This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a commit to branch wicket-8.x
in repository https://gitbox.apache.org/repos/asf/wicket.git
The following commit(s) were added to refs/heads/wicket-8.x by this push:
new 79bb80948e WICKET-7194 Deprecate the Include component for security
reasons
79bb80948e is described below
commit 79bb80948eb97274123dff7b9e52ca0445b63291
Author: Emond Papegaaij <[email protected]>
AuthorDate: Thu Aug 20 15:17:10 2026 +0200
WICKET-7194 Deprecate the Include component for security reasons
Include fetches the URL its model resolves to and writes the response into
the
page body verbatim, so the model value decides three separate things at
once:
what the server connects to, what ends up in the page, and how much of it is
read.
Where anything in the request can influence that value, the component
reaches
file:, jar: and ftp: URLs as well as hosts only the server can see, because
UrlResourceStream calls URL#openConnection without restricting the scheme;
it
puts the response in the page unescaped, because onComponentTagBody hands
the
content to replaceComponentTagBody, which writes the body straight to the
response; and it reads without bound, because ResourceUtil#readString
buffers the
whole stream with no size limit while UrlResourceStream sets neither a
connect
nor a read timeout. The relative form goes through
ServletContext#getResource,
reaching /WEB-INF as well.
None of that is a defect in the implementation. Fetching an arbitrary URL
and
splicing its raw content into a page is what the component is for, and
restricting the scheme, the host, the size or the escaping would leave
nothing of
it. It is therefore deprecated with no replacement offered: the secure
course is
to stop including remote content rather than to include it differently, so
there
is nothing to migrate to. Applications using it for page composition should
use
Panels, Borders and markup inheritance instead.
This is the second of the two cases SECURITY.md describes, where the design
rather than the implementation is the problem, and the javadoc says so in
as many
words so that it is clear before reporting. From this release the component
is
out of scope for the security process on the same footing as any other
deprecated
code.
On this line the bare @Deprecated form is used, since 8.x targets Java 8
and the
since and forRemoval members were added in Java 9. The component is removed
outright on master, in Wicket 11. The compref example that demonstrates it
is
left as it is, per SECURITY.md, which corrects the examples on master only.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
.../apache/wicket/markup/html/include/Include.java | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git
a/wicket-core/src/main/java/org/apache/wicket/markup/html/include/Include.java
b/wicket-core/src/main/java/org/apache/wicket/markup/html/include/Include.java
index 0076e18f39..ace9fca4cd 100644
---
a/wicket-core/src/main/java/org/apache/wicket/markup/html/include/Include.java
+++
b/wicket-core/src/main/java/org/apache/wicket/markup/html/include/Include.java
@@ -77,9 +77,30 @@ import org.apache.wicket.util.lang.Args;
* </pre>
*
* </p>
+ * <p>
+ * <strong>This component is deprecated for security reasons and cannot be
made safe.</strong> It
+ * connects to whatever URL its model resolves to and writes the response into
the page body
+ * without escaping it, so the model value decides three separate things at
once: what the server
+ * connects to, what ends up in the page, and how much of it is read. Where
anything in the request
+ * can influence that value, a caller reaches {@code file:}, {@code jar:} and
{@code ftp:} URLs as
+ * well as hosts only the server can see, places arbitrary markup and script
in the application's
+ * own origin, and pins a render thread on a read that has neither a size
limit nor a timeout.
+ * </p>
+ * <p>
+ * None of that is a defect in the implementation. Fetching an arbitrary URL
and splicing its raw
+ * content into a page is what this component is for, and restricting the
scheme, the host, the size
+ * or the escaping would leave nothing of it, so there is no replacement and
no configuration that
+ * makes it safe. Applications using it for page composition — the
reason most reach for it
+ * — should use Panels, Borders and markup inheritance as described
above; for including
+ * remote content there is nothing to migrate to. See {@code SECURITY.md} for
the scope this places
+ * the component in.
+ * </p>
*
* @author Eelco Hillenius
+ * @deprecated no replacement; see above. Fetching a URL and rendering its
content unescaped cannot
+ * be made safe, so this component is removed in Wicket 11.
*/
+@Deprecated
public class Include extends WebComponent implements IGenericComponent<String,
Include>
{
private static final long serialVersionUID = 1L;
