rzo1 commented on code in PR #1198: URL: https://github.com/apache/opennlp/pull/1198#discussion_r3668477334
########## SECURITY.md: ########## @@ -0,0 +1,232 @@ +<!-- +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +--> + +# Security Policy and Security Model + +## Reporting a Vulnerability + +**Please do not report security issues through GitHub, the mailing lists, or any +other public channel.** + +Report suspected vulnerabilities privately to the Apache Security Team at +[[email protected]](mailto:[email protected]). The team will forward the +report to the Apache OpenNLP PMC and coordinate the response with you. See the +[ASF security process](https://www.apache.org/security/) for what to expect. + +When reporting, it helps a great deal if you can tell us which of the trust +boundaries described below your finding crosses, and what an attacker controls in +your scenario. + +## Supported Versions + +Security fixes are made to the most recent release of the 2.x line and to the +current 3.x line. Apache OpenNLP 1.x is end of life and receives no fixes; users +still on 1.x should upgrade. + +## Security Model + +### What Apache OpenNLP is + +Apache OpenNLP is a **library** and a set of **command-line tools** for natural +language processing. It is not a server. It opens no listening sockets, runs no +daemons, has no user accounts, no authentication, no authorization, and no web +interface. It executes entirely inside the process and with the privileges of the +application that embeds it, or of the user who invokes the CLI. + +Consequently, this security model is almost entirely about **input trust +boundaries**: which inputs OpenNLP is designed to survive when they are hostile, +and which it is not. + +### The short version + +- **Text you analyze is untrusted.** OpenNLP is designed to process hostile text + safely. Crashes, hangs, and unbounded memory growth caused by crafted *text* + are vulnerabilities. Report them. +- **Models, dictionaries, and training data are trusted.** They are closer to + configuration or code than to data. Loading one you did not vet is comparable to + loading a JAR you did not vet. We nevertheless harden these readers, and we + still want to hear about weaknesses in them — see + [Model artifacts](#model-artifacts-and-dictionaries) for exactly what that means. +- **Configuration is trusted.** System properties, file paths, and OpenNLP API + parameters are set by the operator, not by an attacker. + +### Input categories + +#### Text under analysis + +**Trust level: untrusted.** + +The text passed to a tokenizer, sentence detector, name finder, POS tagger, +lemmatizer, parser, document categorizer, normalizer, spell checker, or any other +analysis component is expected to be arbitrary and possibly hostile. This is the +core of what OpenNLP does, and it is the boundary we take most seriously. + +In scope as vulnerabilities: + +- Crashes, uncaught errors, or infinite loops triggered by crafted input text. +- Catastrophic backtracking (ReDoS) in a built-in regular expression applied to + input text. +- Memory consumption grossly disproportionate to input size — a small input that + causes a large allocation. +- Any escape from "compute a result over this string" into file, process, or + network access. + +Not in scope: analysis being slow, or memory use being proportionate to input, for +genuinely large input. Feed OpenNLP a gigabyte of text and it will use a lot of +memory. That is arithmetic, not a vulnerability. + +#### Model artifacts and dictionaries + +**Trust level: trusted, but hardened as defense in depth.** + +Model files (`.bin` model archives, serialized `BaseModel` artifacts, dictionary +XML, SymSpell dictionaries, ONNX models), custom feature-generator descriptors, +and training-data corpora are treated as **trusted input**. They configure and +parameterize the behavior of the library; a model can legitimately specify feature +generators and serializer classes to instantiate. Loading a model from a source +you do not trust is comparable to putting an untrusted JAR on your classpath, and +no amount of input validation makes that safe in general. + +That is our position on guarantees. It is not our position on effort. We recognize +that models are shipped, downloaded, cached, and passed between systems, and that +in real deployments they do not always come from where an operator assumes. So: + +- We **do not guarantee** that OpenNLP can safely load a maliciously crafted model + file. Do not build a system whose security depends on that. +- We **do strive for it**, and we harden these paths continuously. +- We **do welcome reports** about them. Findings in this area are treated as + security hardening improvements, and where the impact warrants it we have + requested CVEs and will continue to — CVE-2026-42440 (unbounded allocation in + the binary model reader) and CVE-2026-43825 (unsafe Java deserialization in the + LIBSVM document categorizer model) were both handled this way. + +Existing hardening in this area includes: + +- **Bounded count fields.** `AbstractModelReader` validates outcome, predicate, + and pattern counts against an upper bound before allocating, defaulting to + 10,000,000 and configurable at JVM startup via `-DOPENNLP_MAX_ENTRIES=<n>`. +- **Filtered Java deserialization.** `BaseModel` and `SvmDoccatModel` install an + `ObjectInputFilter` allowlist, with limits on graph depth, reference count, and + array length, so foreign payloads are rejected before they are materialized. +- **Hardened XML parsing.** `XmlUtil` enables secure processing and disables + DOCTYPE declarations and external DTD and schema access, so dictionary and + descriptor XML cannot pull in external entities. +- **Fail-fast format checks.** Binary formats validate magic numbers and version + fields before consuming the body. + +What we will generally *not* treat as a vulnerability here: a model that is simply +large and consumes proportionate memory; a model that fails to load with a clear +exception; behavior that requires the reporter to also control the classpath, the +JVM arguments, or the `OPENNLP_MAX_ENTRIES` setting. + +#### Downloaded models + +**Trust level: trusted, integrity-checked in transit.** + +`DownloadUtil` fetches pretrained models over HTTPS from the Apache distribution +CDN (`https://dlcdn.apache.org/opennlp/`) and verifies each download against the Review Comment: https://issues.apache.org/jira/browse/OPENNLP-1902 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
