(tooling-agents) branch main updated: ASVS audit: 1.3.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 3b12449  ASVS audit: 1.3.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
3b12449 is described below

commit 3b12449c2f0c74b94df0964a4408076e4726c135
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:50:28 2026 +0200

    ASVS audit: 1.3.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/1.3.8.md | 84 ++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/1.3.8.md b/ASVS/reports/steve/v3/d0aa7e9/all/1.3.8.md
new file mode 100644
index 0000000..21c7624
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/1.3.8.md
@@ -0,0 +1,84 @@
+# Security Audit Report: ASVS 1.3.8
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 1.3.8 |
+| **Files Analyzed** | 5 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured securely to prevent JNDI injection attacks.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-1.3.8: JNDI Injection Protection
+
+### Findings for 1.3.8
+
+No findings detected.
+
+This is a Python application using Quart (async Flask-like framework), SQLite, and EZT templating. JNDI (Java Naming and Directory Interface) is a Java-specific technology. There is no Java code, no JNDI lookups, and no LDAP/RMI/DNS resolution based on user input in this codebase.
+
+### Security Controls Inventory for 1.3.8
+
+No applicable controls in this scope. JNDI is a Java-specific technology not present in this Python application.
+
+### Positive Patterns for 1.3.8
+
+- The application is implemented in Python, which does not use JNDI.
+- No directory service lookups based on user input are present.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Output Encoding Inconsistency (Type B Gap Pattern):** The EZT templating system provides the `[format "js,html"]` encoding directive, and developers correctly apply it in JavaScript contexts. However, the same data (issue titles, descriptions, election titles) is rendered WITHOUT encoding in HTML body contexts. This represents a systematic Type B gap where the control exists but is not consistently applied.
+
+2. **No Input Sanitization Layer:** The application has no centralized input sanitization for user-supplied content. Issue titles, descriptions, and election titles flow directly from form input to database storage to template rendering without any intermediate sanitization step.
+
+3. **Defense-in-Depth Absence:** The application relies solely on authentication (`@asfquart.auth.require`) for security. There is no:
+   - Content Security Policy (CSP) headers
+   - Input sanitization middleware
+   - Output encoding applied by default
+   - CSRF token validation (acknowledged as placeholder)
+
+4. **Privileged User Attack Surface:** While all endpoints require authentication (committer or PMC member), the stored XSS vulnerabilities mean any compromised or malicious insider can attack all other users of the system. In an election/voting context, this is particularly severe as it could undermine election integrity.
+
+5. **Template Engine Choice:** EZT does not auto-escape by default (unlike Jinja2's `autoescape=True`). This architectural choice places the burden on developers to manually encode every output point, which has demonstrably led to gaps.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (address before next deployment)
+1. **Apply `[format "html"]` to ALL user-derived template variables** in HTML contexts — at minimum: `[issues.title]`, `[issues.description]`, `[e_title]`, `[flashes.message]`.
+2. **HTML-escape content in `rewrite_description()`** before wrapping in `<pre>` tags and before constructing `<a>` attributes.
+3. **Sanitize flash messages** — escape `form.title` and similar user input before interpolating into flash strings.
+
+### Short-term (within next sprint)
+4. **Implement a Content Security Policy** header (`script-src 'self'`) to mitigate XSS impact even if encoding is missed.
+5. **Add `X-Content-Type-Options: nosniff`** to document responses from `serve_doc()` to prevent MIME-type sniffing of uploaded files.
+6. **Restrict served document types** in `serve_doc()` to a whitelist of safe extensions (PDF, TXT, PNG, etc.), blocking SVG and HTML.
+7. **Implement input sanitization** for issue descriptions — either use a library like `bleach` to allow safe HTML subset, or store as plain text and render encoded.
+
+### Long-term (architectural improvements)
+8. **Migrate from EZT to a template engine with auto-escaping** (e.g., Jinja2 with `autoescape=True`). This eliminates the class of bugs where developers forget to encode.
+9. **Implement a centralized input validation/sanitization layer** as middleware that processes all form submissions before they reach handlers.
+10. **Implement real CSRF protection** — the placeholder token provides zero security and creates false confidence (Type B gap at the architecture level).
+11. **Add security-focused integration tests** that attempt XSS payloads through each input field and verify they are neutralized in rendered output.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org