You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by as...@apache.org on 2026/05/05 12:17:05 UTC
(tooling-agents) branch main updated: ASVS audit: 16.5.4.md (redacted)
This is an automated email from the ASF dual-hosted git repository.
asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git
The following commit(s) were added to refs/heads/main by this push:
new 33c68e6 ASVS audit: 16.5.4.md (redacted)
33c68e6 is described below
commit 33c68e62e5fcdf0f82c4200822c1320b873cd1ee
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:05:24 2026 +0200
ASVS audit: 16.5.4.md (redacted)
---
ASVS/reports/steve/v3/d0aa7e9/all/16.5.4.md | 213 ++++++++++++++++++++++++++++
1 file changed, 213 insertions(+)
diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/16.5.4.md b/ASVS/reports/steve/v3/d0aa7e9/all/16.5.4.md
new file mode 100644
index 0000000..d33cf61
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/16.5.4.md
@@ -0,0 +1,213 @@
+# Security Audit Report: ASVS 16.5.4
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 16.5.4 |
+| **Files Analyzed** | 8 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that a "last resort" error handler is defined which will catch all unhandled exceptions. This is both to avoid losing error details that must go to log files and to ensure that an error does not take down the entire application process, leading to a loss of availability.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠High | 2 |
+| 🟡 Medium | 1 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-16.5.4: Last Resort Error Handler
+
+### Findings for 16.5.4
+
+### [HIGH]
+**Finding ID**: ASVS-1654-HIGH-001
+
+**File**: `v3/server/pages.py` (entire file)
+**Function**: Application-wide (missing)
+
+**Vulnerable code quote**:
+```python
+# No global error handler defined anywhere in the file.
+# The file defines routes, helpers, and templates but no:
+# @APP.errorhandler(Exception)
+# @APP.errorhandler(500)
+# @APP.errorhandler(InternalServerError)
+```
+
+**Description**: The application does not define a "last resort" error handler that catches all unhandled exceptions. There is no `@APP.errorhandler(Exception)` or `@APP.errorhandler(500)` decorator in the codebase.
+
+Consequences:
+1. **Lost error details**: Unhandled exceptions may not be logged to the application's structured logging (they'll only appear in stderr if the process captures it).
+2. **Information disclosure**: Without a custom handler, Quart's default error response may include debug information depending on configuration.
+3. **Availability risk**: Depending on the ASGI server configuration, unhandled exceptions in specific request contexts could potentially affect other concurrent requests or the process health.
+
+The following exception paths are unhandled:
+- `sqlite3.OperationalError` (database locked/corrupt) in any endpoint
+- `KeyError` if session data is malformed in `basic_info()`
+- Any exception in `election.open()` called from `do_open_endpoint()`
+- `AssertionError` from `election.py` state checks (if assertions enabled)
+- `ElectionBadState` from `add_vote()` called via `do_vote_endpoint()`
+
+**Data flow**: Unhandled exception → Quart framework default handler → potential stack trace in response OR lost log entry
+
+**Proof of concept**:
+```
+# Trigger an ElectionBadState by voting on a closed election:
+POST /do-vote/CLOSED_ELECTION_EID
+Content-Type: application/x-www-form-urlencoded
+
+vote-some_iid=yes
+# The add_vote() raises ElectionBadState, which is not caught in do_vote_endpoint
+# Result: 500 response with framework default error page
+```
+
+**Impact**:
+- Error details are lost from structured logging
+- Potential information disclosure via stack traces
+- No guaranteed graceful recovery from unexpected errors
+- Application stability at risk from unhandled exception propagation
+
+**Remediation**:
+```python
+@APP.errorhandler(Exception)
+async def last_resort_error_handler(error):
+ """Catch-all error handler for unhandled exceptions."""
+ _LOGGER.exception(f'Unhandled exception: {type(error).__name__}')
+
+ # Return a generic error page
+ result = edict(title='Error', flashes=[], uid=None, name=None, email=None)
+ # Use a simple error template or generic response
+ return quart.Response(
+ '<html><body><h1>An unexpected error occurred</h1>'
+ '<p>Please try again later. If the problem persists, contact support.</p>'
+ '</body></html>',
+ status=500,
+ mimetype='text/html'
+ )
+
+@APP.errorhandler(404)
+async def handle_404(error):
+ """Custom 404 handler."""
+ _LOGGER.warning(f'404: {quart.request.path}')
+ return quart.Response(
+ '<html><body><h1>Page not found</h1></body></html>',
+ status=404,
+ mimetype='text/html'
+ )
+```
+
+### [MEDIUM]
+**Finding ID**: ASVS-1654-MED-001
+
+**File**: `v3/server/pages.py`, line 372
+**Function**: `do_vote_endpoint`
+
+**Vulnerable code quote**:
+```python
+@APP.post('/do-vote/<eid>')
+@asfquart.auth.require({R.committer})
+@load_election
+async def do_vote_endpoint(election):
+ result = await basic_info()
+ # ...
