This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a change to branch wicket-8.x
in repository https://gitbox.apache.org/repos/asf/wicket.git
from 79bb80948e WICKET-7194 Deprecate the Include component for security
reasons
new f4ff8c8abc Escape the model string a Button writes into a button
element body
new b055a7bd38 Escape the label text wicket:label takes from a model or a
bundle
new 7f53ba4dff Escape the attribute values of a MetaDataHeaderItem as
markup
new 8c1eff3d42 Escape the additional option attributes of a palette
new 28b50bbd21 Escape the body of the default option of a single select
choice
new 0d566fb2a9 Say in the javadoc which methods have their value written
to the markup as is
new 629b79fbcb Document how model data, markup and message bundles are
escaped
new 6d6930c0ec Escape the value an editable label shows for an empty model
The 8 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
SECURITY.md | 49 ++++++
.../wicket/markup/head/MetaDataHeaderItem.java | 2 +-
.../wicket/markup/html/form/AbstractChoice.java | 28 +++
.../html/form/AbstractSingleSelectChoice.java | 21 ++-
.../markup/html/form/AutoLabelTextResolver.java | 62 ++++---
.../org/apache/wicket/markup/html/form/Button.java | 12 +-
.../markup/html/form/CheckBoxMultipleChoice.java | 36 ++++
.../wicket/markup/html/form/RadioChoice.java | 36 ++++
.../html/navigation/paging/PagingNavigation.java | 12 ++
.../wicket/markup/transformer/ITransformer.java | 6 +
.../markup/head/HtmlImportHeaderItemTest.java | 7 +-
.../wicket/markup/head/MetaDataHeaderItemTest.java | 35 +++-
.../form/AbstractSingleSelectChoiceEscapeTest.java | 192 +++++++++++++++++++++
.../form/AutoLabelEscapeMarkupTest$LabelPage.html | 14 ++
.../AutoLabelEscapeMarkupTest$LabelPage.properties | 2 +
.../html/form/AutoLabelEscapeMarkupTest.java | 140 +++++++++++++++
.../apache/wicket/markup/html/form/ButtonTest.java | 33 +++-
.../ajax/markup/html/AjaxEditableChoiceLabel.java | 4 +-
.../ajax/markup/html/AjaxEditableLabel.java | 5 +-
.../markup/html/AjaxEditableMultiLineLabel.java | 5 +-
.../autocomplete/AbstractAutoCompleteRenderer.java | 6 +
.../html/autocomplete/IAutoCompleteRenderer.java | 18 ++
.../extensions/breadcrumb/BreadCrumbBar.java | 6 +
.../form/palette/component/AbstractOptions.java | 4 +-
.../html/AjaxEditableLabelNullLabelEscapeTest.java | 154 +++++++++++++++++
...tteAdditionalAttributesTest$AttributesPage.html | 2 +-
.../palette/PaletteAdditionalAttributesTest.java | 113 ++++++++++++
.../wicket/velocity/VelocityContributor.java | 6 +
.../wicket/velocity/markup/html/VelocityPanel.java | 6 +
29 files changed, 976 insertions(+), 40 deletions(-)
create mode 100644
wicket-core/src/test/java/org/apache/wicket/markup/html/form/AbstractSingleSelectChoiceEscapeTest.java
create mode 100644
wicket-core/src/test/java/org/apache/wicket/markup/html/form/AutoLabelEscapeMarkupTest$LabelPage.html
create mode 100644
wicket-core/src/test/java/org/apache/wicket/markup/html/form/AutoLabelEscapeMarkupTest$LabelPage.properties
create mode 100644
wicket-core/src/test/java/org/apache/wicket/markup/html/form/AutoLabelEscapeMarkupTest.java
create mode 100644
wicket-extensions/src/test/java/org/apache/wicket/extensions/ajax/markup/html/AjaxEditableLabelNullLabelEscapeTest.java
copy
wicket-core/src/test/java/org/apache/wicket/markup/html/form/FormDefaultButtonTestPage.html
=>
wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/form/palette/PaletteAdditionalAttributesTest$AttributesPage.html
(61%)
create mode 100644
wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/form/palette/PaletteAdditionalAttributesTest.java
