papegaaij opened a new pull request, #1535:
URL: https://github.com/apache/wicket/pull/1535

   Documents which inputs Wicket treats as trusted, so that operators know what 
they are responsible for and reporters know what the framework does and does 
not claim to defend.
   
   This is documentation only — no behaviour changes.
   
   ### `SECURITY.md` (new)
   
   Adds the ASF reporting process, supported versions, and a **Security Model** 
section stating the framework's trust assumptions:
   
   - **The container-reported host, port and scheme are trusted.** There is no 
hostname allowlist and no `Host` validation, in 
`ServletWebRequest#setParameters`, `HttpsMapper#createRedirectUrl`, or — 
importantly — `OriginResourceIsolationPolicy#getTargetUriFromRequest`, where 
the container-reported host becomes the *trusted* target URI that incoming 
`Origin`/`Referer` headers are compared against. Documents the four deployment 
steps that follow from that.
   - **`X-Forwarded-*` is not trusted by default**, and `X-Forwarded-Host` is 
not implemented at all.
   - **Client-supplied URLs are not trusted for authority** — the Ajax base URL 
can influence the path, never the authority.
   - **Serialized data is trusted** — the page store and session store are 
trusted, private storage.
   - **Another origin may not invoke a listener** where 
`ResourceIsolationRequestCycleListener` is registered, with the two things 
deliberately outside that boundary (page renders are allowed; sibling origins 
can be trusted explicitly).
   - **`CryptoMapper` is not an authorization mechanism.**
   
   The document is explicit that a report depending on the framework 
distrusting something the model treats as trusted may be closed as a deployment 
issue — while a demonstrated bypass of a boundary the model *does* claim is a 
vulnerability. Where the code falls short of a stated boundary, the code is 
what needs fixing.
   
   ### Javadoc and user guide
   
   - `HttpsMapper` — records that the redirect host comes from the container 
and that the mapper deliberately performs no hostname validation.
   - `security_3.adoc` — a section on the redirect host coming from the 
container, and the deployment configuration that follows.
   - `pagestoring.adoc`, `ICrypter`, `DefaultCrypter`, `GCMSIVCrypter`, 
`StoreSettings#setCrypter` — document that page store encryption does not by 
itself imply tamper detection, and that the default `DefaultCrypter` 
(AES-256-CBC) is unauthenticated while `GCMSIVCrypter` is not.
   
   ### Note on the crypter documentation
   
   That last item documents the page store as it behaves on `master` today. the 
crypt unification PR that builds on it supersedes it by making every shipped 
scheme authenticated, and rewrites these passages accordingly. This PR is the 
base of that one, so the two are best read in order.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to