear error messages explaining valid ranges
+
+### Acceptance Criteria
+- [ ] Fixed - Input validation added for MaxFileSize
+- [ ] Test added - Validation tests for boundary values
+- [ ] Error messages guide users to valid configuration
+
+### References
+- Source Report: 2.2.1.md
+
+### Priority
+**Low** - Resource exhaustion via misconfiguration
+
+---
+## Issue: FINDING-006 - Numeric Configuration Properties Lack Documented Validation Rules
+**Labels:** bug, security, priority:low
+**Description:**
+### Summary
+Security-sensitive numeric configuration properties lack formal documentation of valid value ranges, boundary behavior, and performance implications. This creates risk of misconfiguration leading to resource exhaustion or unexpected behavior.
+
+### Details
+- **CWE:** CWE-1059 (Incomplete Documentation)
+- **ASVS Section:** 2.1.1 (Level L1)
+- **Affected File:** `src/log4net/Appender/RollingFileAppender.cs`
+
+Missing documentation for:
+- Minimum/maximum acceptable values for MaxFileSize
+- Performance implications of specific MaxSizeRollBackups values combined with CountDirection
+- Valid ranges for the Size property on AdoNetAppenderParameter
+- Bounds for BufferSize
+
+While XML doc comments describe valid value ranges informally, there is no formal schema or comprehensive documentation.
+
+### Remediation
+Add explicit documentation covering:
+- Valid value ranges for each numeric property
+- Boundary behavior (what happens at min/max values)
+- Performance implications of extreme values
+- Security considerations for resource-constrained environments
+- Recommended values for common scenarios
+
+### Acceptance Criteria
+- [ ] Fixed - Comprehensive documentation added
+- [ ] Test added - Documentation validation tests
+- [ ] Schema or validation rules published
+
+### References
+- Related Finding: FINDING-008
+- Source Report: 2.1.1.md
+
+### Priority
+**Low** - Documentation gap affecting secure configuration
+
+---
+## Issue: FINDING-007 - Missing IsBodyHtml Configuration Causes Potential Content-Type Mismatch
+**Labels:** bug, security, priority:low
+**Description:**
+### Summary
+The SmtpAppender does not expose the IsBodyHtml property, preventing administrators from correctly declaring HTML content type when using HTML-producing layouts. This creates a MIME type mismatch where HTML content is declared as text/plain.
+
+### Details
+- **ASVS Section:** 4.1.1 (Level L1)
+- **Affected File:** `src/log4net/Appender/SmtpAppender.cs`
+
+The missing configuration option prevents proper content type declaration, potentially leading to:
+- Inconsistent rendering across email clients
+- Security warnings in email clients
+- Failure to apply appropriate security policies for HTML content
+
+### Remediation
+Add an IsBodyHtml property to SmtpAppender to:
+- Allow administrators to explicitly declare HTML content type
+- Ensure MIME type matches actual content
+- Enable email clients to apply appropriate security policies
+- Provide clear configuration examples for both text and HTML modes
+
+### Acceptance Criteria
+- [ ] Fixed - IsBodyHtml property exposed as configuration option
+- [ ] Test added - Tests for both HTML and plain text modes
+- [ ] Documentation includes configuration examples
+
+### References
+- Source Report: 4.1.1.md
+
+### Priority
+**Low** - Content type mismatch with security policy implications
+
+---
+## Issue: FINDING-008 - SecurityContext Documentation Lacks Explicit Security Implications
+**Labels:** bug, security, priority:low
+**Description:**
+### Summary
+The XML documentation for WindowsSecurityContext describes functionality but does not document security implications, usage constraints, or best practices. This may lead developers to implement authorization controls without understanding required security constraints.
+
+### Details
+- **CWE:** CWE-1059 (Incomplete Documentation)
+- **ASVS Section:** 8.1.1 (Level L1)
+- **Affected File:** `src/log4net/Util/WindowsSecurityContext.cs`
+
+Missing documentation for:
+- Security implications of storing credentials in configuration
+- Principle of minimal impersonation duration
+- Guidance on minimal privileges
+- Risks of ImpersonationMode.Process
+- LOGON32_LOGON_INTERACTIVE creates a token with full network credentials
+
+### Remediation
+Add security guidance to XML documentation covering:
+- Principle of least privilege for impersonated accounts
+- Minimal impersonation duration best practices
+- Configuration file protection requirements
+- Implications of each ImpersonationMode
+- Warnings about credential storage risks
+- Network credential exposure with LOGON32_LOGON_INTERACTIVE
+- Process-wide impersonation risks with ImpersonationMode.Process
+
+### Acceptance Criteria
+- [ ] Fixed - Comprehensive security documentation added
+- [ ] Test added - Documentation completeness validation
+- [ ] Security best practices guide published
+
+### References
+- Related Finding: FINDING-006
+- Source Report: 8.1.1.md
+
+### Priority
+**Low** - Documentation gap for security-sensitive feature
+
+---
+## Issue: FINDING-009 - Rolling State Machine Advances Past Failed Steps Without Verification
+**Labels:** bug, security, priority:low
+**Description:**
+### Summary
+The rolling state machine advances through its steps (rename backups → reset state → open new file) without verifying that file rename operations completed successfully. This can cause the internal counter to become desynchronized from actual filesystem state.
+
+### Details
+- **ASVS Section:** 2.3.1 (Level L1)
+- **Affected File:** `src/log4net/Appender/RollingFileAppender.cs`
+
+The RollFile method catches all exceptions internally and reports them via ErrorHandler but does not return success/failure status to the caller. Consequently, CurrentSizeRollBackups is reset or incremented unconditionally, even when file operations fail.
+
+This can lead to:
+- Lost log data if new file creation fails silently
+- Incorrect backup file numbering
+- Unexpected behavior when MaxSizeRollBackups is reached
+
+### Remediation
+- Track success/failure of RollFile operations
+- Adjust CurrentSizeRollBackups only for confirmed successful renames
+- Introduce a TryRollFile helper that returns a boolean success status
+- Implement retry logic or fallback behavior for failed operations
+- Log clear warnings when rolling operations fail
+
+### Acceptance Criteria
+- [ ] Fixed - State machine verifies operation success before advancing
+- [ ] Test added - Failure scenario tests for file operations
+- [ ] Error handling improved with clear diagnostics
+
+### References
+- Source Report: 2.3.1.md
+
+### Priority
+**Low** - Business logic flaw affecting reliability
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org