You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:50:19 UTC

[I] Project Deletion Missing Additional Authorization Checks (tooling-trusted-releases)

asf-tooling opened a new issue, #1134:
URL: https://github.com/apache/tooling-trusted-releases/issues/1134

   **ASVS Level(s):** L1
   
   **Description:**
   
   ### Summary
   Project deletion in storage writer accepts deletion requests without additional validation that project has no active releases or ongoing votes that should prevent deletion.
   
   ### Details
   In `atr/storage/writers/project.py`, the project deletion logic does not check for blocking conditions such as active releases, ongoing votes, or other dependencies that should prevent deletion.
   
   ### Recommended Remediation
   Add validation checks before project deletion to ensure no active releases, ongoing votes, or other blocking conditions exist.
   
   ### Acceptance Criteria
   - [ ] Project deletion validates no active releases exist
   - [ ] Project deletion validates no ongoing votes exist
   - [ ] Clear error messages for blocked deletions
   - [ ] Unit tests verify validation logic
   
   ### References
   - Source reports: L1:8.3.1.md
   - Related findings: None
   - ASVS sections: 8.3.1
   
   ### Priority
   Low
   
   ---
   
   ---
   
   **Related issue:** https://github.com/apache/tooling-trusted-releases/issues/510
   
   ---
   
   **Triage notes:** related to https://github.com/apache/tooling-trusted-releases/issues/510


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Project Deletion Missing Additional Authorization Checks (tooling-trusted-releases)

Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #1134:
URL: https://github.com/apache/tooling-trusted-releases/issues/1134#issuecomment-4299214465

   This is a duplicate of #510, not just related to it. Closing.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Project Deletion Missing Additional Authorization Checks (tooling-trusted-releases)

Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #1134: Project Deletion Missing Additional Authorization Checks
URL: https://github.com/apache/tooling-trusted-releases/issues/1134


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org