oscerd opened a new pull request, #802: URL: https://github.com/apache/commons-vfs/pull/802
Adds a VFS-specific **threat model** that specializes the [Apache Commons family threat model](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), plus a machine-readable sidecar for automated/AI triage, and wires both into the project site. ### What this is The implicit security contract between Commons VFS and the applications that embed it: what VFS assumes about its caller and inputs, the security properties it provides and those it deliberately does not, and how inbound vulnerability reports, scanner output, and AI-generated findings are triaged against the model. It is **not** an audit or a code review of the library — it describes the contract, not the code. ### Contents - **`src/site/markdown/threat-model-0.1.0.md`** — the prose model: scope and the JDK-parity principle, trust boundaries, the two VFS-authored security properties (`NameScope` subtree confinement and URI-password masking — the two 2025 CVEs, CVE-2025-27553 and CVE-2025-30474, each broke one of these), disclaimed properties and false friends, downstream responsibilities, known non-findings (a scanner suppression list), and a closed set of triage dispositions. - **`src/site/markdown/threat-model-0.1.0.yaml`** — a derived, machine-readable triage index (entry-point trust, security-relevant config knobs, properties, non-findings, dispositions). - **`src/site/site.xml`, `src/site/xdoc/security.xml`** — link the page from the site menu and the security page. ### Status Accepted after maintainer review; all open questions resolved. Provenance tags (`documented` / `maintainer`) are retained so a report closed as out-of-model can cite a dated authority. Provider support tiers are recorded in §2.4. ### Related - **VFS-867** — proposes hardening the SFTP `StrictHostKeyChecking` default. The model records the current `"no"` default as developer-only (a report against the bare default is `OUT-OF-MODEL: non-default-build`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
