(tooling-agents) branch main updated: ASVS audit: 10.4.6.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new d14d0bb  ASVS audit: 10.4.6.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
d14d0bb is described below

commit d14d0bb5de1c5890a501c358c2e267ebd82ac84e
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:51:20 2026 +0200

    ASVS audit: 10.4.6.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/10.4.6.md | 74 +++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/10.4.6.md b/ASVS/reports/steve/v3/d0aa7e9/all/10.4.6.md
new file mode 100644
index 0000000..070975b
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/10.4.6.md
@@ -0,0 +1,74 @@
+# Security Audit Report: ASVS 10.4.6
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 10.4.6 |
+| **Files Analyzed** | 3 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that, if the code grant is used, the authorization server mitigates authorization code interception attacks by requiring proof key for code exchange (PKCE). For authorization requests, the authorization server must require a valid 'code_challenge' value and must not accept a…
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-10.4.6: PKCE Requirement
+
+### Findings for 10.4.6
+
+No findings detected.
+
+The codebase does not implement an OAuth Authorization Server. There is no authorization endpoint that would accept `code_challenge` or `code_challenge_method` parameters, and no token endpoint that would validate `code_verifier` parameters.
+
+### Security Controls Inventory for 10.4.6
+
+No applicable controls in this scope. PKCE validation is not implemented in this codebase as it does not function as an OAuth authorization server.
+
+### Positive Patterns for 10.4.6
+
+- No custom authorization code flow is implemented that would need PKCE protection.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **OAuth AS Not In Scope**: The entire set of ASVS 10.4.x requirements targets OAuth Authorization Server functionality. The provided codebase is an **election/voting application** that *consumes* authentication via the `asfquart` framework but does not *implement* an OAuth Authorization Server. The actual OAuth AS (likely an Apache infrastructure component) is not included in the provided source files.
+
+2. **Authentication Delegation**: The application delegates authentication to `asfquart.auth` with role-based requirements (`R.committer`, `R.pmc_member`). The implementation of these checks, including any underlying OAuth/OIDC flows, is external to this codebase.
+
+3. **Session Management**: The application uses `asfquart.session.read()` to obtain user identity (`uid`, `fullname`, `email`). This session is presumably established after successful OAuth authentication upstream, but the OAuth token exchange, code validation, and refresh mechanisms are handled elsewhere.
+
+4. **Audit Scope Limitation**: To properly audit ASVS 10.4.x requirements, the OAuth Authorization Server implementation used by this application (likely part of the `asfquart` or Apache ID infrastructure) would need to be included in the review scope.
+
+## Cross-cutting Recommendations
+
+**Immediate:**
+- No immediate action required for ASVS 10.4.x within this codebase, as it does not implement OAuth AS functionality.
+
+**Short-term:**
+- **Identify the OAuth AS component**: Determine which system provides OAuth authorization server functionality for this application (e.g., Apache's OAuth infrastructure or a third-party identity provider) and audit that component against ASVS 10.4.x requirements.
+- **Document the trust boundary**: Explicitly document the dependency on the external authentication system and what security guarantees it provides (authorization code one-time use, PKCE enforcement, refresh token rotation, etc.).
+
+**Long-term:**
+- **Ensure upstream compliance**: Verify that the upstream OAuth AS (consumed by `asfquart.auth`) meets all ASVS 10.4.x requirements, particularly:
+  - Authorization code one-time use with revocation on reuse (10.4.2)
+  - Authorization code lifetime ≤ 10 minutes (10.4.3)
+  - No implicit or ROPC grant support (10.4.4)
+  - Refresh token replay protection via rotation or sender-constraining (10.4.5)
+  - PKCE enforcement with S256 (10.4.6)
+- **Supply chain audit**: Include the `asfquart` authentication framework source code in future security audits to verify OAuth security controls are properly implemented at the authorization server level.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org