(tooling-agents) branch main updated: ASVS audit: 14.2.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new d3702c5  ASVS audit: 14.2.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
d3702c5 is described below

commit d3702c54fc49220d5e41dc270a7709424036a967
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:53:30 2026 +0200

    ASVS audit: 14.2.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/14.2.8.md | 91 +++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/14.2.8.md b/ASVS/reports/steve/v3/d0aa7e9/all/14.2.8.md
new file mode 100644
index 0000000..1f6cf07
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/14.2.8.md
@@ -0,0 +1,91 @@
+# Security Audit Report: ASVS 14.2.8
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 14.2.8 |
+| **Files Analyzed** | 8 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that sensitive information is removed from the metadata of user-submitted files unless storage is consented to by the user.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-14.2.8: Sensitive Information in File Metadata
+
+### Findings for 14.2.8
+
+No findings detected.
+
+**Rationale**: The provided codebase does not contain any file upload functionality where user-submitted files would have metadata that needs stripping. The `serve_doc` endpoint in `pages.py` serves pre-existing documents from a server-side directory (`DOCSDIR`), but there is no code path for users to upload files. The election system deals with text-based votes, election metadata, and pre-configured issue documents — not user-submitted files with EXIF, PDF metadata, or similar sensitive [...]
+
+If file uploads are added in the future (e.g., for issue documents), metadata stripping would need to be implemented before storage.
+
+### Security Controls Inventory for 14.2.8
+
+| Control | Location | Status |
+|---------|----------|--------|
+| File metadata stripping on upload | N/A | Not applicable — no upload functionality exists |
+| User consent mechanism for metadata retention | N/A | Not applicable |
+
+### Positive Patterns for 14.2.8
+
+- The application does not accept file uploads in its current form, reducing attack surface for metadata leakage.
+- Documents are served from a controlled server-side directory, suggesting they are curated by administrators rather than submitted by end users.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Incomplete Security Controls Pattern**: The application exhibits a recurring pattern of security controls being _defined_ or _planned_ but not _implemented_:
+   - CSRF token: defined as `'placeholder'` (line 83 of pages.py)
+   - Authorization checks: marked with `### check authz` comments throughout
+   - Path validation in `serve_doc`: marked with `### verify the propriety of DOCNAME`
+   - These represent Type B gaps (control exists in concept but is not applied)
+
+2. **Server-Side Security vs. Client-Side Security Imbalance**: The application demonstrates strong server-side security patterns (parameterized queries, cryptographic vote protection, state assertions, anti-tamper detection) but lacks corresponding client-side protections (no cache control, no Clear-Site-Data, no CSP headers).
+
+3. **Cryptographic Maturity vs. Infrastructure Maturity**: The cryptographic design (Argon2 for key derivation, Fernet encryption, vote token system, tamper detection) is sophisticated, but the surrounding infrastructure (no SBOM, no vulnerability policy, no security headers) lags significantly.
+
+4. **Single-Responsibility Concern**: `pages.py` handles routing, authentication, authorization, template rendering, and business logic. Security controls would benefit from middleware extraction (headers, CSRF, caching) applied uniformly.
+
+5. **Framework Dependency for Security**: The application relies heavily on `asfquart` for authentication and session management. The security posture of these operations is opaque from the provided code — a single vulnerability in the framework could undermine all authentication.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (0-7 days)
+1. **Add anti-caching headers** via `@APP.after_request` handler for all non-static responses (`Cache-Control: no-store`)
+2. **Implement logout endpoint** that sets `Clear-Site-Data: "cache", "cookies", "storage"` header
+3. **Generate and commit `uv.lock`** to ensure reproducible builds and enable transitive dependency auditing
+
+### Short-term (1-4 weeks)
+1. **Create vulnerability remediation policy** documenting timeframes for critical/high/medium/low severity issues in dependencies
+2. **Configure SBOM generation** in CI pipeline using `cyclonedx-py` or equivalent
+3. **Add `uv audit`** to CI pipeline to detect known vulnerabilities in dependencies
+4. **Implement Content-Security-Policy** header to restrict client-side script behavior
+5. **Pin Apache-specific package sources** to prevent dependency confusion attacks
+
+### Long-term (1-3 months)
+1. **Extract security middleware** — Create a unified security headers middleware that applies Cache-Control, CSP, X-Content-Type-Options, and other security headers
+2. **Implement proper CSRF protection** — Replace placeholder with cryptographically secure tokens validated server-side
+3. **Complete authorization system** — Implement the `### check authz` checks throughout the application
+4. **Establish dependency review process** — Monthly review cadence, automated PR generation for updates
+5. **Add client-side session cleanup** — JavaScript that detects session expiration and clears sensitive DOM data
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org