(tooling-agents) branch main updated: ASVS audit: 15.1.3.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new a055df0  ASVS audit: 15.1.3.md (redacted)
a055df0 is described below

commit a055df03e9aa73ba79339540923559447dbb91b2
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:04:16 2026 +0200

    ASVS audit: 15.1.3.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/15.1.3.md | 142 ++++++++++++++++++++++++++++
 1 file changed, 142 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/15.1.3.md b/ASVS/reports/steve/v3/d0aa7e9/all/15.1.3.md
new file mode 100644
index 0000000..1dd5b51
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/15.1.3.md
@@ -0,0 +1,142 @@
+# Security Audit Report: ASVS 15.1.3
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 15.1.3 |
+| **Files Analyzed** | 14 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the application documentation identifies functionality which is time-consuming or resource-demanding. This must include how to prevent a loss of availability due to overusing this functionality and how to avoid a situation where building a response takes longer than the consumer's…
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 1 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-15.1.3: Secure Coding and Architecture Documentation - Resource-Demanding Functionality
+
+### Findings for 15.1.3
+
+### [MEDIUM]
+
+**Finding ID**: ASVS-1513-MED-001
+**Location**: Project-wide documentation (`v3/ARCHITECTURE.md`, `v3/TODO.md`)
+**Issue**: Incomplete documentation of time-consuming/resource-demanding functionality and mitigation strategies
+
+**Evidence**:
+
+The `tally.md` runbook partially addresses this:
+```markdown
+- **Performance**: Tallying is intentionally slow due to cryptographic operations to protect voter privacy. Do not expect web-like response times; run in a background process if needed.
+```
+
+However, the following resource-demanding operations accessible via **web endpoints** are NOT documented with availability mitigation strategies:
+
+1. **`add_vote()` in `election.py`** (line 231): Uses Argon2 key derivation for each vote submission, deliberately slow:
+```python
+def add_vote(self, pid: str, iid: str, votestring: str):
+    md = self._all_metadata(self.S_OPEN)
+    mayvote = self.q_get_mayvote.first_row(pid, iid)
+    vote_token = crypto.gen_vote_token(md.opened_key, pid, iid, mayvote.salt)
+    ciphertext = crypto.create_vote(vote_token, mayvote.salt, votestring)
+    self.c_add_vote.perform(vote_token, ciphertext)
+```
+
+2. **`open()` in `election.py`** (line 70): Generates salts for ALL mayvote rows + Argon2 key derivation, exposed via `GET /do-open/<eid>`:
+```python
+def open(self, pdb):
+    assert self.is_editable()
+    self.add_salts()  # Iterates ALL mayvote rows with crypto operations
+    edata = self.gather_election_data(pdb)
+    salt = crypto.gen_salt()
+    opened_key = crypto.gen_opened_key(edata, salt)  # Argon2
+```
+
+3. **`has_voted_upon()` in `election.py`** (line 300): Iterates all issues computing vote tokens (Argon2 for each).
+
+**Missing documentation**: No documentation identifies:
+- How to prevent availability loss from repeated vote submissions (no rate limiting)
+- How to handle elections with large numbers of voters/issues during `open()` (no timeout strategy)
+- Consumer timeout considerations for Argon2-heavy endpoints
+- Defenses such as async processing, queues, or per-user rate limits
+
+**Impact**: Without documented and implemented strategies, an attacker could cause availability loss by repeatedly triggering Argon2 operations via `/do-vote/<eid>` or triggering `open()` on elections with many voters.
+
+**Remediation**: Create a dedicated "Performance & Availability" section in ARCHITECTURE.md documenting:
+1. All endpoints that use Argon2 or iterate large datasets
+2. Expected response times under load
+3. Mitigations: rate limiting per user, async processing for `open()`, queue-based vote processing, max parallel requests
+
+---
+
+### Security Controls Inventory for 15.1.3
+
+| Control | Location | Coverage |
+|---------|----------|----------|
+| Tally as CLI-only (not web) | `tally.py`, `tally.md` | Documented, effective |
+| Performance monitoring | `asfpy.stopwatch.Stopwatch()` in `pages.py` line 147 | Present but not documented as mitigation |
+| Authentication requirement | `@asfquart.auth.require` on all vote endpoints | Reduces anonymous abuse, not documented as availability defense |
+| No rate limiting | N/A | **MISSING** |
+| No async processing for heavy operations | N/A | **MISSING** |
+| No per-user parallel process limits | N/A | **MISSING** |
+
+### Positive Patterns for 15.1.3
+
+- The tally operation is correctly identified as slow in `tally.md` and kept as a CLI-only tool, preventing web-based DoS via tally
+- `asfpy.stopwatch.Stopwatch()` demonstrates awareness of performance measurement
+- Cryptographic operations use Argon2 which is intentionally slow for security — this tradeoff is partially documented in `tally.md`
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Documentation Maturity Gap**: The project has good inline code documentation (`ARCHITECTURE.md`, `schema.md`, `tally.md`) but lacks formal security architecture documentation. Security decisions are documented in comments and TODOs rather than dedicated security documents.
+
+2. **Development vs. Production Boundary**: Multiple indicators suggest the codebase is in an active development state being deployed (or ready to deploy) with development artifacts still present. The `TODO.md` essentially serves as both a bug tracker and security audit log.
+
+3. **Authentication vs. Authorization**: The project correctly implements authentication (via ASF OAuth/session), but authorization (ownership checks, per-election access control) is consistently marked with placeholder comments (`### check authz`). This creates a Type B gap — the decorator exists but fine-grained authorization is not implemented.
+
+4. **Cryptographic Design is Strong**: The vote encryption/anonymization design (Argon2 KDF, per-voter salts, encrypted ballots, anti-tamper hashing) is well-implemented. However, the deliberate slowness of these operations creates availability concerns that are only partially addressed.
+
+5. **Dependency Management Awareness**: Version constraints show intentional dependency management, but no formal vulnerability tracking or update policy exists.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (0-7 days)
+1. **Remove debug prints** from `pages.py` (`do_add_issue_endpoint`, `do_edit_issue_endpoint`) — trivial fix
+2. **Remove/fix placeholder `issue_count = 5`** — incorrect data shown to users
+3. **Remove `_REMAP` hack** from `create-election.py` — test code in production tool
+
+### Short-term (1-4 weeks)
+4. **Create Security Architecture Document** addressing:
+   - Dangerous functionality registry (ASVS 15.1.5)
+   - Risky component assessment (ASVS 15.1.4)
+   - Resource-demanding functionality inventory with mitigations (ASVS 15.1.3)
+   - Dependency update policy with timeframes (ASVS 15.2.1)
+5. **Implement rate limiting** on Argon2-heavy endpoints (`/do-vote/<eid>`, `/do-open/<eid>`)
+6. **Implement real CSRF tokens** — replace placeholder, add validation middleware
+
+### Long-term (1-3 months)
+7. **Implement authorization layer** — replace all `### check authz` placeholders with ownership/permission verification
+8. **Establish CI/CD pipeline** with:
+   - Automated dependency vulnerability scanning (e.g., `pip-audit`, `safety`)
+   - Linting for debug prints and placeholder code
+   - Separation of dev/test scripts from production distribution
+9. **Add async/queue processing** for election `open()` operations with many voters
+10. **Document and enforce consumer timeout strategy** for all web endpoints interacting with Argon2
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org