The GitHub Actions job "CI" on grails-core.git/docs/threat-model-8.0.x has failed. Run started by GitHub user jamesfredley (triggered by jamesfredley).
Head commit for run: fbafcd6a0c82764ac15bcade2283029937e2c8a5 / James Fredley <[email protected]> Refine THREAT_MODEL.md after multi-agent review pass Convergent findings from five parallel reviewers (oracle rubric audit, librarian comparative review against apache/airflow + apache/apisix + apache/logging-site, two explore agents for ground-truth verification, and an editorial deep pass) prompted these changes. Every factual claim added here was verified directly against grails-core 8.0.x source. Factual corrections - §5a multipart upload defaults were stated as Spring Boot's 1 MB / 10 MB. Actual default is 128000 bytes (~125 KB) for both maxFileSize and maxRequestSize, set by ControllersAutoConfiguration. Fixed in prose and YAML. Structural additions - §7 adversary model now opens with two crisp documented trust statements: the existing URL-reachability quote, plus a new plugin/classpath/ application.groovy trust statement that discharges the largest single class of inbound reports (modeled after apache/airflow's DAG-author trust line). - §7 adds an explicit "Not applicable - single-process, no consensus protocol" line for distributed-system Byzantine adversaries, per rubric §7. - §8 properties table gains a CWE column (P1-P9 each mapped to its CWE) so automated scanners can route findings directly to model properties. - §9 false-friend list expands with two new entries: GRAILS_ENV=development is not a security boundary, and grails.config.locations is a code- execution path rather than a configuration-file path. The existing bindable=false entry now states clearly that it is neither an access control nor a validation constraint. Surface-inventory completeness (§11, §11a) - Adds §11 misuse for Liquibase Groovy change-log paths that may be externally influenced (GroovyChangeLogParser in grails-data-hibernate5/ dbmigration evaluates change-log Groovy via GroovyShell.parse(...).run()). - §11a now cites the §6 trust assumption or §8 invariant that discharges each non-finding, per rubric §11a. The seven entries that previously lacked a citation now have one. - §11a is expanded to cover newly inventoried framework surfaces: every @GroovyASTTransformation implementation in shipped JARs (the full 25-entry set, including RollbackTransform and OrderedGormTransformation that earlier drafts missed); the additional Class.forName callers (DatabaseMigrationCommand.passwordEncryptionCodec, ConfigSupport, ExecuteStep profile-YAML className); GrailsApplicationScriptRunner; the SpEL usage in GroovyEclipseCompilationHelper (compile-time IDE helper, not runtime); SynchronizerTokensHolder Serializable; the absence of any other custom readObject methods beyond BeforeValidateHelper; the absence of any framework-shipped @RestController / @Controller beans; and the absence of any production path-traversal sink. Editorial cleanup - §3 drops the CodeQL / CycloneDX paragraph (build-hygiene drift - rubric §1 explicitly forbids these in a threat model). - §11 drops the Maven-HTTPS / checksum bullet (same reason). - Hedge tags normalized. The non-standard forms `*(documented: framework default)*` and `*(inferred - canonical OWASP class)*` and `*(inferred - §14 wave N)*` are replaced with the three permitted tags only, with citations or §14 cross-references moved outside the tag. - §11 entries for HQL concatenation and params.id are tightened to state the concrete harm and the minimal safe replacement, per rubric §11. - §9 tutorial parenthetical removed from the well-known-attack-classes preamble. - §8 P9 severity cell now contains only the tier label; the resource- consumption framing remains in the dedicated "Resource consumption line" sub-section. - §1 draft-confidence count updated to ~48 documented / 0 maintainer / ~64 inferred to track the added claims. YAML companion alignment - Added missing §5a knobs (dateFormats, serverURL) and corrected the multipart defaults to 128000 bytes. - Added conditions: and cwe: fields to every §8 property entry so the YAML mirrors the prose table. - Added discharged_by: and disposition: fields to every §11a entry. - Added two new false-friend entries to match the prose. - Added an inventory: list naming every shipped @GroovyASTTransformation implementation so SAST suppression configs can consume it directly. - Updated provenance counts to track the prose. No claim is added without provenance. No claim is added without being verified against 8.0.x source at the cited file path. Assisted-by: claude-code:claude-opus-4-7 Report URL: https://github.com/apache/grails-core/actions/runs/25926821096 With regards, GitHub Actions via GitBox
