(tooling-agents) branch main updated: ASVS audit: 15.1.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 3c8a334  ASVS audit: 15.1.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
3c8a334 is described below

commit 3c8a33447620799468e2622293745afc6a0208a2
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:53:38 2026 +0200

    ASVS audit: 15.1.2.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/15.1.2.md | 190 ++++++++++++++++++++++++++++
 1 file changed, 190 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/15.1.2.md b/ASVS/reports/steve/v3/d0aa7e9/all/15.1.2.md
new file mode 100644
index 0000000..ca4fb56
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/15.1.2.md
@@ -0,0 +1,190 @@
+# Security Audit Report: ASVS 15.1.2
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 15.1.2 |
+| **Files Analyzed** | 8 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that an inventory catalog, such as software bill of materials (SBOM), is maintained of all third-party libraries in use, including verifying that components come from pre-defined, trusted, and continually maintained repositories.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 1 |
+| 🟢 Low | 1 |
+
+---
+
+## ASVS-15.1.2: Inventory Catalog / SBOM
+
+### Findings for 15.1.2
+
+### [MEDIUM]
+
+**Finding ID**: ASVS-1512-MED-001
+
+**Title**: No SBOM Generation or Trusted Repository Verification Configured
+
+**File**: `v3/pyproject.toml`
+
+**Relevant Code**:
+```toml
+[build-system]
+requires = ["uv_build"]
+build-backend = "uv_build"
+
+[tool.uv]
+default-groups = "all"
+```
+
+**Issue Description**: While `pyproject.toml` lists direct dependencies, the project lacks:
+
+1. **SBOM generation** — No configuration for generating a Software Bill of Materials (e.g., CycloneDX, SPDX format). Tools like `cyclonedx-bom`, `syft`, or `uv export` could provide this.
+2. **Transitive dependency inventory** — Only direct dependencies are listed; transitive dependencies of `asfpy`, `asfquart`, `cryptography`, `argon2-cffi`, etc. are not inventoried.
+3. **Trusted repository verification** — No `tool.uv.index` configuration or hash verification to ensure packages come from trusted sources. No `--require-hashes` equivalent.
+4. **Lock file** — While `uv` supports lock files (`uv.lock`), no lock file is provided in the codebase, meaning builds may not be reproducible.
+5. **Repository source pinning** — Dependencies like `asfpy` and `asfquart` appear to be Apache-specific packages, but no source repository or registry is explicitly configured.
+
+**Impact**: Without an SBOM and trusted repository verification:
+- Supply chain attacks via dependency confusion are possible (especially for `asfpy`, `asfquart` which are organization-specific)
+- Transitive vulnerabilities cannot be tracked
+- Compliance and audit requirements for component inventory are not met
+- Incident response for dependency-related vulnerabilities is hampered
+
+**Remediation**:
+```toml
+# Add to pyproject.toml or CI configuration:
+
+# 1. Generate SBOM in CI:
+# uv export --format cyclonedx > sbom.json
+
+# 2. Pin trusted repositories:
+[tool.uv]
+index-url = "https://pypi.org/simple/"
+# For internal packages:
+extra-index-url = ["https://packages.apache.org/simple/"]
+
+# 3. Ensure lock file is committed:
+# uv lock
+# git add uv.lock
+```
+
+Additionally, create a CI step:
+```yaml
+# .github/workflows/sbom.yml
+- name: Generate SBOM
+  run: |
+    uv pip compile pyproject.toml -o requirements.txt
+    cyclonedx-py requirements requirements.txt -o sbom.json --format json
+    
+- name: Audit dependencies
+  run: uv audit
+```
+
+---
+
+### [LOW]
+
+**Finding ID**: ASVS-1512-LOW-001
+
+**Title**: Apache-Specific Dependencies Lack Source Verification
+
+**File**: `v3/pyproject.toml`, lines 11-12
+
+**Relevant Code**:
+```toml
+dependencies = [
+    "asfpy>=0.56",
+    "asfquart>=0.1.12",
+    ...
+]
+```
+
+**Issue Description**: The packages `asfpy` and `asfquart` are Apache Software Foundation-specific libraries. Without explicit repository pinning or hash verification, there's a risk of dependency confusion attacks where a malicious package with the same name could be published on PyPI before or alongside the legitimate package.
+
+**Impact**: If an attacker publishes a malicious `asfpy` or `asfquart` package on PyPI with a higher version number, the build system could pull the malicious version instead of the legitimate one.
