This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/wicket.git
The following commit(s) were added to refs/heads/master by this push:
new 62c811277f WICKET-7194 Remove the Include component
62c811277f is described below
commit 62c811277f5bbedf833ebd36cd5c7d67dcf64b65
Author: Emond Papegaaij <[email protected]>
AuthorDate: Thu Aug 20 15:10:46 2026 +0200
WICKET-7194 Remove the Include component
Include fetched the URL its model resolved to and wrote the response into
the
page body verbatim, so the model value decided three separate things at
once:
what the server connected to, what ended up in the page, and how much of it
was
read.
Where anything in the request could influence that value, the component
reached
file:, jar: and ftp: URLs as well as hosts only the server can see, because
UrlResourceStream calls URL#openConnection without restricting the scheme;
it
put the response in the page unescaped, because onComponentTagBody hands the
content to replaceComponentTagBody, which writes the body straight to the
response; and it read without bound, because ResourceUtil#readString
buffers the
whole stream with no size limit while UrlResourceStream sets neither a
connect
nor a read timeout. The relative form went through
ServletContext#getResource,
reaching /WEB-INF as well.
None of that is a defect in the implementation. Fetching an arbitrary URL
and
splicing its raw content into a page is what the component was for, and
restricting the scheme, the host, the size or the escaping would have left
nothing of it, so it is removed rather than hardened and there is nothing to
migrate to. Applications that used it for page composition should use
Panels,
Borders and markup inheritance instead. The component is deprecated for the
same
reason in 8.19.0, 9.24.0 and 10.11.0, and the removal is recorded in the
MigrateToWicket11 recipe.
The package held only this class, so the module-info exports entry and the
OSGi
Export-Package entry go with it. The compref example that demonstrated the
component is removed too; per SECURITY.md the examples are corrected on
master
only, so the released examples keep it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
wicket-core/pom.xml | 1 -
wicket-core/src/main/java/module-info.java | 1 -
.../apache/wicket/markup/html/include/Include.java | 220 ---------------------
.../apache/wicket/markup/html/include/package.html | 27 ---
.../wicket/examples/compref/IncludePage.html | 29 ---
.../wicket/examples/compref/IncludePage.java | 52 -----
.../org/apache/wicket/examples/compref/Index.html | 1 -
.../src/main/webapp/to_be_included.html | 3 -
.../src/main/resources/META-INF/rewrite/wicket.yml | 7 +
9 files changed, 7 insertions(+), 334 deletions(-)
diff --git a/wicket-core/pom.xml b/wicket-core/pom.xml
index c384f85a84..01ef60a5ea 100644
--- a/wicket-core/pom.xml
+++ b/wicket-core/pom.xml
@@ -90,7 +90,6 @@
org.apache.wicket.markup.html.form.upload.resource;-noimport:=true,
org.apache.wicket.markup.html.form.validation;-noimport:=true,
org.apache.wicket.markup.html.image;-noimport:=true,
org.apache.wicket.markup.html.image.resource;-noimport:=true,
-org.apache.wicket.markup.html.include;-noimport:=true,
org.apache.wicket.markup.html.internal;-noimport:=true,
org.apache.wicket.markup.html.link;-noimport:=true,
org.apache.wicket.markup.html.list;-noimport:=true,
diff --git a/wicket-core/src/main/java/module-info.java
b/wicket-core/src/main/java/module-info.java
index cb87eb0452..25561600ed 100644
--- a/wicket-core/src/main/java/module-info.java
+++ b/wicket-core/src/main/java/module-info.java
@@ -87,7 +87,6 @@ module org.apache.wicket.core {
exports org.apache.wicket.markup.html.form.validation;
exports org.apache.wicket.markup.html.image;
exports org.apache.wicket.markup.html.image.resource;
- exports org.apache.wicket.markup.html.include;
exports org.apache.wicket.markup.html.internal;
exports org.apache.wicket.markup.html.link;
exports org.apache.wicket.markup.html.list;
diff --git
a/wicket-core/src/main/java/org/apache/wicket/markup/html/include/Include.java
b/wicket-core/src/main/java/org/apache/wicket/markup/html/include/Include.java
deleted file mode 100644
index ee44fd3b87..0000000000
---
a/wicket-core/src/main/java/org/apache/wicket/markup/html/include/Include.java
+++ /dev/null
@@ -1,220 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.wicket.markup.html.include;
-
-import java.net.MalformedURLException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.net.URL;
-import java.nio.charset.Charset;
-
-import jakarta.servlet.ServletContext;
-
-import org.apache.wicket.IGenericComponent;
-import org.apache.wicket.WicketRuntimeException;
-import org.apache.wicket.core.util.resource.UrlResourceStream;
-import org.apache.wicket.markup.ComponentTag;
-import org.apache.wicket.markup.MarkupStream;
-import org.apache.wicket.markup.html.WebComponent;
-import org.apache.wicket.model.IModel;
-import org.apache.wicket.model.Model;
-import org.apache.wicket.request.UrlUtils;
-import org.apache.wicket.resource.ResourceUtil;
-import org.apache.wicket.util.lang.Args;
-
-
-/**
- * <p>
- * Component that includes/ renders the import result of an URL, much like JSP
include.
