This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git
The following commit(s) were added to refs/heads/main by this push:
new bbae5ab9a enh: CNCF Security slam (#2954)
bbae5ab9a is described below
commit bbae5ab9af0051608ea055740b3143a4949b8714
Author: Lenny Primak <[email protected]>
AuthorDate: Mon Nov 9 21:24:22 2026 -0600
enh: CNCF Security slam (#2954)
* enh: CNCF Security slam
* precommit fixes
---
CONTRIBUTING.md | 52 ++++++++++++++
SECURITY-SELF-ASSESSMENT.md | 160 ++++++++++++++++++++++++++++++++++++++++++++
SECURITY.md | 12 ++++
security-insights.yml | 151 +++++++++++++++++++++++++++++++++++++++++
4 files changed, 375 insertions(+)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f820893ce..cab05a59f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -10,6 +10,16 @@ Your proposed code changes will be published to your own
fork of the Apache Shir
_Let's get started!!!_
+Discussions and defect reports
+------------------------------
+
+- Questions, ideas and discussions of proposed changes: [GitHub
Discussions](https://github.com/apache/shiro/discussions)
+ and the [mailing lists](https://shiro.apache.org/mailing-lists.html),
including `[email protected]`.
+- Defects and feature requests: [GitHub
Issues](https://github.com/apache/shiro/issues).
+ See [Issues and Bug Tracking](https://shiro.apache.org/issues.html) for what
to include in a report
+ (ideally a small reproducing JUnit test, otherwise a stack trace and
`TRACE`/`DEBUG` logs).
+- **Security vulnerabilities must not be reported in public.** Follow
[SECURITY.md](SECURITY.md).
+
Fork the code
-------------
@@ -51,6 +61,36 @@ $ git commit -a -m "descriptive commit message for your
changes"
> The `-b` specifies that you want to create a new branch called `feature_x`.
> You only specify `-b` the first time you checkout because you are creating a
> new branch.
> Once the `feature_x` branch exists, you can later switch to it with only
> `git checkout feature_x`.
+Building from source
+--------------------
+
+You need a JDK (CI builds with latest LTS) and Git. Maven is provided by the
included Maven Wrapper, so no separate installation is required.
+Dependencies are resolved from Maven Central.
+
+```bash
+$ ./mvnw verify
+```
+
+This compiles all modules, runs the unit and integration tests, and runs the
style (checkstyle, Apache RAT license header) checks.
+The same command is run by the project's CI on every pull request.
+For quick local builds while iterating, `./mvnw package` is much faster; run
`./mvnw verify` before submitting a pull request.
+Optionally install [pre-commit](https://pre-commit.com/) (`pre-commit
install`) to run the repository's formatting and sanity hooks before each
commit.
+
+Requirements for acceptable contributions
+-----------------------------------------
+
+A pull request is accepted when it meets all of the following:
+
+- It is linked to a GitHub issue (trivial changes such as typos or Javadoc
excepted) and addresses only that issue.
+- `./mvnw verify` passes, and CI is green.
+- New behavior and bug fixes come with automated tests.
+- New files carry the Apache License 2.0 header. Contributors either have an
[ICLA](https://www.apache.org/licenses/icla.pdf) on file with the ASF
+ or tick the license acknowledgment checkbox in the pull request template;
either is sufficient.
+- No secrets, credentials or generated or unreviewable binary files are
committed.
+- The change is reviewed and approved by a project committer.
+- Behavior with security impact is described in the pull request, and conforms
to the
+ [security model](https://shiro.apache.org/security-model.html).
+
Rebase `feature_x` to include updates from `upstream/main`
----------------------------------------------------------
@@ -114,3 +154,15 @@ $ git checkout main
$ git branch -D feature_x
$ git push origin :feature_x
```
+
+Dependency policy
+-----------------
+
+- **Selecting:** direct dependencies must be available under an
[ASF-compatible license](https://www.apache.org/legal/resolved.html)
+ (Category A or B), be actively maintained, and be justified in the pull
request that adds them.
+ Adding or upgrading a dependency is a normal pull request and goes through
the same review.
+- **Obtaining:** all dependencies are declared in the Maven `pom.xml` files
and resolved from Maven Central.
+ Build tooling versions (including Maven itself) are pinned in the
repository, and GitHub Actions are pinned to commit SHAs.
