This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/wicket.git
from 225f119052 restrict SourcesPage to resources of the page's own package
(#1523)
add 09e05c3d98 WICKET-7190 Unify and harden the cryptography subsystem
(Wicket 11)
add 31b7ce12f6 WICKET-7190 Bind encrypted pages to their page id via AEAD
associated data
add 6b85d7c81a WICKET-7190 Let the crypt scheme generate its own key
add 33eaf71733 WICKET-7190 Update the user guide for the redesigned crypt
API
add e1c2f26508 WICKET-7190 Verify the upload token by decrypting it
add a1864aeaf6 WICKET-7190 State the page store trust boundary on the
crypt API
add fb394dc89c WICKET-7190 Encrypt URLs deterministically so they stay
cacheable
new 2cc4c3b40a Merge branch 'crypt-unification'
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
SECURITY.md | 40 ++-
.../mapper/CryptoMapperResourceStabilityTest.java | 113 +++++++
.../core/request/mapper/CryptoMapperTest.java | 155 +++++++--
.../wicket/core/util/crypt/AESCryptTest.java | 54 ----
.../wicket/core/util/crypt/CryptFactoryTest.java | 75 +++++
.../wicket/core/util/crypt/SchemeCryptTest.java | 301 +++++++++++++++++
.../markup/html/form/encryption/CryptTest.java | 36 +--
.../wicket/pageStore/CryptingPageStoreTest.java | 112 ++++---
.../CryptedUrlWebRequestCodingStrategyTest.java | 21 +-
wicket-core/pom.xml | 1 -
wicket-core/src/main/java/module-info.java | 1 -
.../strategy/DefaultAuthenticationStrategy.java | 12 +-
.../wicket/core/request/mapper/CryptoMapper.java | 35 +-
.../apache/wicket/core/util/crypt/AESCrypt.java | 145 ---------
.../core/util/crypt/AbstractAesGcmCryptScheme.java | 217 +++++++++++++
.../core/util/crypt/AbstractCryptFactory.java | 74 +++++
.../wicket/core/util/crypt/AbstractJceCrypt.java | 99 ------
.../crypt/AbstractKeyInSessionCryptFactory.java | 86 -----
.../wicket/core/util/crypt/AesGcmCryptScheme.java | 59 ++++
.../core/util/crypt/AesGcmSivCryptScheme.java | 60 ++++
.../util/crypt/ApplicationKeyCryptFactory.java | 75 +++++
.../org/apache/wicket/core/util/crypt/ICrypt.java | 185 +++++++++++
.../wicket/core}/util/crypt/ICryptFactory.java | 12 +-
.../wicket/core/util/crypt/ICryptScheme.java | 120 +++++++
.../core/util/crypt/KeyInSessionCryptFactory.java | 57 ++++
.../util/crypt/KeyInSessionSunJceCryptFactory.java | 115 -------
.../apache/wicket/core}/util/crypt/NoCrypt.java | 60 ++--
.../wicket/core}/util/crypt/NoCryptFactory.java | 11 +-
.../apache/wicket/core/util/crypt/SchemeCrypt.java | 151 +++++++++
.../resource/AbstractFileUploadResource.java | 18 +-
.../apache/wicket/pageStore/CryptingPageStore.java | 359 +++++++++++----------
.../wicket/pageStore/crypt/DefaultCrypter.java | 115 -------
.../wicket/pageStore/crypt/GCMSIVCrypter.java | 118 -------
.../apache/wicket/pageStore/crypt/ICrypter.java | 46 ---
.../apache/wicket/settings/SecuritySettings.java | 102 +++++-
.../org/apache/wicket/settings/StoreSettings.java | 45 +--
.../wicket/examples/WicketExampleApplication.java | 2 +-
.../src/main/resources/META-INF/rewrite/wicket.yml | 41 +++
.../src/main/asciidoc/internals/pagestoring.adoc | 23 +-
.../src/main/asciidoc/security/security_4.adoc | 52 ++-
.../src/main/asciidoc/urls/urls_6.adoc | 4 +-
.../apache/wicket/util/crypt/AbstractCrypt.java | 186 -----------
.../util/crypt/CryptFactoryCachingDecorator.java | 53 ---
.../java/org/apache/wicket/util/crypt/ICrypt.java | 53 ---
.../org/apache/wicket/util/crypt/SunJceCrypt.java | 185 -----------
.../org/apache/wicket/util/crypt/TrivialCrypt.java | 38 ---
.../apache/wicket/util/crypt/SunJceCryptTest.java | 74 -----
47 files changed, 2205 insertions(+), 1791 deletions(-)
create mode 100644
wicket-core-tests/src/test/java/org/apache/wicket/core/request/mapper/CryptoMapperResourceStabilityTest.java
delete mode 100644
wicket-core-tests/src/test/java/org/apache/wicket/core/util/crypt/AESCryptTest.java
create mode 100644
wicket-core-tests/src/test/java/org/apache/wicket/core/util/crypt/CryptFactoryTest.java
create mode 100644
wicket-core-tests/src/test/java/org/apache/wicket/core/util/crypt/SchemeCryptTest.java
delete mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/AESCrypt.java
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/AbstractAesGcmCryptScheme.java
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/AbstractCryptFactory.java
delete mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/AbstractJceCrypt.java
delete mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/AbstractKeyInSessionCryptFactory.java
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/AesGcmCryptScheme.java
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/AesGcmSivCryptScheme.java
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/ApplicationKeyCryptFactory.java
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/ICrypt.java
rename {wicket-util/src/main/java/org/apache/wicket =>
wicket-core/src/main/java/org/apache/wicket/core}/util/crypt/ICryptFactory.java
(67%)
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/ICryptScheme.java
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/KeyInSessionCryptFactory.java
delete mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/KeyInSessionSunJceCryptFactory.java
rename {wicket-util/src/main/java/org/apache/wicket =>
wicket-core/src/main/java/org/apache/wicket/core}/util/crypt/NoCrypt.java (50%)
rename {wicket-util/src/main/java/org/apache/wicket =>
wicket-core/src/main/java/org/apache/wicket/core}/util/crypt/NoCryptFactory.java
(77%)
create mode 100644
wicket-core/src/main/java/org/apache/wicket/core/util/crypt/SchemeCrypt.java
delete mode 100644
wicket-core/src/main/java/org/apache/wicket/pageStore/crypt/DefaultCrypter.java
delete mode 100644
wicket-core/src/main/java/org/apache/wicket/pageStore/crypt/GCMSIVCrypter.java
delete mode 100644
wicket-core/src/main/java/org/apache/wicket/pageStore/crypt/ICrypter.java
delete mode 100644
wicket-util/src/main/java/org/apache/wicket/util/crypt/AbstractCrypt.java
delete mode 100644
wicket-util/src/main/java/org/apache/wicket/util/crypt/CryptFactoryCachingDecorator.java
delete mode 100644
wicket-util/src/main/java/org/apache/wicket/util/crypt/ICrypt.java
delete mode 100644
wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java
delete mode 100644
wicket-util/src/main/java/org/apache/wicket/util/crypt/TrivialCrypt.java
delete mode 100644
wicket-util/src/test/java/org/apache/wicket/util/crypt/SunJceCryptTest.java