+ for iid, votestring in votes.items():
+ if iid not in issue_dict:
+ await flash_danger(f'Invalid issue ID: {iid}')
+ return quart.redirect(f'/vote-on/{election.eid}', code=303)
+
+ try:
+ election.add_vote(result.uid, iid, votestring)
+ # ...
+ except Exception as e:
+ _LOGGER.error(
+ f'Error adding vote for user[U:{result.uid}] on issue[I:{iid}]: {e}'
+ )
+ await flash_danger(f'Error submitting vote for issue {iid}.')
+ return quart.redirect(f'/vote-on/{election.eid}', code=303)
+```
+
+**Description**: While `do_vote_endpoint` has a try/except for individual votes, it logs `{e}` which includes the full exception message (potentially including `ElectionBadState` details). More importantly, if `election.list_issues()` or the form parsing throws an exception *before* the try/except block, it propagates unhandled. The missing global handler means these pre-loop errors would not be caught gracefully.
+
+**Impact**: Partial coverage—some errors within voting are caught but errors in setup/parsing may propagate unhandled.
+
+**Remediation**: Add the global error handler as described in ASVS-1654-HIGH-001.
+
+---
+
+### Security Controls Inventory for 16.5.4
+
+| Control | Location | Status |
+|---------|----------|--------|
+| Global exception handler (`@APP.errorhandler(Exception)`) | Not found | ABSENT |
+| Per-endpoint try/except | `do_vote_endpoint` line 400 | PARTIAL - only covers vote submission loop |
+| Custom 404 handler | `raise_404()` at line 647 | PARTIAL - only for specific cases, not a registered handler |
+| Framework default error handling | Quart defaults | UNVERIFIED - no custom configuration |
+
+### Positive Patterns for 16.5.4
+
+- `do_vote_endpoint` demonstrates awareness of the need to catch exceptions around sensitive operations, logging the error and returning a user-friendly message.
+- The `load_election` decorator catches `ElectionNotFound` and returns a proper 404 response.
+- Exception classes in `election.py` are well-structured with meaningful messages for logging purposes.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Security control existence vs. application gap (Type B)**: The most significant systemic issue is that security controls are *identified* (via `### check authz` comments and `assert` statements) but either not implemented or implemented using an unreliable mechanism (`assert`). This creates false confidence that security is handled.
+
+2. **Logging infrastructure immaturity**: The application generates good audit events but lacks the infrastructure to protect, transmit, and store those events securely. This is a foundational gap that affects multiple ASVS requirements.
+
+3. **Error handling philosophy inconsistency**: Some endpoints (like `do_vote_endpoint`) have try/except blocks while others (like `do_open_endpoint`, `do_close_endpoint`) have no error handling at all. There's no consistent strategy.
+
+4. **Single-tier architecture**: The application, database, and logs all reside on the same system/process. This means a compromise of any one component grants access to all others, including logs. A multi-tier or defense-in-depth approach is absent.
+
+5. **Admin tooling (`tally.py`) shares the same deficiencies**: The tally script uses `raise` to "fail hard" on errors, but has no structured error handling, no audit logging to a secure system, and outputs results directly to stdout where they could be captured or lost.
+
+6. **Assertion-based validation in a cryptographic voting system**: Using `assert` for state checks in a system designed to guarantee election integrity is a fundamental design flaw. The security model depends on state transitions being enforced, but the enforcement mechanism can be silently disabled.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical/High - address before deployment)
+
+1. **Replace all `assert` statements with proper exception raising** in `election.py`. Every `assert self.is_editable()`, `assert self.is_open()`, and `assert self.is_closed()` must be converted to `if not ...: raise ElectionBadState(...)`. This is the single highest-impact change.
+
+2. **Implement a global exception handler** (`@APP.errorhandler(Exception)`) that:
+ - Logs the full exception to the structured logger
+ - Returns a generic error page to the user
+ - Prevents stack trace disclosure
+
+3. **Implement authorization checks** at all `### check authz` locations. At minimum, verify the authenticated user owns the election for management operations.
+
+### Short-term (Medium - address within sprint)
+
+4. **Configure log transmission** to a logically separate system (remote syslog, centralized logging service, or at minimum a separate filesystem with restricted permissions).
+
+5. **Add database error handling** with graceful degradation. Wrap database operations in try/except for `sqlite3.OperationalError` and related exceptions.
+
+6. **Remove debug `print()` statements** from production endpoints.
+
+7. **Add log file protection**: If logs are stored locally, configure append-only permissions and ensure the application process cannot delete or modify existing log entries.
+
+### Long-term (Architecture improvements)
+
+8. **Implement a circuit breaker pattern** for database access, with health checks and graceful degradation.
+
+9. **Add log integrity verification**: Implement hash chaining or digital signatures on log entries to detect tampering.
+
+10. **Separate the logging infrastructure**: Deploy a dedicated log aggregation system (e.g., ELK stack, Loki, or cloud-native logging) that is network-isolated from the application.
+
+11. **Add comprehensive integration tests** that verify error handling paths, including simulated database failures and invalid state transitions.
+
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org