This is an automated email from the ASF dual-hosted git repository. dashorst pushed a commit to branch wicket-10.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 49cdc0aaae770e02edfc956076a50c6d30f3d379 Author: Pedro Santos <[email protected]> AuthorDate: Fri Oct 2 20:17:25 2026 -0300 Pin the JavaScript a markup id is written into ComponentIdCharactersTest accepts and rejects ids and renders nothing, so it says that the check is in place and nothing about the code that relies on it. A sink that changed the quoting of its literal, the suffix the hidden fields container derives, or the precedence that makes an id attribute in the markup the markup id would leave every assertion in it passing. The new test renders a form whose markup gives it the id a-b_c.d1, which uses every character the check allows, and asserts the three literals that id reaches: the handler of the default submit button, the lookup of the form in the script that submits it, and the lookup of the hidden fields container, whose id is built from it. What the check permits and what those literals need of it are two halves of one contract, and the sinks carry nothing that says they depend on the check. This test pins behaviour rather than reproducing a defect - with the check in place an id that breaks a literal cannot be built - so it is the half that records the dependency. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../wicket/MarkupIdInGeneratedJavaScriptTest.java | 100 +++++++++++++++++++++ 1 file changed, 100 insertions(+) diff --git a/wicket-core-tests/src/test/java/org/apache/wicket/MarkupIdInGeneratedJavaScriptTest.java b/wicket-core-tests/src/test/java/org/apache/wicket/MarkupIdInGeneratedJavaScriptTest.java new file mode 100644 index 0000000000..01aad1b683 --- /dev/null +++ b/wicket-core-tests/src/test/java/org/apache/wicket/MarkupIdInGeneratedJavaScriptTest.java @@ -0,0 +1,100 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.wicket; + +import static org.junit.jupiter.api.Assertions.assertTrue; + +import org.apache.wicket.markup.IMarkupResourceStreamProvider; +import org.apache.wicket.markup.html.WebPage; +import org.apache.wicket.markup.html.form.Button; +import org.apache.wicket.markup.html.form.Form; +import org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior; +import org.apache.wicket.markup.html.form.TextField; +import org.apache.wicket.model.Model; +import org.apache.wicket.util.resource.IResourceStream; +import org.apache.wicket.util.resource.StringResourceStream; +import org.apache.wicket.util.tester.WicketTestCase; +import org.junit.jupiter.api.Test; + +/** + * Wicket writes a markup id into the JavaScript it generates without escaping it, and relies on the + * check in {@link Component} that an id contains no character able to change the meaning of that + * JavaScript. {@link ComponentIdCharactersTest} covers the check; this covers the other end, and + * pins what those literals look like for an id using every character the check allows. + */ +class MarkupIdInGeneratedJavaScriptTest extends WicketTestCase +{ + /** every character a markup id may contain, beyond letters and digits */ + private static final String MARKUP_ID = "a-b_c.d1"; + + @Test + void theMarkupIdIsWrittenIntoItsLiteralsIntact() + { + tester.startPage(new TestPage()); + + String response = tester.getLastResponseAsString(); + + // the handler of the default submit button, bound to the form + assertTrue(response.contains("Wicket.Event.add('" + MARKUP_ID + "', 'keypress'"), response); + + // the form the script submits, from Form#getJsForListenerUrl + assertTrue(response.contains("document.getElementById('" + MARKUP_ID + "')"), response); + + // the container of the hidden fields, whose id is derived from the markup id + assertTrue(response.contains("document.getElementById('" + MARKUP_ID + "_hf_0')"), response); + } + + /** a form whose markup gives it an id, with a default button and an updating behavior */ + private static class TestPage extends WebPage implements IMarkupResourceStreamProvider + { + private static final long serialVersionUID = 1L; + + TestPage() + { + Form<Void> form = new Form<>("form") + { + private static final long serialVersionUID = 1L; + + @Override + public String getMethod() + { + return METHOD_GET; + } + }; + add(form); + + Button button = new Button("button"); + form.add(button); + form.setDefaultButton(button); + + TextField<String> field = new TextField<>("field", Model.of("")); + field.add(new FormComponentUpdatingBehavior()); + form.add(field); + } + + @Override + public IResourceStream getMarkupResourceStream(MarkupContainer container, + Class<?> containerClass) + { + return new StringResourceStream("<html><head></head><body>" + + "<form wicket:id=\"form\" id=\"" + MARKUP_ID + "\">" + + "<input wicket:id=\"field\" type=\"text\"/>" + + "<input wicket:id=\"button\" type=\"submit\"/>" + + "</form></body></html>"); + } + } +}
