[
https://issues.apache.org/jira/browse/WICKET-7196?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107187#comment-18107187
]
ASF GitHub Bot commented on WICKET-7196:
----------------------------------------
papegaaij opened a new pull request, #1552:
URL: https://github.com/apache/wicket/pull/1552
[WICKET-7196](https://issues.apache.org/jira/browse/WICKET-7196)
`<wicket:label>` escapes the label text it takes from a model or from a
resource bundle. The flag that decides it is read from the `TextLabel` the
resolver inserts, and that component is never handed to the application, so
nothing can clear it. An application whose bundle holds markup, or an entity
such as `Save & close`, has no way back other than moving the content into
the tag body.
This adds an `escape` attribute to the tag:
```html
<label wicket:for="myFormComponent"><wicket:label escape="false"/></label>
```
It sets `escapeModelStrings` on the label the resolver creates, so the write
site in `onComponentTagBody` is unchanged and the attribute is the markup
spelling of the flag `SECURITY.md` already describes — clearing it is the
application saying the content is markup and taking responsibility for it.
### Differences from `<wicket:message escape="…">`
The polarity is inverted: a message is written as markup by default and
`escape="true"` opts in, while a label is escaped by default and
`escape="false"` opts out.
Because of that, a **missing or empty** attribute keeps the escaping.
`<wicket:message>` reads the same attribute with `IValueMap#getBoolean`, which
resolves an empty value to `false`; there `false` is the default, here it is
the opt-out, so an empty value has to keep the escaping rather than quietly
drop it. An unrecognised value still raises `StringValueConversionException`,
the way it does on `<wicket:message>`.
The attribute says nothing about the tag body. That body is markup the label
has just rendered itself, nested components and `<wicket:message>` included,
and is written as is either way.
### Tests
New `AutoLabelEscapeAttributeTest` covers `escape="false"` on all three text
sources (label model, default label from the bundle, `key` attribute),
`escape="true"` still escaping, `escape=""` still escaping, an unrecognised
value failing the render, and the `FormComponent`'s label still holding the raw
bundle value so error messages are unaffected.
Full `wicket-core-tests` suite passes (2392 tests).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
> Allow unescaped wicket:label tags
> ---------------------------------
>
> Key: WICKET-7196
> URL: https://issues.apache.org/jira/browse/WICKET-7196
> Project: Wicket
> Issue Type: New Feature
> Components: wicket-core
> Affects Versions: 9.23.0, 10.10.0
> Reporter: Emond Papegaaij
> Priority: Major
>
> wicket:label tags get their content escaped. This is usually fine, but we
> should allow disabling this via an escape="false" attribute (very similar to
> the escape="true" on wicket:message).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