+- **Tracking:** Dependabot opens update pull requests for Maven dependencies,
GitHub Actions and pre-commit hooks,
+ GitHub Dependency Review checks every pull request for vulnerable or
incompatible-license dependencies,
+ and security alerts are monitored by the PMC. Known-vulnerable dependencies
are updated or replaced in the next release.
diff --git a/SECURITY-SELF-ASSESSMENT.md b/SECURITY-SELF-ASSESSMENT.md
new file mode 100644
index 000000000..240f20f48
--- /dev/null
+++ b/SECURITY-SELF-ASSESSMENT.md
@@ -0,0 +1,160 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+# Apache Shiro Security Self-Assessment
+
+This is the project's self-assessment of Apache Shiro, following the
+[OpenSSF security self-assessment
template](https://security-assessments.openssf.org/).
+It summarizes, and links to, the authoritative
+[security model](https://shiro.apache.org/security-model.html), which defines
+the adversaries, guarantees and known non-findings in detail.
+
+## Metadata
+
+| | |
+| --- | --- |
+| Assessment created | 2026-11-09 |
+| Software | Apache Shiro, <https://github.com/apache/shiro> |
+| Security provider | Yes. Shiro is an application security framework. |
+| Languages | Java |
+| License | Apache License 2.0 |
+| Security contact |
[[email protected]](mailto:[email protected]) |
+| Security insights | [security-insights.yml](./security-insights.yml) |
+
+## Overview
+
+Apache Shiro is a Java library that adds authentication, authorization,
+cryptography and session management to an application. It is embedded in the
+application's JVM process; it is not a standalone server or service.
+
+### Background
+
+Applications use Shiro to identify users (`Subject`), verify their credentials
+against one or more `Realm`s (LDAP, databases and others), decide whether they
may
+perform an action (roles and permissions), manage their sessions, and hash or
+encrypt data. Integrations exist for servlet and Jakarta EE web containers,
+Spring, Guice, CDI and others.
+
+### Actors
+
+| Actor | Description | Trust |
+| --- | --- | --- |
+| Application code | Code that calls Shiro APIs inside the JVM. | Trusted |
+| Operator / administrator | Controls configuration (INI, properties, Spring
or Guice wiring), keys, and deployment. | Trusted |
+| Realm backing stores | LDAP, databases and other credential or permission
sources. | Trusted |
+| End user (anonymous or authenticated) | Submits credentials, session
identifiers and requests over the network. | **Untrusted** |
+| Servlet container / reverse proxy | Normalizes paths, hosts and headers
before Shiro sees them. | Trusted to behave as configured |
+
+### Actions
+
+- Authenticate a `Subject` from submitted credentials via configured realms.
+- Authorize a `Subject` using role and permission checks, including
annotations.
+- Create, validate, persist and invalidate sessions, including "remember me"
identity.
+- Hash passwords and data, and encrypt or decrypt data, through JCA/JCE and
BouncyCastle.
+- Apply URL-based filter chains to web requests.
+
+### Goals
+
+- Correctly enforce the configured authentication and authorization decisions
against
+ an unauthenticated or low-privileged network adversary.
+- Provide secure defaults for password hashing and session handling, and make
secure
+ configuration straightforward.
+- Do not log plaintext credentials.
+- Fix and publicly disclose vulnerabilities through a coordinated process.
+
+### Non-goals
+
+Not provided by Shiro; operators and applications are responsible for these
+(see "Known Non-Findings" in the security model):
+
+- CSRF protection, multi-factor authentication, and account lockout.
+- Key management infrastructure.
+- Defense against code running in the JVM, against administrators with
configuration
+ access, against local shell access, or against compromised realm data
sources.
+- Concealing the Shiro version.
+- Defending against inconsistent path interpretation by downstream frameworks.
+
+## Self-assessment use
+
+This document is the maintainers' own review. It is not an independent audit,
+and it does not replace the security model or an assessment of your deployment.
+
+## Security functions and features
+
+| Function | Critical to security | Notes |
+| --- | --- | --- |
+| Credential matching and realm coordination | Yes | `CredentialsMatcher`,
`AuthenticationStrategy`. |
+| Permission and role resolution | Yes | Wildcard permissions and annotations.
|
+| Session management and fixation prevention | Yes | Pluggable `SessionDAO`;
timeouts and validation. |
+| Password hashing | Yes | `PasswordService` with Argon2 and BCrypt. |
+| Cipher and hash services | Yes | Wrappers over JCA/JCE and BouncyCastle. |
+| Web filter chain and `InvalidRequestFilter` | Yes | Relies on the
container's path normalization. |
+| Remember-me cookie | Security relevant | Weaker guarantees than full
authentication, by design. |
+| SLF4J security event logging | Supporting | Principals may be logged;
credentials are not. |
+
+## Project compliance
+
+Apache Shiro is not claimed to comply with a specific regulatory standard.
+The project follows the ASF release and security policies, and self-reports
+against the [OSPS Baseline](https://baseline.openssf.org/) using
+[security-insights.yml](./security-insights.yml).
