Package org.apache.wicket.core.request.mapper

Class CryptoMapper

  • All Implemented Interfaces:
    org.apache.wicket.request.IRequestMapper, org.apache.wicket.request.mapper.IRequestMapperDelegate
    public class CryptoMapper
extends java.lang.Object
implements org.apache.wicket.request.mapper.IRequestMapperDelegate

    A request mapper that encrypts URLs generated by another mapper. This mapper encrypts the segments and query parameters of URLs starting with IMapperContext.getNamespace(), and just the PageComponentInfo parameter for mounted URLs.

    Important: for better security it is recommended to use CryptoMapper(IRequestMapper, Supplier) constructor with ICrypt implementation that generates a separate key for each user. KeyInSessionSunJceCryptFactory provides such an implementation that stores the key in the HTTP session.

    This mapper can be mounted before or after mounting other pages, but will only encrypt URLs for pages mounted before the CryptoMapper. If required, multiple CryptoMappers may be installed in an Application.

    When encrypting URLs in the Wicket namespace (starting with IMapperContext.getNamespace()), the entire URL, including segments and parameters, is encrypted, with the encrypted form stored in the first segment of the encrypted URL.

    To be able to handle relative URLs, like for image URLs in a CSS file, checksum segments are appended to the encrypted URL until the encrypted URL has the same number of segments as the original URL had. Each checksum segment has a precise 5 character value, calculated using a checksum. This helps in calculating the relative distance from the original URL. When a URL is returned by the browser, we iterate through these checksummed placeholder URL segments. If the segment matches the expected checksum, then the segment is deemed to be the corresponding segment in the original URL. If the segment does not match the expected checksum, then the segment is deemed a plain text sibling of the corresponding segment in the original URL, and all subsequent segments are considered plain text children of the current segment.

    When encrypting mounted URLs, we look for the PageComponentInfo parameter, and encrypt only that parameter.

    CryptoMapper can be configured to mark encrypted URLs as encrypted, and throw a PageExpiredException exception if a encrypted URL cannot be decrypted. This can occur when using KeyInSessionSunJceCryptFactory, and the session has expired.

    Author:
    igor.vaynberg, Jesse Long, svenmeier
    See Also:
    SecuritySettings.setCryptFactory(org.apache.wicket.util.crypt.ICryptFactory), KeyInSessionSunJceCryptFactory, SunJceCrypt

    • Constructor Summary

      Constructors 
      Constructor Description
      CryptoMapper​(org.apache.wicket.request.IRequestMapper wrappedMapper, java.util.function.Supplier<org.apache.wicket.util.crypt.ICrypt> cryptProvider)
      Construct.
      CryptoMapper​(org.apache.wicket.request.IRequestMapper wrappedMapper, Application application)
      Encrypt with SecuritySettings.getCryptFactory().

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected org.apache.wicket.request.Url decryptEntireUrl​(org.apache.wicket.request.Request request, org.apache.wicket.request.Url encryptedUrl)
      Decrypts an entire URL, which was previously encrypted by encryptEntireUrl(org.apache.wicket.request.Url).
      protected org.apache.wicket.request.Url decryptRequestListenerParameter​(org.apache.wicket.request.Request request, org.apache.wicket.request.Url encryptedUrl)
      Decrypts a URL which may contain an encrypted PageComponentInfo query parameter.
      protected org.apache.wicket.request.Url decryptUrl​(org.apache.wicket.request.Request request, org.apache.wicket.request.Url encryptedUrl)
      Decrypts a Url.
      protected org.apache.wicket.request.Url encryptEntireUrl​(org.apache.wicket.request.Url url)
      Encrypts an entire URL, segments and query parameters.
      protected org.apache.wicket.request.Url encryptRequestListenerParameter​(org.apache.wicket.request.Url url)
      Encrypts the PageComponentInfo query parameter in the URL, if any is found.
      protected org.apache.wicket.request.Url encryptUrl​(org.apache.wicket.request.Url url)
      Encrypts a URL.
      int getCompatibilityScore​(org.apache.wicket.request.Request request)
      protected IMapperContext getContext()
      Returns the applications IMapperContext.
      protected org.apache.wicket.util.crypt.ICrypt getCrypt()  
      org.apache.wicket.request.IRequestMapper getDelegateMapper()  
      boolean getMarkEncryptedUrls()
      Whether or not to mark encrypted URLs as encrypted.
      org.apache.wicket.request.Url mapHandler​(org.apache.wicket.request.IRequestHandler requestHandler)  
      org.apache.wicket.request.IRequestHandler mapRequest​(org.apache.wicket.request.Request request)  
      CryptoMapper setMarkEncryptedUrls​(boolean markEncryptedUrls)
      Sets whether or not to mark encrypted URLs as encrypted.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • CryptoMapper

        public CryptoMapper​(org.apache.wicket.request.IRequestMapper wrappedMapper,
                    java.util.function.Supplier<org.apache.wicket.util.crypt.ICrypt> cryptProvider)
        Construct.
        Parameters:
        wrappedMapper - the non-crypted request mapper
        cryptProvider - the custom crypt provider

    • Method Detail

      • getMarkEncryptedUrls

        public boolean getMarkEncryptedUrls()
        Whether or not to mark encrypted URLs as encrypted. If set, a PageExpiredException is thrown when a encrypted URL can no longer be decrypted.
        Returns:
        whether or not to mark encrypted URLs as encrypted.

