This is an automated email from the ASF dual-hosted git repository. dashorst pushed a commit to branch wicket-10.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 522be5e1c3a1fc8dbd93f240a80826e8b653b8d3 Author: Pedro Santos <[email protected]> AuthorDate: Fri Oct 2 19:28:47 2026 -0300 Escape the starting text of the upload progress bar UploadProgressBar reads the text it shows while an upload starts from the application's resource bundles and writes it into a JavaScript string literal of its initialization script as it stands. A translation carrying an apostrophe did not hold as the literal it was pasted into, and the javadoc invites one by naming the resource key for customising that text. It now goes through JavaScriptUtils#escapeQuotes, as the delete label of MultiFileUploadField and the style class of TrapFocusBehavior do. The ids the same script writes stay as they are: an id is restricted where it enters, and a text from a bundle is not. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../markup/html/form/upload/UploadProgressBar.java | 3 +- .../html/form/upload/UploadProgressBarTest.java | 88 ++++++++++++++++++++++ 2 files changed, 90 insertions(+), 1 deletion(-) diff --git a/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java b/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java index 52e4d29a55..513e962f06 100644 --- a/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java +++ b/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java @@ -22,6 +22,7 @@ import org.apache.wicket.Application; import org.apache.wicket.IInitializer; import org.apache.wicket.MarkupContainer; import org.apache.wicket.core.request.handler.IPartialPageRequestHandler; +import org.apache.wicket.core.util.string.JavaScriptUtils; import org.apache.wicket.markup.head.CssHeaderItem; import org.apache.wicket.markup.head.IHeaderResponse; import org.apache.wicket.markup.head.JavaScriptHeaderItem; @@ -269,7 +270,7 @@ public class UploadProgressBar extends Panel formatter.format(getVarName() + " = new Wicket.WUPB(%s, '%s', '%s', '%s', %s, '%s', %s);", form != null ? "'" + form.getMarkupId() + "'" : "null", statusDiv.getMarkupId(), barDiv.getMarkupId(), url, uploadFieldId, - status, getOnProgressUpdatedCallBack()); + JavaScriptUtils.escapeQuotes(status), getOnProgressUpdatedCallBack()); response.render(OnDomReadyHeaderItem.forScript(builder.toString())); } diff --git a/wicket-extensions/src/test/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBarTest.java b/wicket-extensions/src/test/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBarTest.java new file mode 100644 index 0000000000..137b04c212 --- /dev/null +++ b/wicket-extensions/src/test/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBarTest.java @@ -0,0 +1,88 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.wicket.extensions.ajax.markup.html.form.upload; + +import static org.junit.jupiter.api.Assertions.assertTrue; + +import java.util.Locale; + +import org.apache.wicket.Component; +import org.apache.wicket.MarkupContainer; +import org.apache.wicket.markup.IMarkupResourceStreamProvider; +import org.apache.wicket.markup.html.WebPage; +import org.apache.wicket.markup.html.form.Form; +import org.apache.wicket.resource.loader.IStringResourceLoader; +import org.apache.wicket.util.resource.IResourceStream; +import org.apache.wicket.util.resource.StringResourceStream; +import org.apache.wicket.util.tester.WicketTestCase; +import org.junit.jupiter.api.Test; + +/** + * Tests for {@link UploadProgressBar}. + */ +class UploadProgressBarTest extends WicketTestCase +{ + /** + * The starting text from the resource bundle is written into a JavaScript string literal. + */ + @Test + void startingTextIsEscapedForJavaScript() + { + tester.getApplication().getResourceSettings().getStringResourceLoaders().add(0, + new IStringResourceLoader() + { + @Override + public String loadStringResource(Class<?> clazz, String key, Locale locale, + String style, String variation) + { + return UploadProgressBar.RESOURCE_STARTING.equals(key) ? "l'\\envoi" : null; + } + + @Override + public String loadStringResource(Component component, String key, Locale locale, + String style, String variation) + { + return loadStringResource((Class<?>)null, key, locale, style, variation); + } + }); + + tester.startPage(new TestPage()); + + String response = tester.getLastResponseAsString(); + assertTrue(response.contains("'l\\'\\\\envoi'"), response); + } + + private static class TestPage extends WebPage implements IMarkupResourceStreamProvider + { + private static final long serialVersionUID = 1L; + + TestPage() + { + Form<Void> form = new Form<>("form"); + add(form); + form.add(new UploadProgressBar("bar", form)); + } + + @Override + public IResourceStream getMarkupResourceStream(MarkupContainer container, + Class<?> containerClass) + { + return new StringResourceStream("<html><head></head><body>" + + "<form wicket:id=\"form\"><div wicket:id=\"bar\"></div></form></body></html>"); + } + } +}
