[WICKET-6708] FormComponent should read only the GET/POST parameters of the request, not both

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.6.1, 7.15.0, 9.0.0-M3
• Fix Version/s: 8.7.0, 9.0.0-M4, 7.16.0
• Component/s: wicket
• Assignee: Martin Tzvetanov Grigorov
• Reporter: Martin Tzvetanov Grigorov
• Created: 07/Oct/19 18:56
• Updated: 31/Jul/20 07:35
• Resolved: 09/Oct/19 12:39

Description

org.apache.wicket.markup.html.form.FormComponent#getInputAsArray() currently uses org.apache.wicket.request.Request#getRequestParameters() to read the value(s) of their respective parameter.

It should use only the parameters for the actual method (GET or POST) instead to prevent any data leakage.

If form submit is in place then the method mismatch should be handled at org.apache.wicket.markup.html.form.Form#onMethodMismatch()

Issue Links

• is related to: WICKET-6807 Fake Submitting Button