raboof commented on code in PR #802: URL: https://github.com/apache/commons-vfs/pull/802#discussion_r4411888409
########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). +This is a VFS-specific amendment to the +[Apache Commons Threat Model v0.1.0](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), Review Comment: Can we link to the HTML version of the model, since this is meant to be published on the site? ########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). +This is a VFS-specific amendment to the +[Apache Commons Threat Model v0.1.0](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), +which governs everything not stated here; report findings per the +[Apache Commons security process](https://commons.apache.org/security.html). + +Apache Commons VFS is an in-process Java library that resolves a caller-supplied +URI to a `FileObject` over many backends (local, FTP/FTPS, SFTP, HTTP(S), +WebDAV, HDFS, archive, and in-process schemes). By the family model's JDK-parity +principle, connecting to or reading whatever a URI names is doing what the caller +asked and is not a vulnerability: the URI and `FileSystemOptions` are trusted Review Comment: I would remove `By the family model's JDK-parity principle,` ########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). Review Comment: It was clearly not accepted on 2026-10-27. I don't see why it is needed to state if and when it was accepted - if it's on the website then apparently it's accepted, and people who want more details can check the history. I don't know what it means that you write this is "bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`).", I'd say this can be removed. ########## src/site/xdoc/security.xml: ########## @@ -41,7 +41,18 @@ <a href="mail-lists.html">user mailing list</a>. </p> <p>If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are - incomplete, please report them privately to the Apache Security Team. Thank you. + incomplete, please report them privately to the Apache Security Team. Thank you. + </p> + </section> + <section name="Threat Model"> + <p> + The <a href="threat-model-0.1.0.html">Apache Commons VFS Threat Model</a> describes the implicit + security contract between Commons VFS and the applications that embed it: what the library assumes + about its caller and inputs, the security properties it provides and those it deliberately does not, + and how inbound vulnerability reports, scanner output, and AI-generated findings are triaged against + that model. It is a VFS-specific amendment to the Apache Commons family threat model; see + <a href="https://commons.apache.org/security.html";>Apache Commons Security</a> for the + foundation-wide security policy. Review Comment: I think this can be removed, this all seems repeated in the model itself. ########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). +This is a VFS-specific amendment to the +[Apache Commons Threat Model v0.1.0](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), +which governs everything not stated here; report findings per the +[Apache Commons security process](https://commons.apache.org/security.html). + +Apache Commons VFS is an in-process Java library that resolves a caller-supplied +URI to a `FileObject` over many backends (local, FTP/FTPS, SFTP, HTTP(S), +WebDAV, HDFS, archive, and in-process schemes). By the family model's JDK-parity +principle, connecting to or reading whatever a URI names is doing what the caller +asked and is not a vulnerability: the URI and `FileSystemOptions` are trusted +configuration, while everything a backend returns is untrusted. The only security +properties VFS adds over the JDK are its own `NameScope` subtree confinement +(`CHILD`/`DESCENDENT`; broken by CVE-2025-27553) and the masking of URI passwords +in its own diagnostics such as `getFriendlyURI()` (broken by CVE-2025-30474); +both were fixed in 2.10.0, a break of either is a valid finding, and everything Review Comment: I don't think the security model should refer to past CVE's nor the versions in which they were fixed. ########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). +This is a VFS-specific amendment to the +[Apache Commons Threat Model v0.1.0](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), +which governs everything not stated here; report findings per the +[Apache Commons security process](https://commons.apache.org/security.html). + +Apache Commons VFS is an in-process Java library that resolves a caller-supplied +URI to a `FileObject` over many backends (local, FTP/FTPS, SFTP, HTTP(S), +WebDAV, HDFS, archive, and in-process schemes). By the family model's JDK-parity +principle, connecting to or reading whatever a URI names is doing what the caller +asked and is not a vulnerability: the URI and `FileSystemOptions` are trusted +configuration, while everything a backend returns is untrusted. The only security +properties VFS adds over the JDK are its own `NameScope` subtree confinement +(`CHILD`/`DESCENDENT`; broken by CVE-2025-27553) and the masking of URI passwords +in its own diagnostics such as `getFriendlyURI()` (broken by CVE-2025-30474); +both were fixed in 2.10.0, a break of either is a valid finding, and everything +else is triaged against the family model. VFS adds no resource bounds (archive +bombs and slow servers are the caller's problem), no zip-slip defense when a host +writes archive entries to disk, and no sandbox around untrusted URIs (SSRF/LFI is +the host's own choice). Its SFTP provider leaves `StrictHostKeyChecking` at +`"no"` by default, which the maintainers treat as a developer-only setting, so a +man-in-the-middle report against the bare default is out of model and VFS-867 +proposes hardening it. The in-process library is in