diff --git a/docs/security/threat-model.md b/docs/security/threat-model.md new file mode 100644 index 0000000..9e78c15 --- /dev/null +++ b/docs/security/threat-model.md @@ -0,0 +1,129 @@ +# Threat model — IgniteUI.Blazor.GridLite + +| | | +|---|---| +| **Status** | Draft — awaiting maintainer review | +| **Package in scope** | `IgniteUI.Blazor.GridLite` (net8.0 / net9.0 / net10.0) | +| **Repository** | https://github.com/IgniteUI/IgniteUI.Blazor.GridLite | +| **Reviewed commit** | | +| **Document owner** | | +| **Last updated** | 2026-08-11 | +| **Method** | STRIDE per trust boundary | + +## 1. Why this document exists + +This document records the package's security boundaries, assumptions, and controls. It is a **living document** and must be updated whenever the JS interop surface, serialization boundary, bundled JavaScript, or release process changes. + +Individual threat findings, their severities, and their remediation status are **not published**. They are tracked privately by the maintainers and are not included in this document. + +It is not a penetration test, not an audit, and not an attestation of security. + +## 2. Scope + +**In scope** + +- The `IgniteUI.Blazor.GridLite` NuGet package: managed code under `src/IgniteUI.Blazor.GridLite/`. +- The static web asset it ships: `wwwroot/js/blazor-igc-grid-lite.js` (Vite bundle of `igc-grid-lite-entry.js` and the `igniteui-grid-lite` npm package). +- The build and release pipeline that produces and signs the package. + +**Out of scope** + +- The consuming application (its authentication, authorization, CSP, data access). +- Internal implementation of the upstream `igniteui-grid-lite` npm package, except for its behavior at the rendering boundary. +- The ASP.NET Core Blazor framework itself. Framework-level behavior is treated as an assumption (§5). +- The demo application under `demo/`. + +## 3. Architecture and trust boundaries + +```mermaid +flowchart LR + subgraph SRV["Server circuit / WASM runtime — trusted"] + C["IgbGridLite<TItem>"] + H["JSHandler<TItem>
[JSInvokable] callbacks"] + A["Consuming app
Sorting / Filtering handlers"] + end + subgraph BR["Browser — untrusted"] + M["blazor-igc-grid-lite.js
window.blazor_igc_grid_lite"] + W["igc-grid-lite custom element
(shadow DOM)"] + end + C -- "TB1: JSON.Serialize(Data, options)" --> M + M -- "TB2: invokeMethodAsync(e.detail)" --> H + H --> A + M --> W + W -- "user sorts / filters" --> M +``` + +The two package-specific trust boundaries are: + +- **TB1 — server → client.** Everything crossing it is visible to the end user, forever. +- **TB2 — client → server.** In Blazor Server, callback data originates in the browser and must be treated as untrusted input. In Blazor WebAssembly, it remains client-controlled but does not cross into a server circuit. + +## 4. Assets and security objectives + +| Asset | Objective | +|---|---| +| Consumer data bound to `Data` (`IEnumerable`) | Confidentiality — only intended serializable properties reach the browser | +| The Blazor circuit (server-side rendering) | Availability — a client cannot exhaust CPU/memory | +| The consuming app's browser origin | Integrity — the component never introduces script execution | +| The published NuGet package | Integrity — signed, reproducible, no unintended content | + +## 5. Assumptions and consumer responsibilities + +The model is only valid if these assumptions hold. Consumer-facing responsibilities must be documented where they affect secure use of the package. + +| # | Assumption | +|---|---| +| A1 | The consuming app enforces authentication/authorization; the grid performs none. | +| A2 | The consuming app enforces a Content Security Policy appropriate to its render mode. | +| A3 | The consuming app prevents untrusted script execution. The component must avoid introducing script execution and avoid unnecessarily widening access available to other scripts running in the same origin. | +| A4 | Data bound to `Data` has already passed the app's own authorization filter. | +| A5 | `IgbGridLiteOptions.JavascriptPath` is a compile-time constant controlled by the app, never derived from user input or untrusted configuration. | +| A6 | Blazor Server hosts retain appropriate SignalR message-size and circuit resource limits. Applications that increase those limits must reassess the availability impact of client-driven interop callbacks. | + +## 6. Threat analysis + +STRIDE analysis is performed against each trust boundary described in §3, covering: + +- **TB2 — client → server**: the JS interop callback surface. +- **TB1 — server → client**: the serialization and rendering surface. +- **Supply chain, build and release**: dependency bundling and the publish pipeline. + +Severity is assessed as residual severity **given** assumptions A1–A6. + +The resulting findings, severities, remediation status, and any accepted risks are maintained in a private maintainer-only record and are deliberately omitted here. Suspected vulnerabilities should be reported through [GitHub Private Vulnerability Reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) on this repository rather than in a public issue. + +## 7. Existing controls + +Controls already in place, verified in the repository files, evaluated build properties, and repository-level GitHub settings: + +- **Code scanning** — GitHub CodeQL default setup is configured with the extended query suite for Actions, C#, and JavaScript/TypeScript; analyses run for the default branch and pull requests. +- **Repository protection** — secret scanning, push protection, Dependabot security updates, vulnerability alerts, and Private Vulnerability Reporting are enabled. +- **Release integrity** — Authenticode signing of all DLLs with a post-sign verification gate; NuGet package signing followed by `dotnet nuget verify`. +- **Credential hygiene** — Azure OIDC federation and NuGet Trusted Publishing use short-lived credentials rather than stored cloud or NuGet publishing secrets. +- **Workflow permissions** — job-scoped `permissions: { id-token: write, contents: read }`. +- **Reproducible dependency install** — `npm ci` against a committed `package-lock.json`. +- **Dependency updates** — Dependabot is configured for weekly GitHub Actions version updates, and repository-level Dependabot security updates are enabled. +- **Managed-code determinism** — the evaluated SDK property `Deterministic` is `true`, and portable PDBs are generated. +- **No unsafe primitives** — no `eval`, `new Function`, `MarkupString`, `AddMarkupContent`, or `AllowUnsafeBlocks` in first-party code. + +## 8. Review and sign-off log + +| Version | Commit | Reviewers | Date | Outcome | +|---|---|---|---|---| +| | | | | | + +Release gate: **no open finding of severity High or above may ship.** Findings themselves are tracked privately (§6). + +## 9. References + +- [Threat mitigation guidance for ASP.NET Core Blazor interactive server-side rendering](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/interactive-server-side-rendering) +- [Call .NET methods from JavaScript functions in ASP.NET Core Blazor](https://learn.microsoft.com/en-us/aspnet/core/blazor/javascript-interoperability/call-dotnet-from-javascript) +- [Call JavaScript functions from .NET methods in ASP.NET Core Blazor](https://learn.microsoft.com/en-us/aspnet/core/blazor/javascript-interoperability/call-javascript-from-dotnet) +- [Enforce a Content Security Policy for ASP.NET Core Blazor](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/content-security-policy) +- [Microsoft SDL — Threat Modeling](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) +- [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +- [GitHub — About code scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) +- [GitHub — Configuring default setup for code scanning](https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning) +- [GitHub — Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/privately-reporting-a-security-vulnerability) +- [GitHub — Security hardening for GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) +- [NuGet Trusted Publishing](https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing)