[WICKET-6725] CSP: display:none in Component.renderPlaceholderTag

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 9.0.0-M5
• Component/s: wicket-core
• Assignee: Emond Papegaaij
• Reporter: Emond Papegaaij
• Created: 12/Jan/20 19:23
• Updated: 06/Feb/20 20:32
• Resolved: 22/Jan/20 08:27

Description

org.apache.wicket.Component#renderPlaceholderTag : should rather add some special css class, or javascript which can set display none programmatically (and can also be nonced)

response.write("<");
response.write(name);
response.write(" id=\"");
response.write(getAjaxRegionMarkupId());
response.write("\" style=\"display:none\" data-wicket-placeholder=\"\"></");
response.write(name);
response.write(">");

(org.apache.wicket.extensions.ajax.markup.html.AjaxIndicatorAppender#afterRender has the same issue)

Issue Links

• is a child of: WICKET-6687 Cleanup the code from attribute inline styles and attribute inline scripts
• links to: GitHub Pull Request #400