[WICKET-6724] CSP: Inline Javascript in AjaxLink

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 9.0.0-M5
• Component/s: wicket-core
• Assignee: Unassigned
• Reporter: Emond Papegaaij
• Created: 12/Jan/20 19:20
• Updated: 21/Jan/20 09:17
• Resolved: 17/Jan/20 10:30

Description

org.apache.wicket.ajax.markup.html.AjaxLink#onComponentTag : should rather completely remove the href, potentially some css class like `wicket-ajax-link` could be added

if (tagName.equalsIgnoreCase("a") || tagName.equalsIgnoreCase("link") ||
	tagName.equalsIgnoreCase("area"))
{
	// disable any href attr in markup
	tag.put("href", "javascript:;");
}

Issue Links

• is a child of: WICKET-6687 Cleanup the code from attribute inline styles and attribute inline scripts