[WICKET-6731] CSP: inline JS in SubmitLink

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 9.0.0-M4
• Fix Version/s: 9.0.0-M5
• Component/s: wicket-core
• Assignee: Emond Papegaaij
• Reporter: Emond Papegaaij
• Created: 17/Jan/20 09:39
• Updated: 02/Feb/20 19:38
• Resolved: 27/Jan/20 09:13

Description

org.apache.wicket.markup.html.formSubmitLink uses inline Javascript in two places.

The href attribute is replaced with empty JS. This will cause a CSP violation. A different solution needs to be found. Probably via a JS event handler that calls event.preventDefault().

tag.put("href", "javascript:;");

The trigger javascript is rendered as onclick. This needs to be an event handler.

tag.put("onclick", getTriggerJavaScript());

Issue Links

• is a child of: WICKET-6687 Cleanup the code from attribute inline styles and attribute inline scripts
• links to: GitHub Pull Request #402