[CONF] Apache Tapestry > Assets

[Bob Harner (Confluence)]

{footnote}Never create such back doors, of course!{footnote} (Never create such back doors, of course!) Fortunately, this can't happen. Files with extension ".class" are secured; they must be accompanied in the URL with a query parameter that is the MD5 hash of the file's contents. If the query parameter is absent, or doesn't match the actual file's content, the request is rejected. When your code exposes an Asset, the URL will automatically include the query parameter if the file type is secured. The malicious user is locked out of access to the files Bob Harner edited the page: Assets Comment: Resolved broken footnotes by making them parenthetical (unfortunately) ... Your Login page exposes a classpath asset, icon.png. A malicious client copies the URL, /assets/1.0.0/app/pages/icon.png , Wiki Markup {footnote}This would indicate that the Login page is actually inside a library, which is unlikely. More likely, {{icon.png}} is a context asset and the malicious user guessed the path for {{Login.class}} by looking at the Tapestry source code.{footnote} (which would indicate that the Login page is actually inside a library, which is unlikely. More likely, icon.png is a context asset and the malicious user guessed the path for Login.class by looking at the Tapestry source code.) and changes the file name to Login.class. The client decompiles the class file and spots your secret emergency password: goodbye security! Wiki Markup Wiki Markup {footnote}Unless they already have the files so that they can generate the MD5 checksum ... to get access to the files they already have.{footnote} .   . (Unless they already have the files so that they can generate the MD5 checksum ... to get access to the files they already have.) By default, Tapestry secures file extensions ".class', ".tml" and ".properties". The list can be extended by contributing to the ResourceDigestGenerator service: ... Code Block title AppModule.java (partial) language java @Contribute(ResourceMinimizer.class) @Primary public static void contributeMinimizers(MappedConfiguration<String, ResourceMinimizer> configuration) { configuration.addInstance("text/coffeescript", CoffeeScriptMinimizer.class); }     Wiki Markup {display-footnotes}   View Online · Like · View Changes Stop watching space · Manage Notifications This message was sent by Atlassian Confluence 5.0.3, Team Collaboration Software