papegaaij opened a new pull request, #1535: URL: https://github.com/apache/wicket/pull/1535
Documents which inputs Wicket treats as trusted, so that operators know what they are responsible for and reporters know what the framework does and does not claim to defend. This is documentation only — no behaviour changes. ### `SECURITY.md` (new) Adds the ASF reporting process, supported versions, and a **Security Model** section stating the framework's trust assumptions: - **The container-reported host, port and scheme are trusted.** There is no hostname allowlist and no `Host` validation, in `ServletWebRequest#setParameters`, `HttpsMapper#createRedirectUrl`, or — importantly — `OriginResourceIsolationPolicy#getTargetUriFromRequest`, where the container-reported host becomes the *trusted* target URI that incoming `Origin`/`Referer` headers are compared against. Documents the four deployment steps that follow from that. - **`X-Forwarded-*` is not trusted by default**, and `X-Forwarded-Host` is not implemented at all. - **Client-supplied URLs are not trusted for authority** — the Ajax base URL can influence the path, never the authority. - **Serialized data is trusted** — the page store and session store are trusted, private storage. - **Another origin may not invoke a listener** where `ResourceIsolationRequestCycleListener` is registered, with the two things deliberately outside that boundary (page renders are allowed; sibling origins can be trusted explicitly). - **`CryptoMapper` is not an authorization mechanism.** The document is explicit that a report depending on the framework distrusting something the model treats as trusted may be closed as a deployment issue — while a demonstrated bypass of a boundary the model *does* claim is a vulnerability. Where the code falls short of a stated boundary, the code is what needs fixing. ### Javadoc and user guide - `HttpsMapper` — records that the redirect host comes from the container and that the mapper deliberately performs no hostname validation. - `security_3.adoc` — a section on the redirect host coming from the container, and the deployment configuration that follows. - `pagestoring.adoc`, `ICrypter`, `DefaultCrypter`, `GCMSIVCrypter`, `StoreSettings#setCrypter` — document that page store encryption does not by itself imply tamper detection, and that the default `DefaultCrypter` (AES-256-CBC) is unauthenticated while `GCMSIVCrypter` is not. ### Note on the crypter documentation That last item documents the page store as it behaves on `master` today. the crypt unification PR that builds on it supersedes it by making every shipped scheme authenticated, and rewrites these passages accordingly. This PR is the base of that one, so the two are best read in order. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
