You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by as...@apache.org on 2026/05/02 14:55:59 UTC
(tooling-agents) branch main updated: ASVS audit: 12.2.1.md (redacted)
This is an automated email from the ASF dual-hosted git repository.
asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git
The following commit(s) were added to refs/heads/main by this push:
new fdc42ca ASVS audit: 12.2.1.md (redacted)
fdc42ca is described below
commit fdc42cab59dce6ee893c2ea4ea514132154be213
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Sat May 2 16:55:24 2026 +0200
ASVS audit: 12.2.1.md (redacted)
---
.../245aad3/tls_external_communications/12.2.1.md | 328 +++++++++++++++++++++
1 file changed, 328 insertions(+)
diff --git a/ASVS/reports/mahout/245aad3/tls_external_communications/12.2.1.md b/ASVS/reports/mahout/245aad3/tls_external_communications/12.2.1.md
new file mode 100644
index 0000000..16e1117
--- /dev/null
+++ b/ASVS/reports/mahout/245aad3/tls_external_communications/12.2.1.md
@@ -0,0 +1,328 @@
+# ASVS 12.2.1 Security Audit Report: HTTPS Communication with External Facing Services
+
+## Executive Summary
+
+- **Repository:** apache/mahout
+- **Audit Date:** May 02, 2026
+- **Auditor:** Tooling Agents
+- **ASVS Requirement:** 12.2.1 — ASVS Requirement 12.2.1
+ - **Description:** Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.
+ - **Level:** 1
+ - **Section:** HTTPS Communication with External Facing Services
+ - **Section Description:** Ensure all HTTP traffic to external-facing services which the application exposes is sent encrypted, with publicly trusted certificates.
+ - **Chapter:** Secure Communication
+ - **Control Objective:** This chapter includes requirements related to the specific mechanisms that should be in place to protect data in transit, both between an end-user client and a backend service, as well as between internal and backend services.
+- **Files analyzed:** 2 relevant out of 2 total, 0 skipped
+
+**Finding Counts:**
+
+| Severity | Count |
+|----------|-------|
+| Critical | 0 |
+| High | 0 |
+| Medium | 1 |
+| Low | 0 |
+| **Total** | **1** |
+
+The audit evaluates whether all HTTP-based external connectivity uses TLS without fallback to insecure communications. Two files were analyzed: the Rust remote I/O module (`remote.rs`) handling S3/GCS cloud storage connections, and the Python AWS Braket backend (`amazon_braket_backend.py`) connecting to quantum computing services. One substantive finding was identified where environment-variable-driven configuration can disable TLS enforcement on cloud storage connections, directly viola [...]
+
+---
+
+## Security Controls Inventory
+
+| Control | Location | Defined? | Applied? | Enforced? | Coverage |
+|---------|----------|----------|----------|-----------|----------|
+| HTTPS for S3 | `remote.rs:build_store()` L78 | Implicit (library default) | Partially — `from_env()` can override | ❌ No — `AWS_ALLOW_HTTP` can disable | Gap |
+| HTTPS for GCS | `remote.rs:build_store()` L89 | Implicit (library default) | Partially — `from_env()` can override | ❌ No — env var can disable | Gap |
+| HTTPS for Braket API | `amazon_braket_backend.py:initialize_backend()` L35 | Implicit (boto3 default) | ✅ Yes — no custom endpoint exposed | ✅ Yes — boto3 enforces HTTPS for AWS endpoints | Full |
+| Certificate validation | Both files | Implicit (system trust stores) | ✅ Yes — default library behavior | ✅ Yes — default behavior | Full |
+| Credential protection in transit | Both files | Dependent on TLS enforcement | Partial (see findings) | Partial | Partial |
+
+---
+
+## Critical File Review
+
