(tooling-agents) branch main updated: ASVS audit: 8.3.3.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 381c84e  ASVS audit: 8.3.3.md (redacted)
381c84e is described below

commit 381c84e413fa428d7c98f08e8ea537d2e11903a9
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:10:16 2026 +0200

    ASVS audit: 8.3.3.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/8.3.3.md | 115 +++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/8.3.3.md b/ASVS/reports/steve/v3/d0aa7e9/all/8.3.3.md
new file mode 100644
index 0000000..fe2d592
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/8.3.3.md
@@ -0,0 +1,115 @@
+# Security Audit Report: ASVS 8.3.3
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 8.3.3 |
+| **Files Analyzed** | 13 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that access to an object is based on the originating subject's (e.g. consumer's) permissions, not on the permissions of any intermediary or service acting on their behalf. For example, if a consumer calls a web service using a self-contained token for authentication, and the service then…
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 1 |
+
+---
+
+## ASVS-8.3.3: Operation Level Authorization — Originating Subject's Permissions
+
+### Findings for 8.3.3
+
+### [LOW]
+**Finding ID**: ASVS-833-LOW-001  
+**Title**: Architecture Does Not Include Service-to-Service Delegation — Requirement Partially Applicable  
+**File**: `v3/server/pages.py` (entire application)
+
+**Description**: The application is a monolithic web application where:
+- All authorization decisions use the originating user's session (`result.uid` from `asfquart.session.read()`)
+- There are no intermediate service calls where a machine token could be substituted for a user token
+- The `Election` class methods accept `pid` directly from the session-derived user ID
+
+**Code pattern (consistent across all endpoints):**
+```python
+async def do_vote_endpoint(election):
+    result = await basic_info()     # Gets user identity from session
+    ...
+    election.add_vote(result.uid, iid, votestring)  # Uses user's identity
+```
+
+**Analysis**: This monolithic architecture inherently satisfies the requirement — there's no intermediary service that could substitute its own credentials. The user's identity (`result.uid`) flows through all operations directly.
+
+**Potential concern**: If the application later adds microservices or background workers (e.g., for tallying), care must be taken to propagate the user's identity rather than using a service account.
+
+### Security Controls Inventory for 8.3.3
+
+| Control | Location | Status |
+|---------|----------|--------|
+| User identity derived from session | `basic_info()` → `asfquart.session.read()` | ✅ Direct user identity |
+| PID passed to business logic from session | All endpoints (`result.uid`) | ✅ Originating subject's identity |
+| No machine-to-machine token substitution | Architecture | ✅ Monolithic — not applicable |
+
+### Positive Patterns for 8.3.3
+
+1. **Direct session-to-PID flow**: All operations derive the acting user's identity directly from the authenticated session, not from any intermediary.
+2. **PID explicitly passed to data layer**: Business methods like `add_vote(pid, ...)` receive the PID from the web layer's session, maintaining clear identity provenance.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Authorization Architecture Gap (Type B Pattern)**: The application has a clear architectural intent for object-level authorization — the database schema includes `owner_pid` and `authz` columns, `q_owned` queries filter by PID, and `### check authz` comments exist at 8+ locations. However, NONE of these placeholder checks are implemented. This creates false confidence: developers and auditors see the comments and may assume authorization is handled.
+
+2. **Inconsistent Authorization Granularity**: 
+   - `/vote-on/<eid>` (GET) verifies voter eligibility via `q_find_issues`
+   - `/do-vote/<eid>` (POST) does NOT verify voter eligibility before attempting the vote
+   - `/serve_doc/<iid>/<docname>` (GET) properly checks `q_get_mayvote`
+   - Management endpoints check NOTHING beyond role
+
+3. **GET for State Changes**: Using HTTP GET for `do-open` and `do-close` violates REST semantics and eliminates CSRF protection even if tokens were properly implemented (CSRF tokens protect POST/PUT/DELETE, not GET).
+
+4. **Placeholder Security Controls**: The CSRF token system illustrates a dangerous anti-pattern — templates include tokens, JavaScript sends them in headers, but the server never validates them. This provides zero actual security while appearing secure during code review.
+
+5. **Assertion-Based State Enforcement**: The `election.py` model uses Python `assert` statements for state checks. While these work in development, `assert` statements are removed when Python runs with optimization (`-O` flag). Production deployments MUST NOT use `-O` or these security checks disappear silently.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical — Address Before Production)
+
+1. **Implement Object-Level Authorization**: Add ownership/authz checks in `load_election` and `load_election_issue` decorators. Compare `election.owner_pid` against `result.uid` (or check `election.authz` group membership).
+
+2. **Implement CSRF Protection**: Replace the placeholder token with real per-session tokens. Add server-side validation in a `@before_request` handler or decorator for all POST endpoints.
+
+3. **Change `do-open`/`do-close` to POST**: These perform irreversible state changes and must not be accessible via GET requests.
+
+4. **Add Eligibility Check to `do_vote_endpoint`**: Replicate the `q_find_issues` check from `vote_on_page` before processing votes.
+
+### Short-term (High Priority)
+
+5. **Replace `assert` with Explicit Checks**: Replace `assert self.is_editable()` patterns with explicit `if not self.is_editable(): raise ElectionBadState(...)` to ensure enforcement regardless of Python optimization flags.
+
+6. **Add Comprehensive Access Logging**: Log authorization denials (not just successful actions) to support security monitoring.
+
+7. **Validate `docname` in `serve_doc`**: While `send_from_directory` likely prevents path traversal, add explicit validation per the code comment (`### verify the propriety of DOCNAME`).
+
+### Long-term (Architecture Enhancement)
+
+8. **Implement Adaptive Controls**: For Level 3 compliance, add IP/device tracking to sessions with re-authentication on context changes.
+
+9. **Centralize Authorization Logic**: Create a dedicated authorization module rather than scattering checks across decorators and handlers. Consider a policy-based approach (e.g., checking owner, authz group, and election state in one call).
+
+10. **Add Real-Time State Notifications**: Implement WebSocket or polling to notify active voting sessions when an election closes, preventing wasted user effort.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org