- * </p>
- * <p>
- * Use this to integrate non-Wicket locations in your page. <strong>This
component is NOT meant for
- * integrating more Wicket sources as a means of quick and dirty page
composition. Use Panels,
- * Borders and (Markup)inheritance for page composition instead.</strong>
- * </p>
- * <p>
- * You can feed this component the URL directly, or use a model that should
deliver a valid URL. You
- * can both use absolute (e.g. http://www.theserverside.com/) and relative
(e.g. mydir/mypage.html)
- * urls. This component will try to resolve relative urls to resources in the
same webapplication.
- * </p>
- * <p>
- * The following example shows how to integrate a header and footer, coming
from a plain HTML source
- * on the same server is integrated using this component. The files
footer.html and header.html
- * would be located in the web application root directory
- * </p>
- * <p>
- * Java:
- *
- * <pre>
- * ...
- * add(new Include("header", "header.html"));
- * add(new Include("footer", "footer.html"));
- * ...
- * </pre>
- *
- * Html:
- *
- * <pre>
- * ...
- * <div>
- * <div wicket:id="header">header comes here</div>
- * <div>I am the body!</div>
- * <div wicket:id="footer">footer comes here</div>
- * </div>
- * ...
- * </pre>
- *
- * </p>
- *
- * @author Eelco Hillenius
- */
-public class Include extends WebComponent implements IGenericComponent<String,
Include>
-{
- private static final long serialVersionUID = 1L;
-
- /**
- * Construct.
- *
- * @param id
- * component id
- */
- public Include(final String id)
- {
- super(id);
- }
-
- /**
- * Construct.
- *
- * @param id
- * component id
- * @param model
- * the model
- */
- public Include(String id, IModel<String> model)
- {
- super(id, model);
- }
-
- /**
- * Construct.
- *
- * @param id
- * component id
- * @param modelObject
- * the model object (will be wrapped in a model)
- */
- public Include(String id, String modelObject)
- {
- super(id, new Model<>(modelObject));
- }
-
- /**
- * Imports the contents of the url of the model object.
- *
- * @return the imported contents
- */
- protected String importAsString()
- {
- // gets the model object: should provide us with either an
absolute or a
- // relative url
- String url = getModelObject();
-
- if (UrlUtils.isRelative(url))
- {
- return importRelativeUrl(url);
- }
- else
- {
- return importAbsoluteUrl(url);
- }
- }
-
- @Override
- public void onComponentTagBody(final MarkupStream markupStream, final
ComponentTag openTag)
- {
- String content = importAsString();
- replaceComponentTagBody(markupStream, openTag, content);
- }
-
- /**
- * Imports from a relative url.
- *
- * @param url
- * the url to import
- * @return the imported url's contents
- */
- private String importRelativeUrl(String url)
- {
- Args.notEmpty(url, "url");
-
- if (url.charAt(0) != '/')
- {
- url = '/' + url;
- }
-
- try
- {
- ServletContext servletContext =
getWebApplication().getServletContext();
- URL resource = servletContext.getResource(url);
- return importUrl(resource);
- } catch (MalformedURLException mux)
- {
- throw new WicketRuntimeException(mux);
- }
- }
-
- /**
- * Imports from an absolute url.
- *
- * @param url
- * the url to import
- * @return the imported url's contents
- */
- private String importAbsoluteUrl(CharSequence url)
- {
- try
- {
- return importUrl(new URI(url.toString()).toURL());
- }
- catch (URISyntaxException | MalformedURLException e)
- {
- throw new WicketRuntimeException(e);
- }
- }
-
- /**
- *
- * @return The charset of the text to be retrieved and included
- */
- public Charset getCharset()
- {
- return null;
- }
-
- /**
- * Imports the contents from the given url.
- *
- * @param url
- * the url
- * @return the imported contents
- */
- private String importUrl(URL url)
- {
- return ResourceUtil.readString(new UrlResourceStream(url),
getCharset());
- }
-}
diff --git
a/wicket-core/src/main/java/org/apache/wicket/markup/html/include/package.html
b/wicket-core/src/main/java/org/apache/wicket/markup/html/include/package.html
deleted file mode 100644
index 5cec3dad31..0000000000
---
a/wicket-core/src/main/java/org/apache/wicket/markup/html/include/package.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--->
-<!DOCTYPE HTML PUBLIC "-//W3C/DTD HTML 3.2 Final//NL">
-<html>
-<head>
-<title>wicket.markup.html.include package</title>
-</head>
-<body>
-<p>
-Components for including content from non-Wicket sources.
