Non-existant package resources lazily added to pool
---------------------------------------------------
Key: WICKET-1556
URL: https://issues.apache.org/jira/browse/WICKET-1556
Project: Wicket
Issue Type: Bug
Components: wicket
Affects Versions: 1.3.3
Environment: any environment
Reporter: Nathan Hamblen
Attachments: lazy-res.diff
When a SharedResourceRequestTarget is looking for a resource respond to the
request, it can (improperly) create a package resource that does not exist and
add it to the shared resource pool. While this doesn't pose an immediate
problem, it has a seriously side effect for auto-link resolution in subsequent
requests. If a local-specific potential name coincides with the non-existant
shared resource, that bad reference will be used to generate the auto-link URL.
For example:
A page refers to href="style.css" in an autolink. This loads correctly, UNTIL
anyone on the internet requests "style_en.css" (which could be an old resource
name still known to crawlers). Now that name is added to the resource pool, and
the next request for locale "en" will find that bad resource in pool, thinking
it is a good local-specific stylesheet, and render href="style_en.css" for the
page. This resource does not exist, will not be found, and all "en" users will
now see the page without styles.
This is fully reproducible in Wicket 1.3.3, while 1.3.2 is not susceptible. I'm
not sure where the effective code change was (it doesn't seem to be in this
chunk of code), but this particular problem can be easily fixed by checking if
a resource exists before trying to "get" it and add it to the pool. Will upload
patch.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
