(tooling-agents) branch main updated: ASVS audit: 8.3.2.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 9ecfd89  ASVS audit: 8.3.2.md (redacted)
9ecfd89 is described below

commit 9ecfd892dcc3fe36f0d60ef3b6f6eae93c6a23be
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:10:14 2026 +0200

    ASVS audit: 8.3.2.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/8.3.2.md | 119 +++++++++++++++++++++++++++++
 1 file changed, 119 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/8.3.2.md b/ASVS/reports/steve/v3/d0aa7e9/all/8.3.2.md
new file mode 100644
index 0000000..83c3250
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/8.3.2.md
@@ -0,0 +1,119 @@
+# Security Audit Report: ASVS 8.3.2
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 8.3.2 |
+| **Files Analyzed** | 13 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that changes to values on which authorization decisions are made are applied immediately. Where changes cannot be applied immediately, (such as when relying on data in self-contained tokens), there must be mitigating controls to alert when a consumer performs an action when they are no…
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 1 |
+
+---
+
+## ASVS-8.3.2: Operation Level Authorization — Immediate Application of Changes
+
+### Findings for 8.3.2
+
+### [LOW]
+**Finding ID**: ASVS-832-LOW-001  
+**Title**: Election State Changes Take Effect Immediately but No Alerting for In-Flight Sessions  
+**File**: `v3/steve/election.py`, `close()` (line 109) and `v3/server/pages.py`, `do_vote_endpoint` (line 372)
+
+**Description**: When an election is closed via `election.close()`, the state change takes effect immediately in the database. Any subsequent call to `add_vote()` will properly reject the vote because `_all_metadata(self.S_OPEN)` will raise `ElectionBadState`.
+
+However, there is no mechanism to:
+- Alert users who currently have the voting page open that the election has been closed
+- Invalidate in-progress voting sessions
+- Notify voters whose ballots fail to submit due to timing
+
+**Code demonstrating immediate enforcement:**
+```python
+def add_vote(self, pid: str, iid: str, votestring: str):
+    # The Election should be open.
+    md = self._all_metadata(self.S_OPEN)  # Raises ElectionBadState if closed
+    ...
+```
+
+**Impact**: Low — the system correctly prevents unauthorized actions after state changes. The missing notification is a UX concern rather than a security vulnerability. Users will receive a server error rather than a graceful notification.
+
+**Note**: This is a Level 3 requirement. The current implementation satisfies the core requirement (immediate enforcement) but lacks the alerting component.
+
+### Security Controls Inventory for 8.3.2
+
+| Control | Location | Status |
+|---------|----------|--------|
+| Immediate state enforcement on vote | `add_vote()` → `_all_metadata(self.S_OPEN)` | ✅ Database lookup on every operation |
+| Immediate state enforcement on edit | `add_issue()` → `assert self.is_editable()` | ✅ Database lookup on every operation |
+| Real-time session invalidation on role change | External auth system | ⚠️ Depends on `asfquart.auth` implementation |
+| Voter eligibility change detection | `q_get_mayvote` per-vote lookup | ✅ Checked on each vote submission |
+
+### Positive Patterns for 8.3.2
+
+1. **Database-backed state checks on every operation**: Every mutating operation (`add_vote`, `add_issue`, `edit_issue`, `delete_issue`, `open`, `close`) re-reads state from the database rather than caching.
+2. **No local state caching**: The `Election` class does not cache metadata — each operation calls `_all_metadata()` which queries the database.
+3. **Immediate mayvote enforcement**: Adding/removing voter eligibility takes immediate effect since `q_get_mayvote` is queried per vote submission.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Authorization Architecture Gap (Type B Pattern)**: The application has a clear architectural intent for object-level authorization — the database schema includes `owner_pid` and `authz` columns, `q_owned` queries filter by PID, and `### check authz` comments exist at 8+ locations. However, NONE of these placeholder checks are implemented. This creates false confidence: developers and auditors see the comments and may assume authorization is handled.
+
+2. **Inconsistent Authorization Granularity**: 
+   - `/vote-on/<eid>` (GET) verifies voter eligibility via `q_find_issues`
+   - `/do-vote/<eid>` (POST) does NOT verify voter eligibility before attempting the vote
+   - `/serve_doc/<iid>/<docname>` (GET) properly checks `q_get_mayvote`
+   - Management endpoints check NOTHING beyond role
+
+3. **GET for State Changes**: Using HTTP GET for `do-open` and `do-close` violates REST semantics and eliminates CSRF protection even if tokens were properly implemented (CSRF tokens protect POST/PUT/DELETE, not GET).
+
+4. **Placeholder Security Controls**: The CSRF token system illustrates a dangerous anti-pattern — templates include tokens, JavaScript sends them in headers, but the server never validates them. This provides zero actual security while appearing secure during code review.
+
+5. **Assertion-Based State Enforcement**: The `election.py` model uses Python `assert` statements for state checks. While these work in development, `assert` statements are removed when Python runs with optimization (`-O` flag). Production deployments MUST NOT use `-O` or these security checks disappear silently.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical — Address Before Production)
+
+1. **Implement Object-Level Authorization**: Add ownership/authz checks in `load_election` and `load_election_issue` decorators. Compare `election.owner_pid` against `result.uid` (or check `election.authz` group membership).
+
+2. **Implement CSRF Protection**: Replace the placeholder token with real per-session tokens. Add server-side validation in a `@before_request` handler or decorator for all POST endpoints.
+
+3. **Change `do-open`/`do-close` to POST**: These perform irreversible state changes and must not be accessible via GET requests.
+
+4. **Add Eligibility Check to `do_vote_endpoint`**: Replicate the `q_find_issues` check from `vote_on_page` before processing votes.
+
+### Short-term (High Priority)
+
+5. **Replace `assert` with Explicit Checks**: Replace `assert self.is_editable()` patterns with explicit `if not self.is_editable(): raise ElectionBadState(...)` to ensure enforcement regardless of Python optimization flags.
+
+6. **Add Comprehensive Access Logging**: Log authorization denials (not just successful actions) to support security monitoring.
+
+7. **Validate `docname` in `serve_doc`**: While `send_from_directory` likely prevents path traversal, add explicit validation per the code comment (`### verify the propriety of DOCNAME`).
+
+### Long-term (Architecture Enhancement)
+
+8. **Implement Adaptive Controls**: For Level 3 compliance, add IP/device tracking to sessions with re-authentication on context changes.
+
+9. **Centralize Authorization Logic**: Create a dedicated authorization module rather than scattering checks across decorators and handlers. Consider a policy-based approach (e.g., checking owner, authz group, and election state in one call).
+
+10. **Add Real-Time State Notifications**: Implement WebSocket or polling to notify active voting sessions when an election closes, preventing wasted user effort.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org