[
https://issues.apache.org/jira/browse/WICKET-6731?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17024172#comment-17024172
]
ASF subversion and git services commented on WICKET-6731:
---------------------------------------------------------
Commit a6ed6f294707ecd6606b089b074a3098b4add6c3 in wicket's branch
refs/heads/master from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=a6ed6f2 ]
WICKET-6731: move inline onclick to event handler
> CSP: inline JS in SubmitLink
> ----------------------------
>
> Key: WICKET-6731
> URL: https://issues.apache.org/jira/browse/WICKET-6731
> Project: Wicket
> Issue Type: Improvement
> Components: wicket-core
> Affects Versions: 9.0.0-M4
> Reporter: Emond Papegaaij
> Priority: Major
>
> {{org.apache.wicket.markup.html.formSubmitLink}} uses inline Javascript in
> two places.
> The href attribute is replaced with empty JS. This will cause a CSP
> violation. A different solution needs to be found. Probably via a JS event
> handler that calls {{event.preventDefault()}}.
> {code:java}
> tag.put("href", "javascript:;");
> {code}
> The trigger javascript is rendered as onclick. This needs to be an event
> handler.
> {code:java}
> tag.put("onclick", getTriggerJavaScript());
> {code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
