papegaaij opened a new pull request, #1552: URL: https://github.com/apache/wicket/pull/1552
[WICKET-7196](https://issues.apache.org/jira/browse/WICKET-7196) `<wicket:label>` escapes the label text it takes from a model or from a resource bundle. The flag that decides it is read from the `TextLabel` the resolver inserts, and that component is never handed to the application, so nothing can clear it. An application whose bundle holds markup, or an entity such as `Save & close`, has no way back other than moving the content into the tag body. This adds an `escape` attribute to the tag: ```html <label wicket:for="myFormComponent"><wicket:label escape="false"/></label> ``` It sets `escapeModelStrings` on the label the resolver creates, so the write site in `onComponentTagBody` is unchanged and the attribute is the markup spelling of the flag `SECURITY.md` already describes — clearing it is the application saying the content is markup and taking responsibility for it. ### Differences from `<wicket:message escape="…">` The polarity is inverted: a message is written as markup by default and `escape="true"` opts in, while a label is escaped by default and `escape="false"` opts out. Because of that, a **missing or empty** attribute keeps the escaping. `<wicket:message>` reads the same attribute with `IValueMap#getBoolean`, which resolves an empty value to `false`; there `false` is the default, here it is the opt-out, so an empty value has to keep the escaping rather than quietly drop it. An unrecognised value still raises `StringValueConversionException`, the way it does on `<wicket:message>`. The attribute says nothing about the tag body. That body is markup the label has just rendered itself, nested components and `<wicket:message>` included, and is written as is either way. ### Tests New `AutoLabelEscapeAttributeTest` covers `escape="false"` on all three text sources (label model, default label from the bundle, `key` attribute), `escape="true"` still escaping, `escape=""` still escaping, an unrecognised value failing the render, and the `FormComponent`'s label still holding the raw bundle value so error messages are unaffected. Full `wicket-core-tests` suite passes (2392 tests). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
