(tooling-agents) branch main updated: ASVS audit: 15.2.3.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 3505adf  ASVS audit: 15.2.3.md (redacted)
3505adf is described below

commit 3505adf3035464613e3ad46a704488a17f5444f0
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:04:24 2026 +0200

    ASVS audit: 15.2.3.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/15.2.3.md | 245 ++++++++++++++++++++++++++++
 1 file changed, 245 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/15.2.3.md b/ASVS/reports/steve/v3/d0aa7e9/all/15.2.3.md
new file mode 100644
index 0000000..858e0b2
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/15.2.3.md
@@ -0,0 +1,245 @@
+# Security Audit Report: ASVS 15.2.3
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 15.2.3 |
+| **Files Analyzed** | 14 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the production environment only includes functionality that is required for the application to function, and does not expose extraneous functionality such as test code, sample snippets, and development functionality.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 1 |
+| 🟡 Medium | 3 |
+| 🟢 Low | 2 |
+
+---
+
+## ASVS-15.2.3: Security Architecture and Dependencies - Extraneous Functionality
+
+### Findings for 15.2.3
+
+### [HIGH]
+
+**Finding ID**: ASVS-1523-HIGH-001
+**Location**: `v3/server/pages.py` — `do_add_issue_endpoint()` (line 476), `do_edit_issue_endpoint()` (line 497)
+**Issue**: Debug `print()` statements present in production endpoint code
+
+```python
+@APP.post('/do-add-issue/<eid>')
+@asfquart.auth.require({R.committer})
+@load_election
+async def do_add_issue_endpoint(election):
+    # ...
+    form = edict(await quart.request.form)
+    print('FORM:', form)  # DEBUG: prints all form data to stdout/logs
+```
+
+```python
+@APP.post('/do-edit-issue/<eid>/<iid>')
+@asfquart.auth.require({R.committer})
+@load_election_issue
+async def do_edit_issue_endpoint(election, issue):
+    # ...
+    form = edict(await quart.request.form)
+    print('FORM:', form)  # DEBUG: prints all form data to stdout/logs
+```
+
+**Impact**: In production, these print statements output form data (including election titles, descriptions) to process stdout. This is debug code that:
+1. Clutters production logs with sensitive data
+2. May expose form data in shared logging systems
+3. Indicates incomplete development practices in production code
+
+**Remediation**: Remove debug prints or replace with proper logging:
+```python
+_LOGGER.debug(f'Form data received for issue in election[E:{election.eid}]')
+```
+
+---
+
+### [MEDIUM]
+
+**Finding ID**: ASVS-1523-MED-001
+**Location**: `v3/server/pages.py` — `postprocess_election()` (line 619)
+**Issue**: Hardcoded placeholder value in production code
+
+```python
+def postprocess_election(e):
+    # ...
+    ### temporary. need to adjust input query.
+    if 'issue_count' not in e:
+        e.issue_count = 5  ### arbitrary. just provide a value
+```
+
+This is explicitly marked as temporary test/placeholder code with comments acknowledging it provides an arbitrary value. This masks real data issues and provides incorrect information to users.
+
+**Impact**: Users see incorrect issue counts (always "5" when data is missing), creating confusion and indicating incomplete/test functionality in production.
+
+**Remediation**: Fix the underlying query to always return `issue_count`, then remove the placeholder:
+```python
+def postprocess_election(e):
+    if 'issue_count' not in e:
+        e.issue_count = 0  # Default for elections without issues
+```
+
+---
+
+### [MEDIUM]
+
+**Finding ID**: ASVS-1523-MED-002
+**Location**: `v3/server/pages.py` — `basic_info()` (line 83)
+**Issue**: Placeholder CSRF token exposed in production
+
+```python
+async def basic_info():
+    # ...
+    ### generate a real token and store in the session
+    basic.csrf_token = 'placeholder'
+    return basic
+```
+
+A non-functional placeholder token is rendered into every page template (see `manage.ezt` line 11):
+```html
+<input type="hidden" id="csrf-token" value="[csrf_token]">
+```
+
+This is development stub code that:
+1. Provides false confidence that CSRF protection exists
+2. Exposes the word "placeholder" as a static value an attacker can trivially use
+3. Is explicitly noted as needing replacement
+
+**Impact**: This development-stage stub in production means all POST forms send a token that is never validated, making the application appear protected while being fully vulnerable to CSRF.
+
+---
+
+### [MEDIUM]
+
+**Finding ID**: ASVS-1523-MED-003
+**Location**: `v3/steve/election.py` — lines 79-80, 330-331
+**Issue**: Commented-out debug print statements in production code
+
+```python
+def open(self, pdb):
+    # ...
+    #print('SALT:', salt)
+    #print('KEY:', opened_key)
+    self.c_open.perform(salt, opened_key, self.eid)
+```
+
+```python
+def is_tampered(self, pdb):
+    # ...