+
+**Remediation**:
+```toml
+[tool.uv]
+# Pin the source for ASF-specific packages
+[[tool.uv.index]]
+name = "apache"
+url = "https://packages.apache.org/simple/"
+# Or use git references:
+# asfpy = { git = "https://github.com/apache/infrastructure-asfpy.git", tag = "v0.56" }
+```
+
+---
+
+### Security Controls Inventory for 15.1.2
+
+| Control | Location | Status |
+|---------|----------|--------|
+| SBOM generation (CycloneDX/SPDX) | Not found | **MISSING** |
+| Lock file (`uv.lock`) | Not provided | **MISSING from codebase** |
+| Trusted repository configuration | Not configured in `pyproject.toml` | **MISSING** |
+| Hash verification for dependencies | Not configured | **MISSING** |
+| Transitive dependency inventory | Not found | **MISSING** |
+| Dependency confusion mitigation | Not configured | **MISSING** |
+
+### Positive Patterns for 15.1.2
+
+- Direct dependencies are explicitly declared in `pyproject.toml` with version constraints.
+- The project uses `uv` which has built-in support for lock files (`uv.lock`) and dependency auditing (`uv audit`), even if not fully configured.
+- Version ranges are appropriately scoped — critical libraries have upper bounds (`<47`, `<26`) while less critical ones use minimum versions.
+- Development/lint dependencies are properly separated from production dependencies using dependency groups.
+- The build system (`uv_build`) is a modern, well-maintained tool.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Incomplete Security Controls Pattern**: The application exhibits a recurring pattern of security controls being _defined_ or _planned_ but not _implemented_:
+   - CSRF token: defined as `'placeholder'` (line 83 of pages.py)
+   - Authorization checks: marked with `### check authz` comments throughout
+   - Path validation in `serve_doc`: marked with `### verify the propriety of DOCNAME`
+   - These represent Type B gaps (control exists in concept but is not applied)
+
+2. **Server-Side Security vs. Client-Side Security Imbalance**: The application demonstrates strong server-side security patterns (parameterized queries, cryptographic vote protection, state assertions, anti-tamper detection) but lacks corresponding client-side protections (no cache control, no Clear-Site-Data, no CSP headers).
+
+3. **Cryptographic Maturity vs. Infrastructure Maturity**: The cryptographic design (Argon2 for key derivation, Fernet encryption, vote token system, tamper detection) is sophisticated, but the surrounding infrastructure (no SBOM, no vulnerability policy, no security headers) lags significantly.
+
+4. **Single-Responsibility Concern**: `pages.py` handles routing, authentication, authorization, template rendering, and business logic. Security controls would benefit from middleware extraction (headers, CSRF, caching) applied uniformly.
+
+5. **Framework Dependency for Security**: The application relies heavily on `asfquart` for authentication and session management. The security posture of these operations is opaque from the provided code — a single vulnerability in the framework could undermine all authentication.
+
+---
+
+## Cross-cutting Recommendations
+
+### Immediate (0-7 days)
+1. **Add anti-caching headers** via `@APP.after_request` handler for all non-static responses (`Cache-Control: no-store`)
+2. **Implement logout endpoint** that sets `Clear-Site-Data: "cache", "cookies", "storage"` header
+3. **Generate and commit `uv.lock`** to ensure reproducible builds and enable transitive dependency auditing
+
+### Short-term (1-4 weeks)
+1. **Create vulnerability remediation policy** documenting timeframes for critical/high/medium/low severity issues in dependencies
+2. **Configure SBOM generation** in CI pipeline using `cyclonedx-py` or equivalent
+3. **Add `uv audit`** to CI pipeline to detect known vulnerabilities in dependencies
+4. **Implement Content-Security-Policy** header to restrict client-side script behavior
+5. **Pin Apache-specific package sources** to prevent dependency confusion attacks
+
+### Long-term (1-3 months)
+1. **Extract security middleware** — Create a unified security headers middleware that applies Cache-Control, CSP, X-Content-Type-Options, and other security headers
+2. **Implement proper CSRF protection** — Replace placeholder with cryptographically secure tokens validated server-side
+3. **Complete authorization system** — Implement the `### check authz` checks throughout the application
+4. **Establish dependency review process** — Monthly review cadence, automated PR generation for updates
+5. **Add client-side session cleanup** — JavaScript that detects session expiration and clears sensitive DOM data
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org