[
https://issues.apache.org/jira/browse/WICKET-7194?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106319#comment-18106319
]
ASF subversion and git services commented on WICKET-7194:
---------------------------------------------------------
Commit 62c811277f5bbedf833ebd36cd5c7d67dcf64b65 in wicket's branch
refs/heads/master from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=62c811277f ]
WICKET-7194 Remove the Include component
Include fetched the URL its model resolved to and wrote the response into the
page body verbatim, so the model value decided three separate things at once:
what the server connected to, what ended up in the page, and how much of it was
read.
Where anything in the request could influence that value, the component reached
file:, jar: and ftp: URLs as well as hosts only the server can see, because
UrlResourceStream calls URL#openConnection without restricting the scheme; it
put the response in the page unescaped, because onComponentTagBody hands the
content to replaceComponentTagBody, which writes the body straight to the
response; and it read without bound, because ResourceUtil#readString buffers the
whole stream with no size limit while UrlResourceStream sets neither a connect
nor a read timeout. The relative form went through ServletContext#getResource,
reaching /WEB-INF as well.
None of that is a defect in the implementation. Fetching an arbitrary URL and
splicing its raw content into a page is what the component was for, and
restricting the scheme, the host, the size or the escaping would have left
nothing of it, so it is removed rather than hardened and there is nothing to
migrate to. Applications that used it for page composition should use Panels,
Borders and markup inheritance instead. The component is deprecated for the same
reason in 8.19.0, 9.24.0 and 10.11.0, and the removal is recorded in the
MigrateToWicket11 recipe.
The package held only this class, so the module-info exports entry and the OSGi
Export-Package entry go with it. The compref example that demonstrated the
component is removed too; per SECURITY.md the examples are corrected on master
only, so the released examples keep it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> Deprecate and remove Include
> ----------------------------
>
> Key: WICKET-7194
> URL: https://issues.apache.org/jira/browse/WICKET-7194
> Project: Wicket
> Issue Type: Task
> Components: wicket-core
> Affects Versions: 11.0.0, 9.23.0, 8.18.0, 10.10.0
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
>
> This class allows including markup from external sources into a page. It does
> not contain any form of validation or verification. This is not something we
> want to provide from Wicket core. If users require such a component, it's
> better to write something yourself tailored for the specific environment it
> operates in. This class will be deprecated for security reasons in 8.x, 9.x
> and 10.x and removed in 11.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