+    # print('EDATA:', edata)
+    #print('SALT:', md.salt)
+    #print('KEY:', opened_key)
+```
+
+While commented out, these indicate development artifacts that would print cryptographic key material. Their presence in production code:
+1. Shows incomplete code cleanup
+2. Risks accidental uncommenting that would leak secrets
+
+---
+
+### [LOW]
+
+**Finding ID**: ASVS-1523-LOW-001
+**Location**: `v3/server/bin/create-election.py` — line 98
+**Issue**: Test/development hack with PID remapping
+
+```python
+# Temporary hack: Map old PIDs to newer equivalents for testing.
+# TODO: Remove once PID data is fully migrated.
+_REMAP = {
+    'iroh': 'wells',
+}
+
+for pid in record:
+    pid = _REMAP.get(pid, pid)  # Apply remapping if needed
+```
+
+This is explicitly marked as a temporary testing hack that should be removed before production use.
+
+---
+
+### [LOW]
+
+**Finding ID**: ASVS-1523-LOW-002
+**Location**: `v3/server/bin/load-fakedata.py` (referenced in `ARCHITECTURE.md`)
+**Issue**: Test data loading script included in production distribution
+
+From `ARCHITECTURE.md`:
+```markdown
+- **Data Loading** (`load-fakedata.py`): Populates the database with test data for development.
+```
+
+While CLI scripts require server access, including test data population tools in the production deployment expands the attack surface if an attacker gains filesystem access.
+
+---
+
+### Security Controls Inventory for 15.2.3
+
+| Control | Location | Coverage |
+|---------|----------|----------|
+| Auth requirements on endpoints | `pages.py` decorators | Applied to all sensitive endpoints |
+| Environment separation | N/A | **NOT DOCUMENTED** |
+| Code review/cleanup process | N/A | **GAPS EVIDENT** (debug prints present) |
+| Build pipeline stripping dev artifacts | N/A | **NOT EVIDENT** |
+
+### Positive Patterns for 15.2.3
+
+- The `TODO.md` explicitly documents known development artifacts (debug prints, placeholder token) showing developer awareness
+- CLI tools (`bin/` directory) are separate from web-served code, reducing accidental exposure
+- The `tally.py` script's `--spy-on-open-elections` flag uses a deliberately long name to prevent accidental misuse
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Documentation Maturity Gap**: The project has good inline code documentation (`ARCHITECTURE.md`, `schema.md`, `tally.md`) but lacks formal security architecture documentation. Security decisions are documented in comments and TODOs rather than dedicated security documents.
+
+2. **Development vs. Production Boundary**: Multiple indicators suggest the codebase is in an active development state being deployed (or ready to deploy) with development artifacts still present. The `TODO.md` essentially serves as both a bug tracker and security audit log.
+
+3. **Authentication vs. Authorization**: The project correctly implements authentication (via ASF OAuth/session), but authorization (ownership checks, per-election access control) is consistently marked with placeholder comments (`### check authz`). This creates a Type B gap — the decorator exists but fine-grained authorization is not implemented.
+
+4. **Cryptographic Design is Strong**: The vote encryption/anonymization design (Argon2 KDF, per-voter salts, encrypted ballots, anti-tamper hashing) is well-implemented. However, the deliberate slowness of these operations creates availability concerns that are only partially addressed.
+
+5. **Dependency Management Awareness**: Version constraints show intentional dependency management, but no formal vulnerability tracking or update policy exists.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (0-7 days)
+1. **Remove debug prints** from `pages.py` (`do_add_issue_endpoint`, `do_edit_issue_endpoint`) — trivial fix
+2. **Remove/fix placeholder `issue_count = 5`** — incorrect data shown to users
+3. **Remove `_REMAP` hack** from `create-election.py` — test code in production tool
+
+### Short-term (1-4 weeks)
+4. **Create Security Architecture Document** addressing:
+   - Dangerous functionality registry (ASVS 15.1.5)
+   - Risky component assessment (ASVS 15.1.4)
+   - Resource-demanding functionality inventory with mitigations (ASVS 15.1.3)
+   - Dependency update policy with timeframes (ASVS 15.2.1)
+5. **Implement rate limiting** on Argon2-heavy endpoints (`/do-vote/<eid>`, `/do-open/<eid>`)
+6. **Implement real CSRF tokens** — replace placeholder, add validation middleware
+
+### Long-term (1-3 months)
+7. **Implement authorization layer** — replace all `### check authz` placeholders with ownership/permission verification
+8. **Establish CI/CD pipeline** with:
+   - Automated dependency vulnerability scanning (e.g., `pip-audit`, `safety`)
+   - Linting for debug prints and placeholder code
+   - Separation of dev/test scripts from production distribution
+9. **Add async/queue processing** for election `open()` operations with many voters
+10. **Document and enforce consumer timeout strategy** for all web endpoints interacting with Argon2
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org