This is an automated email from the ASF dual-hosted git repository. papegaaij pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 2cc4c3b40a2c1b931955221a02629daccd2ec0c5 Merge: 225f119052 fb394dc89c Author: Emond Papegaaij <[email protected]> AuthorDate: Tue Aug 18 16:04:50 2026 +0200 Merge branch 'crypt-unification' Brings in WICKET-7190, which replaces the crypt subsystem with a single scheme-based API. ICryptScheme and SchemeCrypt, backed by AES-GCM and AES-GCM-SIV, take over from ICrypt/AbstractCrypt/SunJceCrypt in wicket-util, from AESCrypt and the KeyInSession factories in wicket-core, and from the pageStore ICrypter family. Encrypted pages are now bound to their page id via AEAD associated data, and CryptoMapper encrypts deterministically so resource URLs stay cacheable. The only conflicts were four modify/delete pairs against 848fefaefb, which had documented AESCrypt, AbstractJceCrypt, AbstractCrypt and SunJceCrypt as unauthenticated and malleable. This branch removes all four and replaces them with AEAD schemes, so the deletions were taken and that javadoc goes with them. SECURITY.md merged cleanly; the scope and reporting sections from master sit alongside the new page store and deterministic-URL sections from the branch. Note for anyone hitting a red build: japicmp is still configured to compare against 10.0.0 and now fails for wicket-util and wicket-core on the removed crypt API. Those removals are intentional for the 11 line, and the baseline needs revisiting separately. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> SECURITY.md | 40 ++- .../mapper/CryptoMapperResourceStabilityTest.java | 113 +++++++ .../core/request/mapper/CryptoMapperTest.java | 155 +++++++-- .../wicket/core/util/crypt/AESCryptTest.java | 54 ---- .../wicket/core/util/crypt/CryptFactoryTest.java | 75 +++++ .../wicket/core/util/crypt/SchemeCryptTest.java | 301 +++++++++++++++++ .../markup/html/form/encryption/CryptTest.java | 36 +-- .../wicket/pageStore/CryptingPageStoreTest.java | 112 ++++--- .../CryptedUrlWebRequestCodingStrategyTest.java | 21 +- wicket-core/pom.xml | 1 - wicket-core/src/main/java/module-info.java | 1 - .../strategy/DefaultAuthenticationStrategy.java | 12 +- .../wicket/core/request/mapper/CryptoMapper.java | 35 +- .../apache/wicket/core/util/crypt/AESCrypt.java | 145 --------- .../core/util/crypt/AbstractAesGcmCryptScheme.java | 217 +++++++++++++ .../core/util/crypt/AbstractCryptFactory.java | 74 +++++ .../wicket/core/util/crypt/AbstractJceCrypt.java | 99 ------ .../crypt/AbstractKeyInSessionCryptFactory.java | 86 ----- .../wicket/core/util/crypt/AesGcmCryptScheme.java | 59 ++++ .../core/util/crypt/AesGcmSivCryptScheme.java | 60 ++++ .../util/crypt/ApplicationKeyCryptFactory.java | 75 +++++ .../org/apache/wicket/core/util/crypt/ICrypt.java | 185 +++++++++++ .../wicket/core}/util/crypt/ICryptFactory.java | 12 +- .../wicket/core/util/crypt/ICryptScheme.java | 120 +++++++ .../core/util/crypt/KeyInSessionCryptFactory.java | 57 ++++ .../util/crypt/KeyInSessionSunJceCryptFactory.java | 115 ------- .../apache/wicket/core}/util/crypt/NoCrypt.java | 60 ++-- .../wicket/core}/util/crypt/NoCryptFactory.java | 11 +- .../apache/wicket/core/util/crypt/SchemeCrypt.java | 151 +++++++++ .../resource/AbstractFileUploadResource.java | 18 +- .../apache/wicket/pageStore/CryptingPageStore.java | 359 +++++++++++---------- .../wicket/pageStore/crypt/DefaultCrypter.java | 115 ------- .../wicket/pageStore/crypt/GCMSIVCrypter.java | 118 ------- .../apache/wicket/pageStore/crypt/ICrypter.java | 46 --- .../apache/wicket/settings/SecuritySettings.java | 102 +++++- .../org/apache/wicket/settings/StoreSettings.java | 45 +-- .../wicket/examples/WicketExampleApplication.java | 2 +- .../src/main/resources/META-INF/rewrite/wicket.yml | 41 +++ .../src/main/asciidoc/internals/pagestoring.adoc | 23 +- .../src/main/asciidoc/security/security_4.adoc | 52 ++- .../src/main/asciidoc/urls/urls_6.adoc | 4 +- .../apache/wicket/util/crypt/AbstractCrypt.java | 186 ----------- .../util/crypt/CryptFactoryCachingDecorator.java | 53 --- .../java/org/apache/wicket/util/crypt/ICrypt.java | 53 --- .../org/apache/wicket/util/crypt/SunJceCrypt.java | 185 ----------- .../org/apache/wicket/util/crypt/TrivialCrypt.java | 38 --- .../apache/wicket/util/crypt/SunJceCryptTest.java | 74 ----- 47 files changed, 2205 insertions(+), 1791 deletions(-)
