[ https://issues.apache.org/jira/browse/WICKET-6938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17453334#comment-17453334 ]
Sven Meier commented on WICKET-6938: ------------------------------------ Regarding AbstractAutoCompleteRenderer#getOnSelectJavaScriptExpression(): I would just deprecate it, as the two examples given in the Javadoc are dubious anyways: the first can be done with an OnChangeAjaxBehavior instead, and the second wouldn't work, since Ajax is asynchronous. > wicket-autocomplete.js not CSP compliant > ---------------------------------------- > > Key: WICKET-6938 > URL: https://issues.apache.org/jira/browse/WICKET-6938 > Project: Wicket > Issue Type: Bug > Components: wicket-extensions > Affects Versions: 9.6.0 > Reporter: Alexandre > Priority: Major > > While upgrading from wicket 8 to 9.6 we are trying to implement CSP. We also > use the autocompletebehavior. This in turn call wicket-autocomplete.js > (wicket-extensions\src\main\java\org\apache\wicket\extensions\ajax\markup\html\autocomplete). > This js file contains "handleSelection" function trying to "eval(attr.value)" > throwing a CSP 'unsafe-eval' exception. > So the autocomplete textfield will display choices, but won't handle user > selection. -- This message was sent by Atlassian Jira (v8.20.1#820001)