From 95e011accbfb4a405f4b8252aab9cd3cc165681d Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 14 Oct 2026 01:32:20 +0200 Subject: [PATCH] docs(phase-18): add security threat verification --- .../phases/18-payment-gateway/18-SECURITY.md | 144 ++++++++++++++++++ 1 file changed, 144 insertions(+) create mode 100644 .planning/phases/18-payment-gateway/18-SECURITY.md diff --git a/.planning/phases/18-payment-gateway/18-SECURITY.md b/.planning/phases/18-payment-gateway/18-SECURITY.md new file mode 100644 index 0000000..9cd7f5b --- /dev/null +++ b/.planning/phases/18-payment-gateway/18-SECURITY.md @@ -0,0 +1,144 @@ +--- +phase: "18" +slug: "payment-gateway" +status: verified +# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate) +threats_open: 0 +asvs_level: 1 +block_on: high +register_authored_at_plan_time: true +created: "2026-10-14" +--- + +# Phase 18 — Security + +> Per-phase security contract: threat register, accepted risks, and audit trail. + +Verification depth is ASVS level 1: each mitigation was located in the implementation by search (file, symbol or named test). The tests were not re-run by this audit; their results are in `18-VERIFICATION.md`. + +Evidence paths are relative to the meta repository: `summercms.go/` (framework), `sm-paymentgateway-plugin/` (gateway, HEAD `f55320a`, clean), `sm-pgstripe-plugin/` (Stripe operator), `vue-paymentgateway-layer/` (Nuxt layer). + +--- + +## Trust Boundaries + +| Boundary | Description | Data Crossing | +|----------|-------------|---------------| +| admin browser → cabana API | authenticated administrators with per-permission gates; payloads untrusted | decimal strings, secrets, rich-text HTML, e-mail addresses, action names | +| cabana → settings column | encrypted at rest; the projection decides what leaves the server | API keys, webhook secrets | +| host config → SecretFallbacks | operator-controlled fallback keys; never echoed | API keys | +| internet → notification route | unauthenticated, any method, attacker-controlled body and path | payment notifications | +| Stripe → notification route | signed events over HTTPS; anyone can POST to the same path | webhook events | +| browser → return URL with pgUuid | unauthenticated, attacker-controlled query | payment uuid | +| operator → api.stripe.com | outbound with the secret key | amounts, currency, e-mail | +| NBP / Fixer → converter | third-party JSON over HTTPS | exchange rates | +| stored legacy rows → reader | rows written by PHP, possibly with an unknown app type | cart JSON | +| internet → customer API | anonymous or JWT callers | order hash, guest code, guest token, method codes, item ids | +| layer → host app | the payment-action slot hands PaymentIntent data to app code | client secret (transient) | +| events → mailers → SMTP | order data and user-supplied strings enter mail bodies | names, addresses, bank details HTML | +| PHP settings export → import command | operator-supplied JSON | settings, secrets | +| partial view models → admin DOM | server-rendered node trees | payment data (public keys only) | +| operator → application log | Warn and Error lines read by operators and log shippers | ids, states, Stripe error codes | +| test fixtures → repository | exported rows may carry personal data | anonymized order rows | + +--- + +## Threat Register + +| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status | +|-----------|----------|-----------|----------|-------------|------------|--------| +| T-18-01 | Information Disclosure | settings projection of password fields | high | mitigate | `summercms.go/modules/cabana/settings_secret.go` (state word only in `SettingsMeta.Secrets`); `TestSettingsSecretSmoke` | closed | +| T-18-02 | Tampering | money value parsing (server) | high | mitigate | `cabana/field_money.go` (`money.invalid`, `too_precise`, `too_large`); `TestMoneyFieldSmoke` | closed | +| T-18-03 | Tampering (stored XSS) | richeditor on settings | high | mitigate | `cabana/settings.go:241` `sanitizeSettingRichEditors` before Fill; `TestSettingsRichEditorSmoke` | closed | +| T-18-04 | Tampering | secret