[PR] Add draft security threat model (THREAT_MODEL.md) + discoverability pointer [struts]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1756:
URL: https://github.com/apache/struts/pull/1756

   ## What this is
   
   **This is a proposal for the Struts PMC to review, correct, reject, or adopt — not a finished document and not an obligation.** It adds a draft `THREAT_MODEL.md` for the Apache Struts framework, plus a one-paragraph pointer to it from `SECURITY.md`, to improve the project's security-model discoverability for automated security scanners and for triaging inbound reports.
   
   It was drafted at the PMC's request (path: "the Security team drafts a v0, the PMC reviews and owns it").
   
   ## What it does
   
   - **`THREAT_MODEL.md`** (new) — a structured model: scope and intended use, trust boundaries, adversary model, the security properties the framework provides vs. those it leaves to the embedding application, a known-non-findings list, and a triage-disposition guide. It is built as a **strict superset of the existing [`SECURITY.md`](SECURITY.md) and the published [security guidance](https://struts.apache.org/security/)** and **links to them rather than duplicating** their content (knob lists, reporting process, and developer-responsibility detail stay canonical in those docs). The central framing follows the project's own words — Struts "doesn't provide any security mechanism — it is just a pure web framework" — with OGNL-injection / parameter-binding containment as the property the framework actively defends.
   - **`SECURITY.md`** — adds a short "Threat Model" section linking to the new file, so the existing `AGENTS.md` → `SECURITY.md` → `THREAT_MODEL.md` chain resolves. No existing content is changed or removed.
   
   ## How to review it
   
   Every load-bearing claim carries a provenance tag — *(documented)* (from your own docs / `SECURITY.md` / security site), *(maintainer)* (to be filled in as you confirm), or *(inferred)* (reasoned, not yet ratified). **§14 collects the open questions** — the fastest way to review is to react to those; each *(inferred)* claim has a matching question. Anything you correct, we fold in; anything you reject, we drop. The model is versioned with the project and is meant to live in the repo for the PMC to maintain.
   
   Nothing here changes framework behaviour — it is documentation only.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add draft security threat model (THREAT_MODEL.md) + discoverability pointer [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart merged PR #1756:
URL: https://github.com/apache/struts/pull/1756


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add draft security threat model (THREAT_MODEL.md) + discoverability pointer [struts]

["rgielen (via GitHub)" <gi...@apache.org>]

rgielen commented on PR #1756:
URL: https://github.com/apache/struts/pull/1756#issuecomment-4825933265

   Looks good to me as well, AFAICS ready to merge


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org