M0nd0R opened a new pull request, #1517: URL: https://github.com/apache/wicket/pull/1517
## Summary This change rejects plaintext request-listener parameters that are appended to an otherwise encrypted bookmarkable page URL. ## Root Cause `decryptEntireUrl(...)` decrypted the protected URL and then merged additional query parameters from the incoming request. A plaintext `PageComponentInfo` parameter could therefore survive outside the encrypted payload and still affect request mapping. ## Fix Reject incoming query parameters that parse as `PageComponentInfo` before merging the request query parameters back into the decrypted URL. ## Validation - `mvn -pl wicket-core-tests -am -Dtest=org.apache.wicket.core.request.mapper.CryptoMapperTest -Dsurefire.failIfNoSpecifiedTests=false clean test` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