+
+## Secure development practices
+
+- **Review:** changes are made by pull request and reviewed by committers.
+ Branch rulesets on `main` and release branches prevent deletion and force
pushes
+ and require a linear history and a passing build.
+- **Automated analysis:** CodeQL, GitHub Dependency Review, Dependabot and
OpenSSF
+ Scorecard run against the repository.
+- **Build integrity:** GitHub Actions are pinned to commit SHAs and run with
+ least-privilege permissions. Maven and build plugins are pinned, and
dependencies
+ come from Maven Central. See the dependency policy in
[CONTRIBUTING.md](./CONTRIBUTING.md).
+- **Testing:** unit and integration tests run in CI on every pull request.
+- **Releases:** releases are built by a release manager, signed, voted on by
the PMC
+ following the [ASF release
policy](https://www.apache.org/legal/release-policy.html),
+ and published with checksums. Users verify releases as described on the
[download page](https://shiro.apache.org/download.html#release_process).
+- **Contributions:** contributors license their work under Apache-2.0, and
contributions
+ either have an ICLA on file with the ASF or acknowledge the license in the
pull request template.
+
+## Security issue resolution
+
+- Vulnerabilities are reported privately to
+ [[email protected]](mailto:[email protected]) and handled by
the
+ PMC under the [ASF security process](https://www.apache.org/security/).
+- Reports are acknowledged within the timeframe published on the security
reports page, triaged against the security model into the
+ dispositions it defines (VALID, VALID-HARDENING, OUT-OF-MODEL, BY-DESIGN,
+ KNOWN-NON-FINDING, MODEL-GAP), fixed in a release, then disclosed with a CVE
and credit.
+- Published advisories: <https://shiro.apache.org/security-reports.html>.
+- Supported release lines are listed on the [support
page](https://shiro.apache.org/support.html#supported-versions).
+
+## Threats and mitigations
+
+| Threat | Mitigation | Residual risk |
+| --- | --- | --- |
+| Authentication bypass via crafted requests | Filter chains, strict
`InvalidRequestFilter`, Shiro API checks | Downstream frameworks may read paths
differently. |
+| Session fixation and hijacking | Session ID regeneration on login, timeouts,
TLS | Session IDs are sensitive; operators must use secure transport and
storage. |
+| Weak credential storage | Secure default `PasswordService` (Argon2, BCrypt)
| Operators can configure weak algorithms. |
+| Injection into identity lookups (for example LDAP DN) | Input escaping in
realms, fixed through advisories | New realm implementations must escape input.
|
+| Forged or replayed remember-me cookies | Encryption and server-side age
verification | Remember-me is a weaker identity; sensitive actions should
require full authentication. |
+| Request-derived host or port abuse | Documented host and port configuration,
explicit system properties | Depends on reverse proxy and container
configuration. |
+| Compromised dependency or CI pipeline | Dependabot, Dependency Review,
SHA-pinned Actions, signed releases | Third-party supply chain risk remains. |
+
+## Appendix
+
+- Security model: <https://shiro.apache.org/security-model.html>
+- Security reports: <https://shiro.apache.org/security-reports.html>
+- Architecture: <https://shiro.apache.org/architecture.html>
diff --git a/SECURITY.md b/SECURITY.md
index 0be9170af..ad34cef6a 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -7,8 +7,20 @@ published on the project website rather than in the repository:
<https://shiro.apache.org/security-model.html>
- **Security policy, vulnerability reporting, past advisories and CVEs**:
<https://shiro.apache.org/security-reports.html>
+- [Supported
versions](https://shiro.apache.org/support.html#supported-versions)
+- [Verifying releases](https://shiro.apache.org/download.html#release_process)
+- [Security self-assessment](./SECURITY-SELF-ASSESSMENT.md)
+- [Dependency policy](./CONTRIBUTING.md#dependency-policy)
+- [Security Insights](./security-insights.yml)
The project website is the authoritative source; this file
exists so agents and tooling that look for `SECURITY.md` in
the repository can mechanically follow the link to the
canonical documents.
+
+## Reporting a vulnerability
+
+Report undisclosed security vulnerabilities **privately** to
+[[email protected]](mailto:[email protected]).
+Do not open public issues, pull requests or discussions for
+vulnerabilities that have not been fixed and announced.
diff --git a/security-insights.yml b/security-insights.yml
new file mode 100644
index 000000000..6478718d3
--- /dev/null
+++ b/security-insights.yml
@@ -0,0 +1,151 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+header:
+ schema-version: 2.2.0
+ last-reviewed: 2026-11-09
+ last-updated: 2026-11-09
+ url:
https://raw.githubusercontent.com/apache/shiro/main/security-insights.yml
+
+project:
+ name: Apache Shiro
+ homepage: https://shiro.apache.org/
+ steward:
+ comment: Apache Shiro is a top-level project of the Apache Software
Foundation.
