(tooling-agents) branch main updated: ASVS audit: 4.1.3.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 3220182  ASVS audit: 4.1.3.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
3220182 is described below

commit 322018202e0fe1b81bd521f752069071b2613cd4
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:56:14 2026 +0200

    ASVS audit: 4.1.3.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/4.1.3.md | 175 +++++++++++++++++++++++++++++
 1 file changed, 175 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/4.1.3.md b/ASVS/reports/steve/v3/d0aa7e9/all/4.1.3.md
new file mode 100644
index 0000000..7d0ccc1
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/4.1.3.md
@@ -0,0 +1,175 @@
+# Security Audit Report: ASVS 4.1.3
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 4.1.3 |
+| **Files Analyzed** | 9 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that any HTTP header field used by the application and set by an intermediary layer, such as a load balancer, a web proxy, or a backend-for-frontend service, cannot be overridden by the end-user. Example headers might include X-Real-IP, X-Forwarded-*, or X-User-ID.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 1 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-4.1.3: Intermediary Header Override Protection
+
+### Findings for 4.1.3
+
+### [HIGH] ASVS-413-HIGH-001
+**Finding: No Protection Against User-Controlled Proxy Headers**
+
+- **File:** `v3/server/main.py` and `v3/server/pages.py`
+- **Location:** Application-wide — no header stripping/validation configured
+
+**Vulnerable code quote:**
+```python
+# main.py - No proxy header configuration
+def create_app():
+    app = asfquart.construct('steve', app_dir=THIS_DIR, static_folder=None)
+    import pages
+    import api
+    return app
+```
+
+```python
+# pages.py - Session reads may depend on framework's IP resolution
+async def basic_info():
+    s = await asfquart.session.read()
+    # ...
+```
+
+- **Data flow:** Attacker sends request with spoofed headers → `X-Forwarded-For: 10.0.0.1` / `X-Real-IP: admin-ip` → Quart/Hypercorn processes request → If trusted proxies not configured, these headers may be used for logging, rate limiting, or session binding → Attacker can impersonate different IP
+- **Proof of concept:**
+```
+GET /voter HTTP/1.1
+Host: steve.apache.org
+X-Forwarded-For: 192.168.1.1
+X-Forwarded-Proto: https
+X-Real-IP: 10.0.0.1
+X-Forwarded-Host: evil.com
+```
+Without explicit proxy trust configuration, these headers could influence the application's behavior.
+
+- **Impact:** An attacker could:
+  1. Spoof their IP address in logs, making audit trails unreliable for a voting system
+  2. Bypass IP-based access controls (if any are added)
+  3. Manipulate `X-Forwarded-Proto` to trick the application into thinking it's served over HTTPS when it's not
+  4. For a voting system, unreliable audit trails are especially concerning for election integrity
+
+- **Gap Type:** Type A — No proxy header protection exists.
+
+**Remediation:**
+```python
+# For Hypercorn (ASGI mode), configure trusted proxy in hypercorn.toml:
+# forwarded_allow_ips = "10.0.0.0/8"
+
+# For application-level protection:
+from quart import Quart
+
+def create_app():
+    app = asfquart.construct('steve', app_dir=THIS_DIR, static_folder=None)
+    
+    # Configure trusted proxies (Quart supports ProxyFix-style middleware)
+    # Only trust headers from known proxy IPs
+    app.config['PROXY_FIX_X_FOR'] = 1  # Trust 1 level of X-Forwarded-For
+    app.config['PROXY_FIX_X_PROTO'] = 1
+    
+    @app.before_request
+    async def strip_untrusted_headers():
+        # If not from trusted proxy, remove proxy headers
+        trusted_proxies = {'127.0.0.1', '10.0.0.1'}  # Configure per deployment
+        if quart.request.remote_addr not in trusted_proxies:
+            # Quart doesn't allow header modification on request,
+            # but we can prevent their use
+            pass  # Implement via ASGI middleware
+    
+    import pages
+    import api
+    return app
+```
+
+For Hypercorn deployment:
+```toml
+# hypercorn.toml
+forwarded-allow-ips = "127.0.0.1,10.0.0.0/8"
+```
+
+### Security Controls Inventory for 4.1.3
+
+| Control | Location | Coverage Status |
+|---------|----------|----------------|
+| Trusted Proxy Configuration | Not found | **MISSING** |
+| Header Stripping Middleware | Not found | **MISSING** |
+| X-Forwarded-For Validation | Not found | **MISSING** |
+| X-Forwarded-Proto Validation | Not found | **MISSING** |
+| Hypercorn forwarded_allow_ips | Not found | **MISSING** |
+
+### Positive Patterns for 4.1.3
+
+- The application code in `pages.py` does not directly read or trust any proxy headers (e.g., `X-Forwarded-For`) for application logic — this reduces the immediate attack surface.