+### `qdp/qdp-core/src/remote.rs`
+
+| Function | External Connectivity | TLS Enforced? | Status |
+|----------|----------------------|---------------|--------|
+| `build_store("s3", ...)` | AWS S3 API | ❌ Overridable by `AWS_ALLOW_HTTP` | **Finding ASVS-1221-SEV-001** |
+| `build_store("gs", ...)` | Google Cloud Storage API | ❌ Overridable by env var | **Finding ASVS-1221-SEV-001** |
+| `download_to_tempfile()` | Delegates to `build_store` | Inherits from store | Inherits finding |
+| `resolve_path()` | Delegates to `download_to_tempfile` | Inherits | Inherits finding |
+
+### `qumat/amazon_braket_backend.py`
+
+| Function | External Connectivity | TLS Enforced? | Status |
+|----------|----------------------|---------------|--------|
+| `initialize_backend()` | AWS Braket API via boto3 | ✅ boto3 uses HTTPS by default; no `endpoint_url` override exposed | **Pass** |
+| `execute_circuit()` | AWS Braket API via `backend.run()` | ✅ Inherits from backend session | **Pass** |
+| `get_final_state_vector()` | AWS Braket API via `backend.run()` | ✅ Inherits from backend session | **Pass** |
+
+---
+
+## Findings
+
+### Medium Severity
+
+#### Finding ASVS-1221-SEV-001: Cloud Storage Client Allows HTTP Fallback via Environment Variables
+
+| Attribute | Value |
+|-----------|-------|
+| **Finding ID** | ASVS-1221-SEV-001 |
+| **Severity** | MEDIUM |
+| **Gap Type** | Type A — No control preventing TLS downgrade |
+| **File** | `qdp/qdp-core/src/remote.rs` |
+| **Function** | `build_store()` |
+| **Lines** | 78–100 |
+
+**Related Functions Checked:**
+- `download_to_tempfile()` — Delegates to `build_store`, inherits vulnerability
+- `resolve_path()` — Delegates to `download_to_tempfile`, inherits vulnerability
+- `parse_url()` — URL validation only, no TLS enforcement
+
+**Description:**
+
+The `build_store()` function constructs cloud storage clients (S3 and GCS) using environment-based configuration via `from_env()`. This pattern reads environment variables including `AWS_ALLOW_HTTP` and `GCS_ALLOW_HTTP`, which can disable TLS enforcement. When combined with custom endpoint URLs (`AWS_ENDPOINT`, `GCS_ENDPOINT`), the application will transmit all data over plain HTTP, including authentication credentials and sensitive payloads.
+
+**Vulnerable Code (S3):**
+```rust
+"s3" => {
+ let store = object_store::aws::AmazonS3Builder::from_env()
+ .with_bucket_name(bucket)
+ .build()
+ .map_err(|e| {
+ MahoutError::Io(format!(
+ "Failed to build S3 client for bucket '{}': {}",
+ bucket, e
+ ))
+ })?;
+ Ok(Arc::new(store))
+}
+```
+
+**Vulnerable Code (GCS):**
+```rust
+"gs" => {
+ let store = object_store::gcp::GoogleCloudStorageBuilder::from_env()
+ .with_bucket_name(bucket)
+ .build()
+ .map_err(|e| {
+ MahoutError::Io(format!(
+ "Failed to build GCS client for bucket '{}': {}",
+ bucket, e
+ ))
+ })?;
+ Ok(Arc::new(store))
+}
+```
+
+**Data Flow:**
+```
+Environment variable AWS_ALLOW_HTTP=true
+ → AmazonS3Builder::from_env() reads it
+ → ClientOptions.allow_http = true
+ → .build() creates client that permits HTTP
+ → download_to_tempfile() performs GET over plain HTTP
+ → AWS SigV4 auth headers + response data transmitted unencrypted
+```
+
+**Technical Explanation:**
+
+The `object_store` crate's `AmazonS3Builder::from_env()` reads the `AWS_ALLOW_HTTP` environment variable. When set to `true`, the built client permits plain HTTP connections. Combined with `AWS_ENDPOINT` pointing to an HTTP URL, all object storage traffic — including AWS SigV4 authentication signatures, request headers, and response payloads — transmits unencrypted. The same pattern applies to `GoogleCloudStorageBuilder::from_env()`.