      • setMarkEncryptedUrls

        public CryptoMapper setMarkEncryptedUrls​(boolean markEncryptedUrls)
        Sets whether or not to mark encrypted URLs as encrypted. If set, a PageExpiredException is thrown when a encrypted URL can no longer be decrypted.
        Parameters:
        markEncryptedUrls - whether or not to mark encrypted URLs as encrypted.
        Returns:
        this, for chaining.

      • getCompatibilityScore

        public int getCompatibilityScore​(org.apache.wicket.request.Request request)

        This implementation decrypts the URL and passes the decrypted URL to the wrapped mapper.

        Specified by:
        getCompatibilityScore in interface org.apache.wicket.request.IRequestMapper
        Parameters:
        request - The request for which to get a compatibility score.
        Returns:
        The compatibility score.

      • mapHandler

        public org.apache.wicket.request.Url mapHandler​(org.apache.wicket.request.IRequestHandler requestHandler)
        Specified by:
        mapHandler in interface org.apache.wicket.request.IRequestMapper

      • mapRequest

        public org.apache.wicket.request.IRequestHandler mapRequest​(org.apache.wicket.request.Request request)
        Specified by:
        mapRequest in interface org.apache.wicket.request.IRequestMapper

      • getCrypt

        protected final org.apache.wicket.util.crypt.ICrypt getCrypt()
        Returns:
        the ICrypt implementation that may be used to encrypt/decrypt Url's segments and/or query string

      • getDelegateMapper

        public final org.apache.wicket.request.IRequestMapper getDelegateMapper()
        Specified by:
        getDelegateMapper in interface org.apache.wicket.request.mapper.IRequestMapperDelegate
        Returns:
        the wrapped root request mapper

      • encryptUrl

        protected org.apache.wicket.request.Url encryptUrl​(org.apache.wicket.request.Url url)
        Encrypts a URL. This method should return a new, encrypted instance of the URL. If the URL starts with /wicket/, the entire URL is encrypted.
        Parameters:
        url - The URL to encrypt.
        Returns:
        A new, encrypted version of the URL.

      • encryptEntireUrl

        protected org.apache.wicket.request.Url encryptEntireUrl​(org.apache.wicket.request.Url url)
        Encrypts an entire URL, segments and query parameters.
        Parameters:
        url - The URL to encrypt.
        Returns:
        An encrypted form of the URL.

      • encryptRequestListenerParameter

        protected org.apache.wicket.request.Url encryptRequestListenerParameter​(org.apache.wicket.request.Url url)
        Encrypts the PageComponentInfo query parameter in the URL, if any is found.
        Parameters:
        url - The URL to encrypt.
        Returns:
        An encrypted form of the URL.

      • decryptUrl

        protected org.apache.wicket.request.Url decryptUrl​(org.apache.wicket.request.Request request,
                                                   org.apache.wicket.request.Url encryptedUrl)
        Decrypts a Url. This method should return null if the URL is not decryptable, or if the URL should have been encrypted but was not. Returning null results in a 404 error.
        Parameters:
        request - The Request.
        encryptedUrl - The encrypted Url.
        Returns:
        Returns a decrypted Url.

      • decryptEntireUrl

        protected org.apache.wicket.request.Url decryptEntireUrl​(org.apache.wicket.request.Request request,
                                                         org.apache.wicket.request.Url encryptedUrl)
        Decrypts an entire URL, which was previously encrypted by encryptEntireUrl(org.apache.wicket.request.Url). This method should return null if the URL is not decryptable.
        Parameters:
        request - The request that was made.
        encryptedUrl - The encrypted URL.
        Returns:
        A decrypted form of the URL, or null if the URL is not decryptable.

      • decryptRequestListenerParameter

        protected org.apache.wicket.request.Url decryptRequestListenerParameter​(org.apache.wicket.request.Request request,
                                                                        org.apache.wicket.request.Url encryptedUrl)
        Decrypts a URL which may contain an encrypted PageComponentInfo query parameter.
        Parameters:
        request - The request that was made.
        encryptedUrl - The (potentially) encrypted URL.
        Returns:
        A decrypted form of the URL.