[WICKET-6687] Cleanup the code from attribute inline styles and attribute inline scripts

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 9.0.0-M5
• Component/s: wicket-core
• Assignee: Emond Papegaaij
• Reporter: Andrew Kondratev
• Created: 17/Jul/19 02:29
• Updated: 25/Feb/20 20:35
• Resolved: 25/Feb/20 20:35

Description

Another issue for improving Wicket's Content Security Policy(CSP) compatibility is an abundance of attribute inline styles and scripts, such as style="display: none", onclick="doSomething()", and href="javascript:doSomething();" all these could be easily replaced with appropriate nonced inline scripts and styles or references to predefined css classes and js functions.

Examples

org.apache.wicket.ajax.markup.html.AjaxLink#onComponentTag : should rather completely remove the href, potentially some css class like `wicket-ajax-link` could be added

if (tagName.equalsIgnoreCase("a") || tagName.equalsIgnoreCase("link") ||
	tagName.equalsIgnoreCase("area"))
{
	// disable any href attr in markup
	tag.put("href", "javascript:;");
}

org.apache.wicket.Component#renderPlaceholderTag : should rather add some special css class, or javascript which can set display none programmatically (and can also be nonced)

response.write("<");
response.write(name);
response.write(" id=\"");
response.write(getAjaxRegionMarkupId());
response.write("\" style=\"display:none\" data-wicket-placeholder=\"\"></");
response.write(name);
response.write(">");

(org.apache.wicket.extensions.ajax.markup.html.AjaxIndicatorAppender#afterRender has the same issue)

org.apache.wicket.markup.html.form.Form#appendDefaultButtonField : this piece is just ridiculous to have in 2019

buffer.append(String.format("<div style=\"width:0px;height:0px;position:absolute;left:-100px;top:-100px;overflow:hidden\" class=\"%s\">", cssClass));

org.apache.wicket.markup.html.form.Form#appendDefaultButtonField

buffer.append(defaultSubmittingComponent.getInputName());
buffer.append("\" onclick=\" var b=document.getElementById('");
buffer.append(submittingComponent.getMarkupId());

Issue Links

• is a parent of: WICKET-6745 CSP: inline JS in server and client time response filters
• is a parent of: WICKET-6724 CSP: Inline Javascript in AjaxLink
• is a parent of: WICKET-6725 CSP: display:none in Component.renderPlaceholderTag
• is a parent of: WICKET-6726 CSP: inline styling and js in Form submitbutton handling
• is a parent of: WICKET-6731 CSP: inline JS in SubmitLink
• is a parent of: WICKET-6732 CSP: inline JS in Link and ExternalLink
• is a parent of: WICKET-6733 CSP: enable by default
• is a parent of: WICKET-6735 CSP: inline styling in FormComponentFeedbackBorder/Indicator
• is a parent of: WICKET-6736 CSP: Inline styling in BrowserInfoForm
• is a parent of: WICKET-6737 CSP: violations in examples
• is a parent of: WICKET-6738 CSP: inline styling in UploadProgressBar
• is a parent of: WICKET-6739 CSP: inline JS in Palette
• is a parent of: WICKET-6740 CSP: inline JS in Button
• is a parent of: WICKET-6741 CSP: inline JS in FormComponentUpdatingBehavior
• is a parent of: WICKET-6749 CSP: Inline styling in ExceptionErrorPage.html
• is a parent of: WICKET-6747 Document CSP in user guide and migration guide
• is related to: WICKET-6682 Improve JavaScriptContentHeaderItem and JavaScriptUtils to support nonce
• mentioned in: Page Loading...