This is an automated email from the ASF dual-hosted git repository. papegaaij pushed a commit to branch wicket-8.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 805788eedf8e81983ed6f8aff76366c858973b55 Author: Emond Papegaaij <[email protected]> AuthorDate: Mon Aug 17 21:25:21 2026 +0200 Document that the URL and cookie crypt is not authenticated The crypt behind CryptoMapper and the remember-me cookie in DefaultAuthenticationStrategy never said that it offers confidentiality without tamper detection, and on 8.x there is no page store crypter whose javadoc says it either. SunJceCrypt (PBEWithMD5AndDES, which is DES in CBC mode) now states that the ciphertext is malleable, that its integrity is not verified on decryption, and that a successful decryption is therefore no evidence the value was not tampered with. It points at SECURITY.md and at CryptoMapper for why encrypted URLs are not an access-control mechanism, referring to both with {@code} since wicket-util does not depend on wicket-core. AbstractCrypt picks no mode itself, so it carries the shorter form and points subclasses at AEAD. 8.x has no AES implementation at all, so unlike the 9.x, 10.x and master copies of this change there is no AESCrypt or AbstractJceCrypt to annotate. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../main/java/org/apache/wicket/util/crypt/AbstractCrypt.java | 9 ++++++++- .../main/java/org/apache/wicket/util/crypt/SunJceCrypt.java | 11 ++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/wicket-util/src/main/java/org/apache/wicket/util/crypt/AbstractCrypt.java b/wicket-util/src/main/java/org/apache/wicket/util/crypt/AbstractCrypt.java index da8155ec1a..4f1c40fa22 100644 --- a/wicket-util/src/main/java/org/apache/wicket/util/crypt/AbstractCrypt.java +++ b/wicket-util/src/main/java/org/apache/wicket/util/crypt/AbstractCrypt.java @@ -29,7 +29,14 @@ import org.slf4j.LoggerFactory; /** * Abstract base class for JCE based ICrypt implementations. - * + * <p> + * This class does not choose a cipher mode, but the implementations shipped with Wicket use + * unauthenticated ones and so provide confidentiality only - see {@link SunJceCrypt}. A value that + * decrypts without error has therefore not been shown to be unmodified, and callers must not treat + * successful decryption as proof of integrity. Subclasses that want tamper detection should use an + * AEAD cipher mode (such as GCM, GCM-SIV or CCM) rather than layering something on top of an + * unauthenticated mode. + * * @author Juergen Donnerstag */ public abstract class AbstractCrypt implements ICrypt diff --git a/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java b/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java index b702851f7a..7e75b55703 100644 --- a/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java +++ b/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java @@ -36,7 +36,16 @@ import org.apache.wicket.util.lang.Args; * implementation is based around Sun's security providers and uses the <a * href="http://www.ietf.org/rfc/rfc2898.txt";>PBEWithMD5AndDES</a> method to encrypt and decrypt the * data. - * + * <p> + * <strong>This implementation is not authenticated and provides confidentiality only.</strong> + * {@code PBEWithMD5AndDES} is DES in CBC mode: the ciphertext is malleable and its integrity is not + * verified on decryption, so someone able to modify an encrypted value may change what it decrypts + * to instead of being detected. Never treat the fact that a value was encrypted as evidence that it + * has not been tampered with, and never use encryption here in place of an authorization check. + * Passing another {@code cryptMethod} does not by itself change this. See {@code SECURITY.md} for + * the trust assumptions Wicket makes here, and {@code CryptoMapper} for why encrypted URLs are not + * an access-control mechanism. + * * @author Juergen Donnerstag */ public class SunJceCrypt extends AbstractCrypt
