This is an automated email from the ASF dual-hosted git repository. dashorst pushed a commit to branch wicket-10.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 91828b92bc0b329828179332f04c815a444fbe53 Author: Pedro Santos <[email protected]> AuthorDate: Fri Oct 2 20:10:45 2026 -0300 Escape the css class the filter form writes into its hidden fields FilterForm#generateHiddenInputMarkup builds the markup of its hidden fields with String.format, and escapes three of the four values it substitutes: the css id twice and the submitted value. The fourth, the css class it reads from the resource bundles, went in as it stands, so a quote in it ended the attribute it was written into and the rest of it was read as further attributes of the div. It now goes through Strings#escapeMarkup like the others. A value the framework writes into markup is escaped by the code that writes it, whichever of them the value came from. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../repeater/data/table/filter/FilterForm.java | 2 +- .../repeater/data/table/filter/FilterFormTest.java | 37 ++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java b/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java index a3099c7455..b6a4f3ad27 100644 --- a/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java +++ b/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java @@ -101,7 +101,7 @@ public class FilterForm<T> extends Form<T> return String.format( "<div hidden='' class='%s'><input type='hidden' name='%s' id='%s' value='%s'/><input type='submit'/></div>", - cssClass, id, id, Strings.escapeMarkup(value)); + Strings.escapeMarkup(cssClass), id, id, Strings.escapeMarkup(value)); } /** diff --git a/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java b/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java index d939cc66b3..776c278a8b 100644 --- a/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java +++ b/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java @@ -16,6 +16,13 @@ */ package org.apache.wicket.extensions.markup.html.repeater.data.table.filter; +import static org.junit.jupiter.api.Assertions.assertTrue; + +import java.util.Locale; + +import org.apache.wicket.Component; +import org.apache.wicket.markup.html.form.Form; +import org.apache.wicket.resource.loader.IStringResourceLoader; import org.apache.wicket.util.tester.WicketTestCase; import org.junit.jupiter.api.Test; @@ -26,4 +33,34 @@ public class FilterFormTest extends WicketTestCase public void test() throws Exception { executeTest(FilterFormTestPage.class, "FilterFormTestPage_expected.html"); } + + /** + * The css class from the resource bundle is written into the markup of the hidden fields. + */ + @Test + public void cssClassIsEscapedAsMarkup() + { + tester.getApplication().getResourceSettings().getStringResourceLoaders().add(0, + new IStringResourceLoader() + { + @Override + public String loadStringResource(Class<?> clazz, String key, Locale locale, + String style, String variation) + { + return Form.HIDDEN_FIELDS_CSS_CLASS_KEY.equals(key) ? "a'b" : null; + } + + @Override + public String loadStringResource(Component component, String key, Locale locale, + String style, String variation) + { + return loadStringResource((Class<?>)null, key, locale, style, variation); + } + }); + + tester.startPage(FilterFormTestPage.class); + + String response = tester.getLastResponseAsString(); + assertTrue(response.contains("class='a'b'"), response); + } }