clear semantics | medium | mitigate | `cabana/settings_secret.go:118,157` (only null clears, non-string refused) | closed | +| T-18-05 | Information Disclosure | SPA money and secret components | medium | mitigate | `admin/src/components/form/fields/PasswordField.vue`; `admin/tests/form/PasswordField.test.ts` ("never shows the typed value after the save response replaces it") | closed | +| T-18-06 | Elevation of Privilege | danger record actions | low | accept | AR-18-01 | closed | +| T-18-07 | Spoofing / Tampering | notification route: forged "paid" | critical | mitigate | `sm-paymentgateway-plugin/payments/notification.go:97` `VerifyNotification` before any database access; `operators/cash.go:66` returns false; `TestNotificationRoute` | closed | +| T-18-08 | Tampering / Repudiation | replay or race on Accept | high | mitigate | `payments/notification.go:131` `Lock`; `orders/service.go:271` `clause.Locking{Strength: "UPDATE"}`; `TestNotificationRouteSmoke` | closed | +| T-18-09 | Tampering | mass assignment of state, amounts, owner, hash | high | mitigate | `models/payment.go:82` and sibling `Fillable()` lists; `TestFillable`, `TestPaymentGatewayTracer` | closed | +| T-18-10 | Tampering | money precision | high | mitigate | `money/amount.go` (`Amount4 int64`), `money/parse.go`; `TestMoneyVectorsSmoke`, `TestAmount4ScanValue`, `TestAmount4` | closed | +| T-18-11 | Elevation of Privilege | type injection through cart JSON | high | mitigate | `cart/registry.go` `RegisterItemType`, `cart/v2.go` `ErrUnknownItemType`; `TestLegacyCartGoldens`, `TestCartRegistry` | closed | +| T-18-12 | Information Disclosure | request logs on the notification route | medium | mitigate | `payments/notification.go:231-233` `support.Redact`; `support/redactor.go` key blocklist, e-mail and card patterns | closed | +| T-18-13 | Denial of Service | large notification bodies | medium | mitigate | `http.MaxBytesReader` and `throttle:paymentgateway-notify` (`routes.go:36`, `plugin.go:50`) | closed | +| T-18-14 | Spoofing | guest token forgery or reuse | high | mitigate | `support/guest_token.go:61,91` (HMAC-SHA256, constant-time compare); `TestGuestToken`, `TestCustomerAPITracer` | closed | +| T-18-15 | Tampering | exchange rates from third-party JSON | medium | mitigate | `currency/fixer.go:88` `UseNumber`, `currency/iso.go` exact rational parse | closed | +| T-18-16 | Information Disclosure | committed golden fixtures | medium | mitigate | no e-mail address in `cart/testdata` (searched); `TestLegacyFixtures` anonymization check | closed | +| T-18-17 | Elevation of Privilege | record and admin actions | high | mitigate | `admin_permissions.go` (`manage_orders`, `manage_payments`, `manage_shippings`); `TestOrdersAdminSmoke` | closed | +| T-18-18 | Tampering | quote cart payloads | high | mitigate | `controllers/quotes_cart.go` (allowlist, `UseNumber`, money grammar); `TestQuotesAdminSmoke` | closed | +| T-18-19 | Information Disclosure | partial view models | medium | mitigate | `controllers/payments.go:52` public-key list for `_payment_data` | closed | +| T-18-20 | Tampering (XSS) | partial templates and the custom element | medium | mitigate | `assets/js/quote-cart.js` writes `textContent` only, no `innerHTML`; html/template rendering | closed | +| T-18-21 | Tampering | list localization | low | accept | AR-18-02 | closed | +| T-18-22 | Information Disclosure | asset route | low | mitigate | cabana allowlist from `pact.AdminAssets` (`cabana/registry.go:80`); traversal paths in `admin_quotes_smoke_test.go:199` | closed | +| T-18-23 | Tampering (stored XSS in mail) | bank details in mails and the API | high | mitigate | settings save through T-18-03; `console/import_winter.go:288` `seaglass.Sanitize`; `TestPGSettingsSmoke`, `TestBankDetailsSanitized` | closed | +| T-18-24 | Spoofing / Information Disclosure | mail recipients | medium | mitigate | `events/recipients.go:45` `CustomerRecipient` (from the order, never the request); `models/mailer_settings.go:196` e-mail rules | closed | +| T-18-25 | Tampering (header injection) | mail subjects and variables | medium | mitigate | `summercms.go/modules/postcard/templates.go:340`, `drivers.go:299` refuse CR/LF | closed | +| T-18-26 | Repudiation / Tampering | mail for rolled-back transitions | medium | mitigate | `events/mailers.go:95` `lagoon.AfterCommit`; `TestMailersMatrixSmoke`, `TestMailTracer` | closed | +| T-18-27 | Elevation of Privilege | settings pages | medium | mitigate | `golem15.paymentgateway.access_settings` (`admin_permissions.go:12`, `admin_settings.go`); `TestMailerSettingsSmoke` | closed | +| T-18-28 | Spoofing | forged webhook event | critical | mitigate | `sm-pgstripe-plugin/operator.go:323-352` `VerifyNotification`, `webhook.go:46` `webhook.ValidatePayload`; `TestHostStripeFlow/wrong_secret`, `/missing_header`, `/missing_secret`, `TestStripeWebhook` | closed | +| T-18-29 | Tampering / Repudiation | event replay and concurrent delivery | high | mitigate | gateway row lock (T-18-08) plus `operator.go:447` `Can(Accept)`; `TestHostStripeFlow/replay_and_race` | closed | +| T-18-30 | Spoofing | browser return with a chosen pgUuid | high | mitigate | `browser_return.go:99,113` retrieves the session or intent at Stripe, redirects to the stored URL; `TestHostStripeFlow/browser_return` | closed | +| T-18-31 | Tampering | amount sent to Stripe | high | mitigate | `operator.go:621` `Minor()` from the stored cart; `TestHostStripeFlow/checkout_operator_path`, `/payment_intent_operator_path` | closed | +| T-18-32 | Information Disclosure | secrets in settings responses, logs, errors | critical | mitigate | `models/settings.go:50-52` `lagoon.Encrypted` with `json:"-"`; `TestStripeSettingsSmoke` | closed | +| T-18-33 | Information Disclosure | `payments.data` keys | medium | mitigate | `operator.go:43-46` data key constants; `ClientSecret` only in the transient response (`operator.go:243`), never written to `Payment.Data` | closed | +| T-18-34 | Denial of Service | outbound Stripe calls hanging | medium | mitigate | `client.go:29,33` `RequestTimeout` 30s, `MaxNetworkRetries` 2 | closed | +| T-18-35 | Tampering (supply chain) | stripe-go in go.mod | medium | mitigate | `go.mod:11` `stripe-go/v87 v87.0.0`, `go.sum` committed; `TestSDKPin` | closed | +| T-18-36 | Elevation of Privilege | test fixture plugin in production | medium | mitigate | fixture only in `fixture_plugin_test.go` (no production match); `TestFixtureAbsentFromProduction` | closed | +| T-18-37 | Information Disclosure (IDOR) | order lookup by hash | high | mitigate | `sm-paymentgateway-plugin/api/auth.go:107,203-211` (owner, constant-time guest code or bound token, else 404); `TestCustomerAPI` | closed | +| T-18-38 | Spoofing | guest token reuse | high | mitigate | as T-18-14; `TestCustomerAPITracer` foreign-order case | closed | +| T-18-39 | Tampering | client-supplied amounts, states or operators | high | mitigate | `api/methods.go:49` `registry.Enabled`, `api/errors.go` 422 and 409; `TestCustomerAPI` | closed | +| T-18-40 | Tampering | item edits outside Placed, last item, piece underflow | medium | mitigate | `cart/cart.go:127` `SubtractPiece`, `api/items.go:32` last-item refusal, `api/errors.go:59` 409 | closed | +| T-18-41 | Denial of Service | API abuse | medium | mitigate | `routes.go:63` `throttle:paymentgateway-api` | closed | +| T-18-42 | Information Disclosure | private keys in the order JSON | high | mitigate | `api/order_json.go` allowlist projection (no `guest_code`, `return_url` or `cart` key in the file); `TestCustomerAPI`, `TestCustomerAPITracer` | closed | +| T-18-43 | Tampering (XSS) | bank details HTML in PgBankTransfer | medium | mitigate | `vue-paymentgateway-layer/app/components/Pg/BankTransfer.vue:31` is the only `v-html`, fed by the sanitized settings column | closed | +| T-18-44 | Spoofing (CSRF) | state-changing POSTs from a browser | medium | mitigate | `api/auth.go:37,65` never reads cookies; the layer sends `Authorization: Bearer` (`usePaymentGatewayApi.ts`) | closed | +| T-18-45 | Repudiation | double process from a double click | low | mitigate | layer busy state (`Pg/Confirm.vue`); server 409 (`api/errors.go:59`) | closed | +| T-18-46 | Information Disclosure | committed shop-type fixture rows | high | mitigate | `TestLegacyFixtures` (`cart/legacy_test.go`); no e-mail address in `cart/testdata` | closed | +| T-18-47 | Repudiation | a green gate that measured nothing | medium | mitigate | `summercms.go/scripts/check-phase18.sh` `--self-test`, NOT RUN recorded | closed | +| T-18-48 | Tampering | tests reaching real services | medium | mitigate | no `api.stripe.com`, `api.nbp.pl` or `fixer.io` URL in any `_test.go` of either plugin | closed | +| T-18-49 | Tampering | a retryable decline finalizing the payment | high | mitigate | `sm-pgstripe-plugin/webhook.go:200-215` `attemptFailed` logs only; `TestHostStripeFlow/decline_then_succeed`, `/decline_then_succeed_payment_intent`, `/event_table` | closed | +| T-18-50 | Repudiation | paid signal on a final-state payment dropped silently | high | mitigate | `operator.go:484` `refusedAccept` logs at Error; `TestHostStripeFlow/paid_after_final_state` | closed | +| T-18-51 | Information Disclosure | the new Warn and Error log lines | medium | mitigate | `webhook.go:79-83` `PaymentError` has no message field; `TestStripeOperator` decline subtest | closed | +| T-18-52 | Elevation of Privilege | reviving a final-state payment | high | mitigate | `operator.go:447` `Can(Accept)` then `refusedAccept` with no transition; gateway unchanged at `f55320a`; `paid_after_final_state` | closed | +| T-18-53 | Spoofing | forged decline, expiry or cancel events | low | accept | AR-18-03 | closed | +| T-18-54 | Denial of Service | expired sessions leave the payment Sent | low | accept | AR-18-04 | closed | +| T-18-SC | Tampering | package installs (plans 01-08) | high | mitigate | Go: `go-hashids/v2 v2.0.1`, `stripe-go/v87 v87.0.0` with `go.sum`; layer: nuxt 4.4.8, vue 3.5.35, @nuxtjs/i18n 10.4.0, typescript 5.9.3 with `pnpm-lock.yaml`, no Stripe.js; no other package added | closed | + +*Status: open · closed · open — below high threshold (non-blocking)* +*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open* +*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)* + +T-18-SC appears in all eight plans with the same disposition and is listed once: 62 register rows, 55 distinct threats. + +--- + +## Accepted Risks Log + +| Risk ID | Threat Ref | Rationale | Accepted By | Date | +|---------|------------|-----------|-------------|------| +| AR-18-01 | T-18-06 | `Danger` on a record action is a display flag only; permissions and `Applies` are unchanged server-side. | plan 18-01 threat model | 2026-10-13 | +| AR-18-02 | T-18-21 | `ListValue` maps a constant to a phrase; an unknown constant falls back to the raw value and reaches no code path that executes it. | plan 18-03 threat model | 2026-10-13 | +| AR-18-03 | T-18-53 | Signature verification before lookup (T-18-28) is unchanged, and after plan 18-08 decline, expiry and cancel events cannot change a payment. | plan 18-08 threat model | 2026-10-13 | +| AR-18-04 | T-18-54 | A payment left Sent by an expired session is closed by `pg:cancel-sent-payments` after `payment_sent_to_canceled_timeout`, as on PHP. Review item A-IN-02 (cancel early after matching the stored session id) stays open as a follow-up. | plan 18-08 threat model | 2026-10-13 | + +*Accepted risks do not resurface in future audit runs.* + +--- + +## Security Audit Trail + +| Audit Date | Threats Total | Closed | Open | Run By | +|------------|---------------|--------|------|--------| +| 2026-10-14 | 55 | 55 | 0 | /msd-secure-phase orchestrator (ASVS L1 search; auditor not spawned per the L1 short-circuit) | + +Summary threat flags: plans 02, 03, 04, 06, 07 and 08 report none beyond the register. Plan 05 flags `new-route-test-only` (`POST /_books/stripe/webhook` in `sm-pgstripe-plugin/fixture_plugin_test.go`); it exists only in the test binary and is covered by T-18-36. + +--- + +## Sign-Off + +- [x] All threats have a disposition (mitigate / accept / transfer) +- [x] Accepted risks documented in Accepted Risks Log +- [x] `threats_open: 0` confirmed +- [x] `status: verified` set in frontmatter + +**Approval:** verified 2026-10-14