Page History

...

• Your Login page exposes a classpath asset, icon.png.

• A malicious client copies the URL, /assets/1.0.0/app/pages/icon.png ,

  Wiki Markup
  {footnote}This would indicate that the Login page is actually inside a library, which is unlikely. More likely, {{icon.png}} is a context asset and the malicious user guessed the path for {{Login.class}} by looking at the Tapestry source code.{footnote}

  (which would indicate that the Login page is actually inside a library, which is unlikely. More likely, icon.png is a context asset and the malicious user guessed the path for Login.class by looking at the Tapestry source code.) and changes the file name to Login.class.

• The client decompiles the class file and spots your secret emergency password: goodbye security!

  Wiki Markup{footnote}Never create such back doors, of course!{footnote}

  (Never create such back doors, of course!)

Fortunately, this can't happen. Files with extension ".class" are secured; they must be accompanied in the URL with a query parameter that is the MD5 hash of the file's contents. If the query parameter is absent, or doesn't match the actual file's content, the request is rejected.

When your code exposes an Asset, the URL will automatically include the query parameter if the file type is secured. The malicious user is locked out of access to the files

{footnote}Unless they already have the files so that they can generate the MD5 checksum ... to get access to the files they already have.{footnote}

.

. (Unless they already have the files so that they can generate the MD5 checksum ... to get access to the files they already have.)

By default, Tapestry secures file extensions ".class', ".tml" and ".properties". The list can be extended by contributing to the ResourceDigestGenerator service:

...

@Contribute(ResourceMinimizer.class)
@Primary
public static void contributeMinimizers(MappedConfiguration<String, ResourceMinimizer> configuration)
{
    configuration.addInstance("text/coffeescript", CoffeeScriptMinimizer.class);
}

...