+
+The test code at lines 200–208 explicitly demonstrates this capability:
+```rust
+/// AWS_ENDPOINT=http://localhost:9123 AWS_ALLOW_HTTP=true \
+/// cargo test -p qdp-core --features remote-io -- test_download_from_minio
+```
+
+While this is appropriate for local MinIO testing, the production `build_store` function shares the same code path with no mechanism to prevent HTTP in non-test environments.
+
+**Proof of Concept:**
+```bash
+# Attacker who can influence environment (e.g., shared CI/CD, container orchestration):
+export AWS_ALLOW_HTTP=true
+export AWS_ENDPOINT=http://attacker-proxy:8080
+# Application now sends S3 requests over plain HTTP through attacker's proxy
+# Attacker captures: AWS credentials (SigV4), quantum circuit data, model weights
+```
+
+**Impact:**
+- AWS/GCP credentials exposed in transit (SigV4 signatures, bearer tokens)
+- Quantum circuit intellectual property transmitted unencrypted over potentially untrusted networks (noted in domain context)
+- Downloaded scientific data (Parquet files, model weights) subject to tampering in transit
+- Violates ASVS 12.2.1 "does not fall back to insecure or unencrypted communications"
+
+**Remediation:**
+
+Explicitly enforce HTTPS after loading environment configuration:
+
+```rust
+fn build_store(scheme: &str, bucket: &str) -> Result<Arc<dyn ObjectStore>> {
+ match scheme {
+ "s3" => {
+ let store = object_store::aws::AmazonS3Builder::from_env()
+ .with_bucket_name(bucket)
+ .with_allow_http(false) // Enforce TLS regardless of AWS_ALLOW_HTTP
+ .build()
+ .map_err(|e| {
+ MahoutError::Io(format!(
+ "Failed to build S3 client for bucket '{}': {}",
+ bucket, e
+ ))
+ })?;
+ Ok(Arc::new(store))
+ }
+ "gs" => {
+ let store = object_store::gcp::GoogleCloudStorageBuilder::from_env()
+ .with_bucket_name(bucket)
+ .with_allow_http(false) // Enforce TLS regardless of environment
+ .build()
+ .map_err(|e| {
+ MahoutError::Io(format!(
+ "Failed to build GCS client for bucket '{}': {}",
+ bucket, e
+ ))
+ })?;
+ Ok(Arc::new(store))
+ }
+ _ => Err(MahoutError::InvalidInput(format!(
+ "Unsupported remote scheme '{}://'. Supported: {}",
+ scheme,
+ REMOTE_SCHEMES.join(", ")
+ ))),
+ }
+}
+```
+
+For integration tests requiring HTTP (MinIO), use a separate test-only builder or a feature flag:
+
+```rust
+#[cfg(test)]
+fn build_store_for_test(scheme: &str, bucket: &str) -> Result<Arc<dyn ObjectStore>> {
+ match scheme {
+ "s3" => {
+ let store = object_store::aws::AmazonS3Builder::from_env()
+ .with_bucket_name(bucket)
+ // Allow HTTP only in test builds
+ .build()
+ .map_err(|e| {
+ MahoutError::Io(format!(
+ "Failed to build S3 client for bucket '{}': {}",
+ bucket, e
+ ))
+ })?;
+ Ok(Arc::new(store))
+ }
+ _ => build_store(scheme, bucket),
+ }
+}
+```
+
+---
+
+## Positive Security Patterns
+
+### 1. boto3 Default HTTPS Enforcement (`amazon_braket_backend.py`)
+The Braket backend creates AWS sessions using only `region_name`, without exposing `endpoint_url` as a configurable parameter. This means boto3 always uses official AWS HTTPS endpoints. No mechanism exists in the application code to downgrade to HTTP.
+
+```python
+boto_session = boto3.Session(region_name=region)
+aws_session = AwsSession(boto_session=boto_session)
+```
+
+### 2. Environment-Based Credential Loading (Both Files)
+Both files follow the principle of configuration externalization for credentials:
+- `remote.rs`: `AmazonS3Builder::from_env()` and `GoogleCloudStorageBuilder::from_env()`
+- `amazon_braket_backend.py`: `boto3.Session()` with default credential chain
+
+No credentials are hardcoded in source code.