-</p>
-</body>
-</html>
\ No newline at end of file
diff --git
a/wicket-examples/src/main/java/org/apache/wicket/examples/compref/IncludePage.html
b/wicket-examples/src/main/java/org/apache/wicket/examples/compref/IncludePage.html
deleted file mode 100644
index 245749e976..0000000000
---
a/wicket-examples/src/main/java/org/apache/wicket/examples/compref/IncludePage.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<html xmlns="http://www.w3.org/1999/xhtml";
xmlns:wicket="http://wicket.apache.org";>
-<head>
- <title>Wicket Examples - component reference</title>
-</head>
-<body>
- <wicket:extend>
-
- <h1>wicket.markup.html.include.Include</h1>
- <wicket:link><a href="Index.html">[back to the
reference]</a></wicket:link>
-
- <p>
- You can use the Include component to include arbitrairy content from
non-Wicket locations,
- such as static HTML headers, or even do page integration from external
sites.
- </p>
- <p>
- This component is not used for normal page composition tasks.
- You should usually get by using Panels, Borders and Markup inheritance.
- </p>
- <p>
-
- <span wicket:id="include">
- Inclusion contents to be inserted here.
- </span>
- </p>
- <span wicket:id="explainPanel">panel contents come here</span>
-</wicket:extend>
-</body>
-</html>
diff --git
a/wicket-examples/src/main/java/org/apache/wicket/examples/compref/IncludePage.java
b/wicket-examples/src/main/java/org/apache/wicket/examples/compref/IncludePage.java
deleted file mode 100644
index 01abf01a38..0000000000
---
a/wicket-examples/src/main/java/org/apache/wicket/examples/compref/IncludePage.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.wicket.examples.compref;
-
-import org.apache.wicket.examples.WicketExamplePage;
-import org.apache.wicket.markup.html.include.Include;
-
-
-/**
- * Page with examples on {@link
org.apache.wicket.markup.html.basic.MultiLineLabel}.
- *
- * @author Eelco Hillenius
- */
-public class IncludePage extends WicketExamplePage
-{
- /**
- * Constructor
- */
- public IncludePage()
- {
- add(new Include("include", "to_be_included.html"));
- }
-
- /**
- * Override base method to provide an explanation
- */
- @Override
- protected void explain()
- {
- String html = "<span wicket:id=\"include\">\n"
- + "Inclusion contents to be inserted here.\n" +
"</span>";
- String code = " public IncludePage()\n"
- + " {\n"
- +
" add(new Include(\"include\",
\"to_be_included.html\"));\n"
- + " }";
- add(new ExplainPanel(html, code));
- }
-}
\ No newline at end of file
diff --git
a/wicket-examples/src/main/java/org/apache/wicket/examples/compref/Index.html
b/wicket-examples/src/main/java/org/apache/wicket/examples/compref/Index.html
index 9bd571b5bb..3a1003ae35 100644
---
a/wicket-examples/src/main/java/org/apache/wicket/examples/compref/Index.html
+++
b/wicket-examples/src/main/java/org/apache/wicket/examples/compref/Index.html
@@ -32,7 +32,6 @@
<ul>
<li><a
href="PanelPage.html">wicket.markup.html.panel.Panel</a></li>
<li><a
href="BorderPage.html">wicket.markup.html.border.Border</a></li>
- <li><a
href="IncludePage.html">wicket.markup.html.include.Include</a></li>
<li><a
href="TabbedPanelPage.html">wicket.markup.html.tabs.TabbedPanel
(wicket-extensions)</a></li>
<li><a
href="FragmentPage.html">wicket.markup.html.panel.Fragment</a></li>
</ul>
diff --git a/wicket-examples/src/main/webapp/to_be_included.html
b/wicket-examples/src/main/webapp/to_be_included.html
deleted file mode 100644
index 8844a26283..0000000000
--- a/wicket-examples/src/main/webapp/to_be_included.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<div class="dotted-box">
- I am a static html page.
-</div>
diff --git a/wicket-migration/src/main/resources/META-INF/rewrite/wicket.yml
b/wicket-migration/src/main/resources/META-INF/rewrite/wicket.yml
index 5d4a66800f..3c193e5dba 100644
--- a/wicket-migration/src/main/resources/META-INF/rewrite/wicket.yml
+++ b/wicket-migration/src/main/resources/META-INF/rewrite/wicket.yml
@@ -58,6 +58,13 @@ recipeList:
# AbstractKeyInSessionCryptFactory, DefaultCrypter, GCMSIVCrypter, ICrypter.
# These require manual migration; see the guide above. Data encrypted by
Wicket 10 cannot
# be decrypted by Wicket 11 (per-session keys and formats change).
+#
+# org.apache.wicket.markup.html.include.Include was removed with no drop-in
replacement. It
+# fetched the URL its model resolved to and wrote the response into the page
body unescaped,
+# which cannot be made safe: the model value decided what the server connected
to, what ended
+# up in the page and how much of it was read. Applications composing pages
with it should use
+# Panels, Borders and markup inheritance instead; there is no replacement for
including remote
+# content. It is deprecated in 8.19.0, 9.24.0 and 10.11.0.
type: specs.openrewrite.org/v1beta/recipe
name: org.apache.wicket.MigrateToWicket11
displayName: Migrate to Wicket 11.x
