[
https://issues.apache.org/jira/browse/WICKET-7190?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105474#comment-18105474
]
ASF subversion and git services commented on WICKET-7190:
---------------------------------------------------------
Commit e1c2f265082461f629daee38ec8806c9139ceeca in wicket's branch
refs/heads/document-security-model from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=e1c2f26508 ]
WICKET-7190 Verify the upload token by decrypting it
The signed upload settings introduced in 483b83ca62 were validated by
re-encrypting the expected settings and comparing the resulting ciphertext
to the token supplied by the client. That only worked because the default
crypt at the time was deterministic PBE: the same plaintext always produced
the same ciphertext.
SchemeCrypt encrypts with a fresh random nonce per message, as an AEAD mode
must, so no two encryptions of the same settings agree and the comparison
never succeeds - every upload through FileUploadToResourceField was rejected.
Validate the token by decrypting it and comparing the settings it carries
instead. The authentication tag is what makes the token unforgeable, and
decryption returns null for anything tampered with, so the check keeps
rejecting a client that alters the limits.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> Unified cryptography API
> ------------------------
>
> Key: WICKET-7190
> URL: https://issues.apache.org/jira/browse/WICKET-7190
> Project: Wicket
> Issue Type: New Feature
> Components: wicket-core
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
> Fix For: 11.0.0
>
>
> The current cryptography API in Wicket is split over {{ICrypt}} and
> {{ICrypter}}. Both APIs serve a similar purpose but for different subsystems.
> The goal is to unify these APIs and to allow the implementation of more
> modern ciphers, with AEAD support. Also, the documentation on this API and
> its implementations must be improved, clearly stating what it does and what
> it does not deliver.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
