[TAP5-2008] Serialized object data stored on the client should be HMAC signed and validated

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.3.5, 5.4
• Fix Version/s: 5.3.6, 5.4
• Component/s: tapestry-core
• Labels: fixed-in-5.4-js-rewrite security
• Assignee: Howard Lewis Ship
• Reporter: Howard Lewis Ship
• Created: 04/Oct/12 18:17
• Updated: 06/Dec/18 10:50
• Resolved: 04/Oct/12 18:55

Description

Tapestry encodes serialized objects into Base64 encoded strings that are stored on the client; primarily, this is for form submissions, to encode the set of operations needed to process the form when it is submitted.

However, Tapestry does not use any form of validation to ensure that the encoded data has not been tampered with. It is relatively easy to create a DOS attack by exploiting this.

Tapestry should use some form of HMAC (hash-based message authentication) to ensure that the contents of such data are valid; the signing and validation should occur after writing GZipped content, and before GZip decoding (it is very easy to provide a small gzipped payload that expands to an enormous size, for example; this is one form of DOS).