+- Authentication is session-based (via `asfquart.session.read()`) rather than IP-based, limiting the direct impact of IP spoofing on authentication.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **CSRF Protection is Completely Non-Functional:** The `basic_info()` function sets `basic.csrf_token = 'placeholder'` (line 83). This value is rendered in templates and sent in `X-CSRFToken` headers, but **no server-side validation exists**. This is a Type B gap (control exists in UI but is never validated), creating false confidence. All state-changing endpoints are vulnerable to CSRF, compounded by the GET-method issue on open/close.
+
+2. **Authorization Gaps (Pervasive):** Multiple `### check authz` placeholders indicate that fine-grained authorization (e.g., "is this user the owner of this election?") is NOT implemented. Any authenticated committer can manage/open/close any election. This is explicitly acknowledged in code comments but represents a critical security gap for a voting system.
+
+3. **Defense-in-Depth Layers Missing:** The application lacks:
+   - Security response headers (CSP, X-Content-Type-Options, X-Frame-Options)
+   - Rate limiting
+   - Request size limits
+   - Audit trail integrity
+
+4. **Deployment Architecture Dependency:** The config comment "a proxy sits in front of this server" means some controls (HSTS, HTTP→HTTPS redirect, proxy header trust) might be implemented at the infrastructure layer. However, the application provides no documentation, verification, or enforcement of these assumptions.
+
+5. **Template vs API Endpoint Confusion:** The application mixes template-rendered pages with JSON API endpoints (`/do-set-open_at`, `/do-set-close_at`) without clear architectural separation. This makes it difficult to apply appropriate security policies (Content-Type, redirect behavior, CORS) per endpoint type.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical — must fix before production)
+1. **Implement CSRF protection:** Replace `'placeholder'` token with a cryptographically random token tied to the session. Validate on all POST endpoints. Consider using `quart-csrf` or similar library.
+2. **Change `/do-open` and `/do-close` to POST methods** to prevent CSRF via GET and accidental triggering by prefetchers/crawlers.
+3. **Add HSTS header with preload directive** and submit domain to hstspreload.org.
+4. **Add charset to all responses:** Fix `raise_404()` and add an `after_request` handler ensuring all `text/*` responses include `; charset=utf-8`.
+
+### Short-term (High — fix within current sprint)
+5. **Configure trusted proxy headers:** Add Hypercorn `forwarded_allow_ips` or application-level middleware to prevent header spoofing.
+6. **Implement HTTP rejection for API endpoints:** Non-browser endpoints should return 403 on HTTP rather than redirecting.
+7. **Add browser feature detection:** Implement client-side checks that warn users if their browser cannot support the voting interface.
+8. **Add security headers via `after_request` middleware:**
+   ```python
+   @app.after_request
+   async def security_headers(response):
+       response.headers['X-Content-Type-Options'] = 'nosniff'
+       response.headers['X-Frame-Options'] = 'DENY'
+       response.headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload'
+       response.headers['Content-Security-Policy'] = "default-src 'self'"
+       return response
+   ```
+
+### Long-term (Medium — plan for next release)
+9. **Implement fine-grained authorization** (replace all `### check authz` placeholders) — verify election ownership before allowing management operations.
+10. **Architectural separation:** Create distinct middleware chains for browser-facing pages vs. JSON API endpoints with different security policies.
+11. **Document deployment requirements:** Create a security deployment guide specifying required proxy configuration, TLS requirements, and header trust settings.
+12. **Add integration tests** that verify security headers, method restrictions, and CSRF protection are functioning correctly in the deployed configuration.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org