potiuk opened a new pull request, #1756: URL: https://github.com/apache/struts/pull/1756
## What this is **This is a proposal for the Struts PMC to review, correct, reject, or adopt — not a finished document and not an obligation.** It adds a draft `THREAT_MODEL.md` for the Apache Struts framework, plus a one-paragraph pointer to it from `SECURITY.md`, to improve the project's security-model discoverability for automated security scanners and for triaging inbound reports. It was drafted at the PMC's request (path: "the Security team drafts a v0, the PMC reviews and owns it"). ## What it does - **`THREAT_MODEL.md`** (new) — a structured model: scope and intended use, trust boundaries, adversary model, the security properties the framework provides vs. those it leaves to the embedding application, a known-non-findings list, and a triage-disposition guide. It is built as a **strict superset of the existing [`SECURITY.md`](SECURITY.md) and the published [security guidance](https://struts.apache.org/security/)** and **links to them rather than duplicating** their content (knob lists, reporting process, and developer-responsibility detail stay canonical in those docs). The central framing follows the project's own words — Struts "doesn't provide any security mechanism — it is just a pure web framework" — with OGNL-injection / parameter-binding containment as the property the framework actively defends. - **`SECURITY.md`** — adds a short "Threat Model" section linking to the new file, so the existing `AGENTS.md` → `SECURITY.md` → `THREAT_MODEL.md` chain resolves. No existing content is changed or removed. ## How to review it Every load-bearing claim carries a provenance tag — *(documented)* (from your own docs / `SECURITY.md` / security site), *(maintainer)* (to be filled in as you confirm), or *(inferred)* (reasoned, not yet ratified). **§14 collects the open questions** — the fastest way to review is to react to those; each *(inferred)* claim has a matching question. Anything you correct, we fold in; anything you reject, we drop. The model is versioned with the project and is meant to live in the repo for the PMC to maintain. Nothing here changes framework behaviour — it is documentation only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
