potiuk commented on issue #34: URL: https://github.com/apache/tooling-agents/issues/34#issuecomment-4682001662
Thanks @andrewmusselman — triage of the L3/opus-4.8 Google-provider `7d95a3c` scan (3 findings) against current `main`. | # | Finding | Disposition | |---|---|---| | **FINDING-001** (Medium, CWE-287) | Google OpenID auth backend matches users by the mutable `email` claim, not the immutable `iss`+`sub` | **Defense-in-depth, not a CVE.** The attacker can't forge a token's email (Google signs it), so exploitation requires the org to *reassign* an email to a different identity **and** leave the prior Airflow user provisioned — an IdP / deployment identity-lifecycle failure, which the Security Model delegates to the deployment manager. Native `(iss, sub)` binding would need FAB user-model storage (feature-sized). Documenting the email-matching lifecycle requirement: [apache/airflow#68391](https://github.com/apache/airflow/pull/68391). | | **FINDING-002** (Low, CWE-613) | `_CredentialsToken.refresh` hardcodes a 3600s token lifetime, ignoring the credential's real expiry | **Not a security issue** — consolidated.md: *"correctness defect… the token cannot actually outlive GCP's server-side expiry, so there is no confidentiality or integrity exposure."* Impact is intermittent authentication failures (availability). Skip (a normal provider correctness bug if anyone wants to take it). | | **FINDING-003** (Low, CWE-250) | `ComputeEngineSSHHook` defaults `user="root"` | **By design / Dag-author-trusted** — *"not externally exploitable… requires a DAG author (a trusted identity)… a privileged-by-default foot-gun rather than a shipped/enabled default account."* The Dag author writes the hook config and can override `user`. Skip. | Net: one defense-in-depth docs PR (FINDING-001); no CVEs. --- This response was generated by AI and reviewed by @potiuk before posting; a human maintainer will follow up on anything worth a closer look. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
