[jira] [Commented] (WICKET-5327) CryptoMapper: insecure default encryption provider

["ASF subversion and git services (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WICKET-5327?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14206433#comment-14206433 ] 

ASF subversion and git services commented on WICKET-5327:
---------------------------------------------------------

Commit b5307cc09f8ee4238b8e3d3b1f54a729ee88c740 in wicket's branch refs/heads/5756-improve-crypt from svenmeier
[ https://git-wip-us.apache.org/repos/asf?p=wicket.git;h=b5307cc ]

WICKET-5327 write warning to stderr for insecure default crypt key

(cherry picked from commit d7b13f72f418bb7f300bbc3ac14fdb6e094f20a6)


> CryptoMapper: insecure default encryption provider
> --------------------------------------------------
>
>                 Key: WICKET-5327
>                 URL: https://issues.apache.org/jira/browse/WICKET-5327
>             Project: Wicket
>          Issue Type: Improvement
>    Affects Versions: 6.10.0
>            Reporter: Walter B. Rasmann
>            Assignee: Sven Meier
>              Labels: security
>             Fix For: 7.0.0-M1
>
>
> There is an unexpected and insecure default setting for the encryption provider.
> When CryptoMapper is enabled using
> setRootRequestMapper(new CryptoMapper(getRootRequestMapper(), this));
> or
>                 
> CompoundRequestMapper root = new CompoundRequestMapper();
> root.add(new CryptoMapper(getRootRequestMapper(), this));
> setRootRequestMapper(root);
> Wicket uses "new CachingSunJceCryptFactory(ISecuritySettings.DEFAULT_ENCRYPTION_KEY)" as the CryptFactory, with ISecuritySettings.DEFAULT_ENCRYPTION_KEY being "WiCkEt-FRAMEwork". This generates always the same encrypted strings for each of the URLs and is possibly not a secure way to encrypt URLs even if the encryption key is unknown.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)