andrewmusselman commented on issue #35: URL: https://github.com/apache/tooling-agents/issues/35#issuecomment-4598817000
Summary against our most recent L3 scans across all six components; note for next run we will be using opus 4.8 up from 4.6, and we will take in your open issues and PRs as guidance so the audit can notate where its findings are known by the project already. Thanks @rusackas! ## Cross-reference: Evan's false-positive feedback against current audit guidance About 6 of Evan's items should now drop automatically with the audit guidance we've codified; 3 reappear at lower severity or with different framing; another 4 may or may not depending on LLM variance; and 5 will still appear because they're auditor-judgment issues that policy can't solve directly. ### Should not reappear The audit guidance we've codified in `audit_guidance:superset` should auto-drop these: | # | Item | Why it should now drop | |---|---|---| | Session 2 #1 | Frontend hooks "missing column specification" (ASVS 15.3.1) | `frontend_backend_enforcement_boundary.md` — backend is enforcement boundary for field projection | | Session 2 #5 | CSRF-exempt endpoints Content-Type enforcement (ASVS 3.5.2) | `flask_appbuilder_security_controls.md` — CSRF delegated to FAB | | Session 2 #10 | Chart screenshot missing `X-Content-Type-Options` (ASVS 3.2.1) | `deployment_infrastructure_delegated.md` — headers delegated to reverse proxy | | Session 2 #15 | `row_limit` missing upper bound (ASVS 2.2.1) | `frontend_backend_enforcement_boundary.md` — backend enforces `apply_max_row_limit` | | Session 2 #16 | Auth rate limiting not active by default (ASVS 6.3.1) | `flask_appbuilder_security_controls.md` — auth rate limiting delegated to FAB | | Session 1 A.032 | Explore payload field filtering | `frontend_backend_enforcement_boundary.md` — backend enforces via `raise_for_access` | ### Reappears at lower severity or different framing Verified in current runs: | # | Item | Current behavior | |---|---|---| | Session 2 #2 | SSH tunnel credentials unmasked in read endpoints | Now FINDING-043 at **Low** (schema-level defense-in-depth). `admin_role_trusted.md` credential-masking carve-out narrowed the framing. Evan's analysis matches: `SSHTunnel.data` masks at the model layer. | | Session 2 #3 | SSH tunnel raw `.data` internal fields | Same as #2 — `.data` is hand-curated allowlist | | Session 2 #4 | `get_updated_since` `to_dict()` over-exposure | **Did not appear in latest superset main run.** Could be LLM variance; could be guidance side effect. Today's result aligns with Evan's false-positive call. | ### May still appear Depends on auditor analysis quality — not directly policy-addressable: | # | Item | Why guidance doesn't directly help | |---|---|---| | Session 2 #6 | `sanitize_clause` MySQL dialect fallback | Requires auditor to understand parser invariants; `hardening_vs_vulnerability_classification.md` might catch via no-exploit-path framing | | Session 2 #7 | `getattr` post-processing dynamic dispatch | Requires auditor to trace upstream marshmallow `OneOf` validation | | Session 2 #13 | No AEAD startup validation | Could drop via `hardening_vs_vulnerability_classification.md` (no current attack scenario), but framing-dependent | | Session 1 B.046 | Visualization stack-trace exposure | Could drop as operator-config-controlled, but auditor needs to see `SHOW_STACKTRACE` gate | ### Will still appear Auditor-judgment issues that policy can't address directly: | # | Item | Why | |---|---|---| | Session 2 #8 | MCP JWT verifier hardening (alg / none / jku / exp-nbf) | Requires auditor to understand authlib's internal behavior | | Session 2 #9 | `get_datasource_by_id` no access check | Requires caller-path analysis the auditor can't reliably do | | Session 2 #11 | Import/extension ZIP missing `check_is_safe_zip` | Auditor missed where the check is called — code-location issue | | Session 2 #12 | `uuid3`/MD5 cache key | Requires auditor to recognize non-cryptographic use of MD5 | | Session 2 #14 | Legacy DB URI validator dead code | Requires auditor to detect unreachable code via callgraph | ### New false positive Evan hasn't flagged that did appear in today's run **Session 1 B.003 (CSV formula injection)** — Evan flagged this as already mitigated by `escape_value` / `df_to_escaped_csv`, with only the tab/CR variants needing extension. This appeared as a **Medium finding** in today's superset main run (#3 in Top 5 Risks). Either the audit didn't see the existing protection or framed the partial gap as full vulnerability. Worth code-verifying before forwarding — possibly a similar false-positive pattern to what Evan documented. ### New Highs post-Evan's review Three substantive findings post-date Evan's review and aren't covered in his feedback: - **superset main FINDING-001:** SQL injection via `url_param` Jinja function - **superset-websocket FINDING-001:** No per-user connection cap - **superset-websocket FINDING-002:** No backpressure handling -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
