This is an automated email from the ASF dual-hosted git repository. dashorst pushed a commit to branch wicket-9.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 946ab8615c7789c9c32a491185bf9e7936e2dd74 Author: Pedro Santos <[email protected]> AuthorDate: Fri Oct 9 18:27:43 2026 -0300 Escape what the default button field writes into its attributes Form#appendDefaultButtonField builds its markup as a string, so the attributes it fills in are not escaped for it: the css class from the resource bundles and the input name of the default button. They are now escaped with Strings#escapeMarkup, as the div of the hidden fields already is. Co-Authored-By: Claude Mythos 5.1 <[email protected]> --- .../org/apache/wicket/markup/html/form/Form.java | 4 +- .../html/form/FormDefaultButtonFieldTest.java | 90 ++++++++++++++++++++++ 2 files changed, 92 insertions(+), 2 deletions(-) diff --git a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java index fa65d921b4..d4968777e1 100644 --- a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java +++ b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java @@ -1287,7 +1287,7 @@ public class Form<T> extends WebMarkupContainer // hidden div buffer.append(String.format("<div hidden=\"\" class=\"%s\">", - getString(HIDDEN_FIELDS_CSS_CLASS_KEY))); + Strings.escapeMarkup(getString(HIDDEN_FIELDS_CSS_CLASS_KEY)))); // add an empty textfield (otherwise IE doesn't work) buffer.append("<input type=\"text\" tabindex=\"-1\" autocomplete=\"off\"/>"); @@ -1296,7 +1296,7 @@ public class Form<T> extends WebMarkupContainer buffer .append(String.format("<input id=\"%s\" type=\"submit\" tabindex=\"-1\" name=\"%s\" />", getHiddenFieldsId(HIDDEN_FIELDS_SUBMIT_IDX), - defaultSubmittingComponent.getInputName())); + Strings.escapeMarkup(defaultSubmittingComponent.getInputName()))); // close div buffer.append("</div>"); diff --git a/wicket-core/src/test/java/org/apache/wicket/markup/html/form/FormDefaultButtonFieldTest.java b/wicket-core/src/test/java/org/apache/wicket/markup/html/form/FormDefaultButtonFieldTest.java new file mode 100644 index 0000000000..1f76487c1c --- /dev/null +++ b/wicket-core/src/test/java/org/apache/wicket/markup/html/form/FormDefaultButtonFieldTest.java @@ -0,0 +1,90 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.wicket.markup.html.form; + +import java.util.Locale; + +import org.apache.wicket.Component; +import org.apache.wicket.MarkupContainer; +import org.apache.wicket.markup.IMarkupResourceStreamProvider; +import org.apache.wicket.markup.html.WebPage; +import org.apache.wicket.resource.loader.IStringResourceLoader; +import org.apache.wicket.util.resource.IResourceStream; +import org.apache.wicket.util.resource.StringResourceStream; +import org.apache.wicket.util.tester.WicketTestCase; +import org.junit.jupiter.api.Test; + +/** + * {@link Form#appendDefaultButtonField()} writes its markup as a string, so it has to escape what it + * puts into the attributes itself. + */ +class FormDefaultButtonFieldTest extends WicketTestCase +{ + /** + * The css class of the hidden div comes from the resource bundles. + */ + @Test + void cssClassIsEscaped() + { + tester.getApplication().getResourceSettings().getStringResourceLoaders().add(0, + new IStringResourceLoader() + { + @Override + public String loadStringResource(Class<?> clazz, String key, Locale locale, + String style, String variation) + { + return Form.HIDDEN_FIELDS_CSS_CLASS_KEY.equals(key) ? "a\"b" : null; + } + + @Override + public String loadStringResource(Component component, String key, Locale locale, + String style, String variation) + { + return loadStringResource((Class<?>)null, key, locale, style, variation); + } + }); + + tester.startPage(new TestPage()); + + tester.assertContains("<div hidden=\"\" class=\"a"b\">"); + } + + /** a form with a default button */ + public static class TestPage extends WebPage implements IMarkupResourceStreamProvider + { + private static final long serialVersionUID = 1L; + + /** */ + public TestPage() + { + Form<Void> form = new Form<Void>("form"); + add(form); + + Button button = new Button("button"); + form.add(button); + form.setDefaultButton(button); + } + + @Override + public IResourceStream getMarkupResourceStream(MarkupContainer container, + Class<?> containerClass) + { + return new StringResourceStream("<html><body><form wicket:id=\"form\">" + + "<input wicket:id=\"button\" type=\"submit\"/></form></body></html>"); + } + } +}