+
+### 3. URL Input Validation (`remote.rs`)
+The `parse_url` function validates cloud URLs thoroughly:
+- Rejects query parameters and fragments
+- Validates non-empty bucket and key components
+- Whitelists supported schemes (`s3://`, `gs://`)
+
+```rust
+if url.contains('?') || url.contains('#') {
+ return Err(MahoutError::InvalidInput(...));
+}
+```
+
+### 4. RAII Temp File Management (`remote.rs`)
+The `ResolvedPath` struct uses Rust's RAII pattern to ensure temp files are cleaned up:
+```rust
+pub struct ResolvedPath {
+ pub path: PathBuf,
+ _tempfile: Option<NamedTempFile>, // Dropped = file deleted
+}
+```
+
+### 5. Streaming Downloads (`remote.rs`)
+Large files are streamed chunk-by-chunk rather than buffered entirely in memory, preventing resource exhaustion:
+```rust
+while let Some(chunk) = stream.try_next().await ... {
+ tmpfile.write_all(&chunk) ...
+}
+```
+
+### 6. In-Process FFI Communication
+As noted in the domain context, Python-to-Rust communication occurs via FFI (PyO3), not over network, eliminating a category of TLS concerns for internal communication.
+
+---
+
+## Architecture Observations
+
+1. **TLS Delegation Pattern**: Both files delegate TLS handling entirely to underlying libraries (`object_store`, `boto3`). While these libraries have secure defaults, the application has no defense-in-depth layer to detect or prevent misconfigurations.
+
+2. **No Certificate Pinning**: Neither file implements certificate pinning for cloud service endpoints. For quantum circuit IP protection (mentioned in domain context), this means a compromised CA could issue rogue certificates. This is expected for library code but worth noting for high-value deployments.
+
+3. **No OCSP/CRL Checking**: Certificate revocation checking relies on underlying library and OS defaults. As noted in the domain context, no explicit OCSP stapling or revocation checking is configured.
+
+4. **No External Service Documentation**: The domain context notes "No documentation defines which external services are trusted or required." A service inventory would help audit TLS coverage comprehensively.
+
+5. **Consistent Credential Pattern**: Both AWS integrations (`object_store` for S3 and `boto3` for Braket) use environment-based credential chains, which is the recommended pattern.
+
+---
+
+## Recommendations Summary
+
+### Immediate Actions (Critical - Implement Within 1 Week)
+1. **Add `.with_allow_http(false)` to both S3 and GCS builders** in `build_store()` (Effort: Low, 2 lines)
+ - Eliminates HTTP fallback, directly addresses ASVS 12.2.1
+ - Prevents credential exposure and data tampering
+
+### Short-term Actions (High Priority - Implement Within 1 Month)
+2. **Create a separate test-only builder function** or feature flag for HTTP-capable MinIO testing (Effort: Low)
+ - Maintains test capability without weakening production security
+
+3. **Add integration test** that verifies `build_store` rejects HTTP endpoints (Effort: Low)
+ - Regression prevention for TLS enforcement
+
+4. **Document all external service dependencies** and their TLS requirements (Effort: Low)
+ - Enables comprehensive TLS coverage auditing
+ - Creates baseline for future security reviews
+
+### Long-term Actions (Medium Priority - Implement Within 3 Months)
+5. **Consider adding minimum TLS version enforcement** (TLS 1.2+) via `object_store` `ClientOptions` (Effort: Medium)
+ - Defense-in-depth against protocol downgrade
+ - Addresses ASVS 9.1.2/9.1.3 requirements
+
+---
+
+## Appendix: Files Analyzed
+
+<details>
+<summary>Click to expand file list (2 files)</summary>
+
+1. `qdp/qdp-core/src/remote.rs` (relevance: 10)
+ - Remote I/O module for cloud storage (S3/GCS)
+ - Contains HTTP fallback vulnerability
+
+2. `qumat/amazon_braket_backend.py` (relevance: 10)
+ - AWS Braket quantum computing backend
+ - Properly enforces HTTPS through boto3 defaults
+
+</details>
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org