[WICKET-6732] CSP: inline JS in Link and ExternalLink

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 9.0.0-M4
• Fix Version/s: 9.0.0-M5
• Component/s: wicket-core
• Assignee: Emond Papegaaij
• Reporter: Emond Papegaaij
• Created: 17/Jan/20 09:47
• Updated: 07/Feb/20 16:13
• Resolved: 03/Feb/20 20:43

Description

org.apache.wicket.markup.html.link.Link uses a lot of inline JS, like:

tag.put("onclick", popupSettings.getPopupJavaScript());

tag.put(
	"onclick",
	"var win = this.ownerDocument.defaultView || this.ownerDocument.parentWindow; " +
		"if (win == window) { window.location.href='" +
		url + "'; } ;return false");

// If the subclass specified javascript, use that
final CharSequence onClickJavaScript = getOnClickScript(url);
if (onClickJavaScript != null)
{
	tag.put("onclick", onClickJavaScript);
}

Similar code can be found in ExternalLink.

Also take a look at AjaxFallbackLink. This class removes the onclick attribute from the Link, but that will not work if they are not added in the first place.

Issue Links

• is a child of: WICKET-6687 Cleanup the code from attribute inline styles and attribute inline scripts