Document the security model and Wicket's trust assumptions - #1535
Open
papegaaij wants to merge 2 commits into
Open
Document the security model and Wicket's trust assumptions#1535papegaaij wants to merge 2 commits into
papegaaij wants to merge 2 commits into
Conversation
Add a SECURITY.md covering how to report a vulnerability privately, the supported release lines, and the trust boundaries the framework assumes. Wicket derives its own scheme, host and port from the servlet container and trusts those values as its identity. They back every absolute URL rendered via UrlRenderer, the scheme-switch redirect in HttpsMapper, and the trusted target URI that OriginResourceIsolationPolicy compares incoming Origin and Referer headers against. Nothing in the framework validates the Host header, because only the deployment knows its canonical hostnames, so state that rejecting unexpected hosts is the container's or reverse proxy's job. Also document that page store encryption protects only as far as the configured ICrypter states, which matters because Wicket deserializes whatever it reads back from the store. DefaultCrypter (AES-256-CBC) is unauthenticated and gives confidentiality only; GCMSIVCrypter (AES-256-GCM-SIV) additionally makes the stored bytes tamper-evident. Touches the javadoc of HttpsMapper, ICrypter and its implementations, and StoreSettings, plus the HTTPS and page storing chapters of the user guide. The supported version table follows the download page. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
States the boundary the resource isolation listener is there to enforce: another origin may not invoke a listener on a page. Also records what sits deliberately outside it, so that neither is mistaken for a defect - a page may still be rendered by a simple top-level navigation from anywhere, and a deployment may choose to trust every origin on its own site. Notes that the listener is opt-in, and that CryptoMapper is not a substitute. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
papegaaij
marked this pull request as ready for review
August 5, 2026 06:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents which inputs Wicket treats as trusted, so that operators know what they are responsible for and reporters know what the framework does and does not claim to defend.
This is documentation only — no behaviour changes.
SECURITY.md(new)Adds the ASF reporting process, supported versions, and a Security Model section stating the framework's trust assumptions:
Hostvalidation, inServletWebRequest#setParameters,HttpsMapper#createRedirectUrl, or — importantly —OriginResourceIsolationPolicy#getTargetUriFromRequest, where the container-reported host becomes the trusted target URI that incomingOrigin/Refererheaders are compared against. Documents the four deployment steps that follow from that.X-Forwarded-*is not trusted by default, andX-Forwarded-Hostis not implemented at all.ResourceIsolationRequestCycleListeneris registered, with the two things deliberately outside that boundary (page renders are allowed; sibling origins can be trusted explicitly).CryptoMapperis not an authorization mechanism.The document is explicit that a report depending on the framework distrusting something the model treats as trusted may be closed as a deployment issue — while a demonstrated bypass of a boundary the model does claim is a vulnerability. Where the code falls short of a stated boundary, the code is what needs fixing.
Javadoc and user guide
HttpsMapper— records that the redirect host comes from the container and that the mapper deliberately performs no hostname validation.security_3.adoc— a section on the redirect host coming from the container, and the deployment configuration that follows.pagestoring.adoc,ICrypter,DefaultCrypter,GCMSIVCrypter,StoreSettings#setCrypter— document that page store encryption does not by itself imply tamper detection, and that the defaultDefaultCrypter(AES-256-CBC) is unauthenticated whileGCMSIVCrypteris not.Note on the crypter documentation
That last item documents the page store as it behaves on
mastertoday. #1536 supersedes it: every shipped scheme becomes authenticated, so the caveat no longer applies and those passages are rewritten there. This PR is the base of that one, so the two are best read in order.🤖 Generated with Claude Code