(tooling-agents) branch main updated: ASVS audit: 1.2.9.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new e0ad669  ASVS audit: 1.2.9.md (redacted)
e0ad669 is described below

commit e0ad6699ac8340a1ef1218126d1fa313a1236831
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:00:24 2026 +0200

    ASVS audit: 1.2.9.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/1.2.9.md | 94 ++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/1.2.9.md b/ASVS/reports/steve/v3/d0aa7e9/all/1.2.9.md
new file mode 100644
index 0000000..0f40309
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/1.2.9.md
@@ -0,0 +1,94 @@
+# Security Audit Report: ASVS 1.2.9
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 1.2.9 |
+| **Files Analyzed** | 8 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the application escapes special characters in regular expressions (typically using a backslash) to prevent them from being misinterpreted as metacharacters.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-1.2.9: Regular Expression Injection Prevention
+
+### Findings for 1.2.9
+
+No findings detected. The single regex usage employs a hardcoded pattern, and no user input is used as a regex pattern.
+
+### Security Controls Inventory for 1.2.9
+
+| Control | Location | Coverage Status |
+|---------|----------|-----------------|
+| Hardcoded regex pattern | `v3/server/pages.py` line 48 (`rewrite_description`) | ✅ Pattern is compile-time constant |
+
+**Analysis of the single regex usage:**
+
+```python
+# v3/server/pages.py, lines 43-51
+def rewrite_description(issue):
+    import re
+    desc = issue.description
+    def repl(match):
+        filename = match.group(1)
+        return f'<a href="/docs/{issue.iid}/{filename}">{filename}</a>'
+    desc = re.sub(r'doc:([^\s]+)', repl, desc)
+    issue.description = f'<pre>{desc}</pre>'
+```
+
+- **Pattern**: `r'doc:([^\s]+)'` — hardcoded literal, not derived from user input
+- **Subject string** (`desc`): Comes from issue description (database content, set by election administrators)
+- **Risk**: The user input (`desc`) is the *subject* being searched, not the *pattern*. Using user input as a regex subject cannot cause ReDoS or regex injection.
+- **ReDoS assessment**: The pattern `doc:([^\s]+)` uses a non-backtracking character class `[^\s]+` which cannot cause catastrophic backtracking.
+
+### Positive Patterns for 1.2.9
+
+1. **No dynamic regex construction**: The only `re.sub()` call uses a compile-time constant pattern string.
+2. **User data only as subject**: User-controlled data (issue descriptions) is only matched against patterns, never used to construct patterns.
+3. **Simple, efficient pattern**: `[^\s]+` cannot cause ReDoS due to its non-overlapping character class.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Strong parameterization discipline**: The architecture cleanly separates query definitions (YAML) from business logic (Python), ensuring all database access goes through parameterized cursors. This is a well-designed pattern that makes SQL injection structurally difficult.
+
+2. **Minimal attack surface for injection types 1.2.5–1.2.8**: The application is a voting system that primarily interacts with SQLite — it does not invoke OS commands, query LDAP directories, parse XML, or generate LaTeX. This minimizes the injection attack surface.
+
+3. **Authorization gaps are documented but unimplemented**: The `### check authz` comments throughout `pages.py` indicate that fine-grained authorization beyond authentication is planned but not yet enforced. While not an injection concern per se, this could allow unauthorized users to modify election data through endpoints that only check `R.committer` rather than election ownership.
+
+4. **CSRF protection is absent**: `basic.csrf_token = 'placeholder'` with no validation in POST endpoints. While not an injection issue per ASVS 1.2.x, it could enable an attacker to cause actions (vote submission, election creation) through social engineering.
+
+5. **Path traversal mitigation via database validation**: The `/docs/<iid>/<docname>` endpoint validates `iid` against the `mayvote` table before serving files. Since valid IIDs are constrained to 10-char hex by schema CHECK constraints, path traversal via `iid` is prevented by the database lookup failing. The `docname` relies on `send_from_directory`'s built-in protection, though an explicit comment `### verify the propriety of DOCNAME` acknowledges this needs hardening.
+
+## Cross-cutting Recommendations
+
+**Immediate (no vulnerabilities found, but strengthen confidence):**
+- None required for injection prevention — the parameterized query pattern is consistently applied.
+
+**Short-term:**
+1. When implementing the `authz` LDAP integration (referenced in schema docs), ensure LDAP queries use parameterized filters or escape special characters (`*`, `(`, `)`, `\`, `NUL`) per RFC 4515.
+2. Add explicit validation for the `docname` parameter in `serve_doc()` (e.g., reject names containing `..`, `/`, or null bytes) as defense-in-depth beyond `send_from_directory`.
+3. Implement CSRF token generation and validation for all state-changing POST endpoints.
+
+**Long-term:**
+1. Consider adding a linting rule or CI check to ensure no raw SQL string construction (e.g., `f"SELECT..."`) is introduced in future commits.
+2. If LaTeX/PDF export features are ever added for election results, ensure `--shell-escape` is disabled and input is sanitized.
+3. If search functionality with user-supplied patterns is ever added, use `re.escape()` on user input before incorporating into regex patterns.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org