[
https://issues.apache.org/jira/browse/WICKET-7194?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106318#comment-18106318
]
ASF subversion and git services commented on WICKET-7194:
---------------------------------------------------------
Commit 8644190d6759d67ec1134bfeb2cc11dd88b67e21 in wicket's branch
refs/heads/wicket-9.x from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=8644190d67 ]
WICKET-7194 Deprecate the Include component for security reasons
Include fetches the URL its model resolves to and writes the response into the
page body verbatim, so the model value decides three separate things at once:
what the server connects to, what ends up in the page, and how much of it is
read.
Where anything in the request can influence that value, the component reaches
file:, jar: and ftp: URLs as well as hosts only the server can see, because
UrlResourceStream calls URL#openConnection without restricting the scheme; it
puts the response in the page unescaped, because onComponentTagBody hands the
content to replaceComponentTagBody, which writes the body straight to the
response; and it reads without bound, because ResourceUtil#readString buffers
the
whole stream with no size limit while UrlResourceStream sets neither a connect
nor a read timeout. The relative form goes through ServletContext#getResource,
reaching /WEB-INF as well.
None of that is a defect in the implementation. Fetching an arbitrary URL and
splicing its raw content into a page is what the component is for, and
restricting the scheme, the host, the size or the escaping would leave nothing
of
it. It is therefore deprecated with no replacement offered: the secure course is
to stop including remote content rather than to include it differently, so there
is nothing to migrate to. Applications using it for page composition should use
Panels, Borders and markup inheritance instead.
This is the second of the two cases SECURITY.md describes, where the design
rather than the implementation is the problem, and the javadoc says so in as
many
words so that it is clear before reporting. From this release the component is
out of scope for the security process on the same footing as any other
deprecated
code.
The component is removed outright on master, in Wicket 11. The compref example
that demonstrates it is left as it is, per SECURITY.md, which corrects the
examples on master only.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> Deprecate and remove Include
> ----------------------------
>
> Key: WICKET-7194
> URL: https://issues.apache.org/jira/browse/WICKET-7194
> Project: Wicket
> Issue Type: Task
> Components: wicket-core
> Affects Versions: 11.0.0, 9.23.0, 8.18.0, 10.10.0
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
>
> This class allows including markup from external sources into a page. It does
> not contain any form of validation or verification. This is not something we
> want to provide from Wicket core. If users require such a component, it's
> better to write something yourself tailored for the specific environment it
> operates in. This class will be deprecated for security reasons in 8.x, 9.x
> and 10.x and removed in 11.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