scope; `commons-vfs2-examples`, +`commons-vfs2-sandbox`, and test code are not. The machine-readable Review Comment: why would commons-vfs2-sandbox be out of scope? ########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). +This is a VFS-specific amendment to the +[Apache Commons Threat Model v0.1.0](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), +which governs everything not stated here; report findings per the +[Apache Commons security process](https://commons.apache.org/security.html). + +Apache Commons VFS is an in-process Java library that resolves a caller-supplied +URI to a `FileObject` over many backends (local, FTP/FTPS, SFTP, HTTP(S), +WebDAV, HDFS, archive, and in-process schemes). By the family model's JDK-parity +principle, connecting to or reading whatever a URI names is doing what the caller +asked and is not a vulnerability: the URI and `FileSystemOptions` are trusted +configuration, while everything a backend returns is untrusted. The only security +properties VFS adds over the JDK are its own `NameScope` subtree confinement +(`CHILD`/`DESCENDENT`; broken by CVE-2025-27553) and the masking of URI passwords +in its own diagnostics such as `getFriendlyURI()` (broken by CVE-2025-30474); +both were fixed in 2.10.0, a break of either is a valid finding, and everything +else is triaged against the family model. VFS adds no resource bounds (archive +bombs and slow servers are the caller's problem), no zip-slip defense when a host +writes archive entries to disk, and no sandbox around untrusted URIs (SSRF/LFI is +the host's own choice). Its SFTP provider leaves `StrictHostKeyChecking` at +`"no"` by default, which the maintainers treat as a developer-only setting, so a +man-in-the-middle report against the bare default is out of model and VFS-867 Review Comment: This seems useful to call out, maybe make it a bulleted list for readability though? It can still be much more to-the-point: "Its SFTP provider leaves `StrictHostKeyChecking` at `"no"` by default, which the maintainers treat as a developer-only setting, so a man-in-the-middle report against the bare default is out of model and VFS-867 proposes hardening it" could simply be "For the SFTP provider, StrictHostKeyChecking is off by default". ########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). +This is a VFS-specific amendment to the +[Apache Commons Threat Model v0.1.0](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), +which governs everything not stated here; report findings per the +[Apache Commons security process](https://commons.apache.org/security.html). + +Apache Commons VFS is an in-process Java library that resolves a caller-supplied +URI to a `FileObject` over many backends (local, FTP/FTPS, SFTP, HTTP(S), +WebDAV, HDFS, archive, and in-process schemes). By the family model's JDK-parity +principle, connecting to or reading whatever a URI names is doing what the caller +asked and is not a vulnerability: the URI and `FileSystemOptions` are trusted +configuration, while everything a backend returns is untrusted. The only security Review Comment: is everything a backend returns really untrusted? what does 'untrusted' even mean? I'm not sure this is helpful here. ########## src/site/xdoc/security.xml: ########## @@ -41,7 +41,18 @@ <a href="mail-lists.html">user mailing list</a>. </p> <p>If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are - incomplete, please report them privately to the Apache Security Team. Thank you. + incomplete, please report them privately to the Apache Security Team. Thank you. + </p> + </section> + <section name="Threat Model"> + <p> + The <a href="threat-model-0.1.0.html">Apache Commons VFS Threat Model</a> describes the implicit Review Comment: what is 'implicit' about it? doesn't the threat model actually make it explicit? Better to remove. ########## src/site/markdown/threat-model-0.1.0.yaml: ########## @@ -0,0 +1,270 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Machine-readable companion to threat-model-0.1.0.md. DERIVED INDEX for tooling and +# automated/AI triage; the prose document is canonical. Regenerate when the +# prose changes. Review Comment: Is it really valuable to check this in? If we check it in, do we need to review it? ########## src/site/markdown/threat-model-0.1.0.md: ########## @@ -0,0 +1,45 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +---> +# Apache Commons VFS Threat Model + +**Status:** ACCEPTED 2026-10-27, bound to 2.11.0-SNAPSHOT (`master` @ `08d2eff08`). +This is a VFS-specific amendment to the +[Apache Commons Threat Model v0.1.0](https://svn.apache.org/repos/asf/commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md), +which governs everything not stated here; report findings per the +[Apache Commons security process](https://commons.apache.org/security.html). + +Apache Commons VFS is an in-process Java library that resolves a caller-supplied +URI to a `FileObject` over many backends (local, FTP/FTPS, SFTP, HTTP(S), +WebDAV, HDFS, archive, and in-process schemes). By the family model's JDK-parity +principle, connecting to or reading whatever a URI names is doing what the caller +asked and is not a vulnerability: the URI and `FileSystemOptions` are trusted +configuration, while everything a backend returns is untrusted. The only security +properties VFS adds over the JDK are its own `NameScope` subtree confinement +(`CHILD`/`DESCENDENT`; broken by CVE-2025-27553) and the masking of URI passwords Review Comment: I would leave out "The only security properties VFS adds over the JDK": it's super unclear what "the security properties of the JDK" means in this context. I would _just_ say that `NameScope` subtree confinement (`CHILD`/`DESCENDENT`) is guaranteed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