+ uri: https://www.apache.org/
+ administrators:
+ - name: Apache Shiro PMC
+ primary: true
+ affiliation: Apache Software Foundation
+ email: [email protected]
+ repositories:
+ - name: shiro
+ comment: Main source repository for the Apache Shiro Java security
framework.
+ url: https://github.com/apache/shiro
+ documentation:
+ detailed-guide: https://shiro.apache.org/documentation.html
+ design: https://shiro.apache.org/architecture.html
+ quickstart-guide: https://shiro.apache.org/10-minute-tutorial.html
+ code-of-conduct: https://www.apache.org/foundation/policies/conduct.html
+ release-process: https://shiro.apache.org/download.html#release_process
+ support-policy: https://shiro.apache.org/support.html#supported-versions
+ vulnerability-reporting:
+ reports-accepted: true
+ bug-bounty-available: false
+ policy: https://shiro.apache.org/security-reports.html
+ contact:
+ name: Apache Shiro Security Team
+ primary: true
+ affiliation: Apache Software Foundation
+ email: [email protected]
+ comment: >-
+ Report vulnerabilities privately to [email protected]. Do not
+ open public issues or pull requests for undisclosed vulnerabilities.
+ The security model describing what is and is not considered a
+ vulnerability is at https://shiro.apache.org/security-model.html
+
+repository:
+ url: https://github.com/apache/shiro
+ status: active
+ accepts-change-request: true
+ accepts-automated-change-request: true
+ core-team:
+ - name: Apache Shiro PMC
+ primary: true
+ affiliation: Apache Software Foundation
+ email: [email protected]
+ license:
+ expression: Apache-2.0
+ url: https://github.com/apache/shiro/blob/main/LICENSE
+ documentation:
+ contributing-guide:
https://github.com/apache/shiro/blob/main/CONTRIBUTING.md
+ security-policy: https://github.com/apache/shiro/blob/main/SECURITY.md
+ governance: https://shiro.apache.org/team.html
+ dependency-management-policy:
https://github.com/apache/shiro/blob/main/CONTRIBUTING.md#dependency-policy
+ review-policy:
https://github.com/apache/shiro/blob/main/CONTRIBUTING.md#requirements-for-acceptable-contributions
+ release:
+ automated-pipeline: true
+ changelog: https://github.com/apache/shiro/releases
+ distribution-points:
+ - uri: https://shiro.apache.org/download.html
+ comment: Official source releases, signed and published by the ASF.
+ - uri: https://repo.maven.apache.org/maven2/org/apache/shiro/
+ comment: Binary artifacts on Maven Central.
+ security:
+ assessments:
+ self:
+ name: Apache Shiro Security Self-Assessment
+ comment: >-
+ OSPS self-assessment, built on the published threat and security
model for Apache Shiro
+ (https://shiro.apache.org/security-model.html).
+ date: 2026-11-09
+ evidence:
https://github.com/apache/shiro/blob/main/SECURITY-SELF-ASSESSMENT.md
+ tools:
+ - name: CodeQL
+ type: SAST
+ version: latest
+ rulesets:
+ - default
+ integration:
+ adhoc: true
+ ci: true
+ release: true
+ results:
+ ci:
+ name: CodeQL code scanning alerts
+ location: https://github.com/apache/shiro/security/code-scanning
+ predicate-uri: https://github.com/github/codeql-action
+ - name: Dependency Review
+ type: SCA
+ version: latest
+ rulesets:
+ - default
+ integration:
+ adhoc: false
+ ci: true
+ release: true
+ results:
+ ci:
+ name: Dependency Review workflow runs
+ location:
https://github.com/apache/shiro/actions/workflows/dependency-review.yml
+ predicate-uri: https://github.com/actions/dependency-review-action
+ - name: Dependabot
+ type: SCA
+ version: latest
+ rulesets:
+ - default
+ integration:
+ adhoc: true
+ ci: false
+ release: true
+ results:
+ adhoc:
+ name: Dependabot alerts and update pull requests
+ location: https://github.com/apache/shiro/security/dependabot
+ predicate-uri: https://docs.github.com/en/code-security/dependabot
+ - name: OpenSSF Scorecard
+ type: other
+ version: latest
+ rulesets:
+ - default
+ integration:
+ adhoc: true
+ ci: true
+ release: true
+ results:
+ adhoc:
+ name: OpenSSF Scorecard results
+ location: https://scorecard.dev/viewer/?uri=github.com/apache/shiro
+ predicate-uri: https://github.com/ossf/scorecard
