Updated Branches: refs/heads/master 9ea38ad79 -> d7b13f72f
WICKET-5327 write warning to stderr for insecure default crypt key Project: http://git-wip-us.apache.org/repos/asf/wicket/repo Commit: http://git-wip-us.apache.org/repos/asf/wicket/commit/d7b13f72 Tree: http://git-wip-us.apache.org/repos/asf/wicket/tree/d7b13f72 Diff: http://git-wip-us.apache.org/repos/asf/wicket/diff/d7b13f72 Branch: refs/heads/master Commit: d7b13f72f418bb7f300bbc3ac14fdb6e094f20a6 Parents: 9ea38ad Author: svenmeier <[email protected]> Authored: Thu Nov 28 20:25:40 2013 +0100 Committer: svenmeier <[email protected]> Committed: Thu Nov 28 20:25:40 2013 +0100 ---------------------------------------------------------------------- .../wicket/settings/def/SecuritySettings.java | 11 +++++++ .../core/request/mapper/CryptoMapperTest.java | 30 +++++++++++++++++--- 2 files changed, 37 insertions(+), 4 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/wicket/blob/d7b13f72/wicket-core/src/main/java/org/apache/wicket/settings/def/SecuritySettings.java ---------------------------------------------------------------------- diff --git a/wicket-core/src/main/java/org/apache/wicket/settings/def/SecuritySettings.java b/wicket-core/src/main/java/org/apache/wicket/settings/def/SecuritySettings.java index bc73feb..96d66c8 100644 --- a/wicket-core/src/main/java/org/apache/wicket/settings/def/SecuritySettings.java +++ b/wicket-core/src/main/java/org/apache/wicket/settings/def/SecuritySettings.java @@ -98,12 +98,23 @@ public class SecuritySettings } /** + * Note: Prints a warning to stderr if no factory was set and {@link #DEFAULT_ENCRYPTION_KEY} is + * used instead. + * * @return crypt factory used to generate crypt objects */ public synchronized ICryptFactory getCryptFactory() { if (cryptFactory == null) { + System.err + .print("********************************************************************\n" + + "*** WARNING: Wicket is using a DEFAULT_ENCRYPTION_KEY ***\n" + + "*** ^^^^^^^^^^^^^^^^^^^^^^ ***\n" + + "*** Do NOT deploy to your live server(s) without changing this. ***\n" + + "*** See SecuritySettings#setCryptFactory() for more information. ***\n" + + "********************************************************************\n"); + cryptFactory = new CachingSunJceCryptFactory(DEFAULT_ENCRYPTION_KEY); } return cryptFactory; http://git-wip-us.apache.org/repos/asf/wicket/blob/d7b13f72/wicket-core/src/test/java/org/apache/wicket/core/request/mapper/CryptoMapperTest.java ---------------------------------------------------------------------- diff --git a/wicket-core/src/test/java/org/apache/wicket/core/request/mapper/CryptoMapperTest.java b/wicket-core/src/test/java/org/apache/wicket/core/request/mapper/CryptoMapperTest.java index 5bef307..7377e72 100644 --- a/wicket-core/src/test/java/org/apache/wicket/core/request/mapper/CryptoMapperTest.java +++ b/wicket-core/src/test/java/org/apache/wicket/core/request/mapper/CryptoMapperTest.java @@ -35,6 +35,11 @@ import org.apache.wicket.request.handler.resource.ResourceReferenceRequestHandle import org.apache.wicket.request.mapper.parameter.PageParameters; import org.apache.wicket.request.resource.PackageResourceReference; import org.apache.wicket.request.resource.UrlResourceReference; +import org.apache.wicket.settings.def.SecuritySettings; +import org.apache.wicket.util.IProvider; +import org.apache.wicket.util.crypt.CachingSunJceCryptFactory; +import org.apache.wicket.util.crypt.ICrypt; +import org.apache.wicket.util.crypt.ICryptFactory; import org.apache.wicket.util.string.StringValue; import org.apache.wicket.util.tester.DummyHomePage; import org.apache.wicket.util.tester.WicketTester; @@ -70,11 +75,28 @@ public class CryptoMapperTest extends AbstractMapperTest @Before public void before() throws Exception { - tester = new WicketTester(); - WebApplication webApplication = tester.getApplication(); - webApplication.mountPage(EXPECTED_URL.toString(), DummyHomePage.class); - mapper = new CryptoMapper(webApplication.getRootRequestMapper(), webApplication); + + WebApplication application = tester.getApplication(); + application.mountPage(EXPECTED_URL.toString(), DummyHomePage.class); + + /** + * Use explicit crypt provider to prevent crypt warning output, see + * SecuritySettings#getCryptFactory() + */ + IProvider<ICrypt> cryptProvider = new IProvider<ICrypt>() + { + private ICryptFactory cryptFactory = new CachingSunJceCryptFactory( + SecuritySettings.DEFAULT_ENCRYPTION_KEY); + + @Override + public ICrypt get() + { + return cryptFactory.newCrypt(); + } + }; + + mapper = new CryptoMapper(application.getRootRequestMapper(), cryptProvider); } /**
