aeonframework opened a new pull request, #1667: URL: https://github.com/apache/wicket/pull/1667
Resolves [WICKET-6938](https://issues.apache.org/jira/browse/WICKET-6938). ### Problem Wicket's default Content Security Policy (`strict()`: `script-src 'strict-dynamic' 'nonce-…'`) blocks two things wicket-extensions still relies on: - **AutoCompleteTextField selection hooks.** `AbstractAutoCompleteRenderer#getOnSelectJavaScriptExpression` is written into an `onselect` attribute of each choice, and `wicket-autocomplete.js` runs it with `eval()`. Without `'unsafe-eval'` that throws, so selecting an item with an expression does nothing, and the only way to use the hook is to weaken the CSP for the whole application. The hook also invites building JavaScript from item data by string concatenation, as its own javadoc examples do; the markup escaping of the attribute does not protect that data once `eval()` decodes it. - **ChoiceFilter auto-submit.** With `autoSubmit` the select is rendered with `onchange="this.form.submit();"`, an inline handler the CSP blocks, so the filter silently stops submitting on change. ### Approach Two commits, each standing on its own: 1. **ChoiceFilter** registers the same handler with an `OnEventHeaderItem`, the way `FilterForm#enableFocusTracking` already does, so the script carries the CSP nonce. The markup only loses the attribute. 2. **Autocomplete** dispatches a cancelable, bubbling `wicket-autocomplete-select` `CustomEvent` on the input. `detail.item` is the chosen element and `detail.value` the text value; a listener may replace `detail.value`, or call `preventDefault()` to leave the input unchanged (what returning `null` from the expression did). Data a listener needs comes from the new `AbstractAutoCompleteRenderer#getChoiceData(T)`, written as markup-escaped `data-*` attributes whose names must match `[a-z][a-z0-9-]*`. The listener is registered from `renderHead()`, so it carries the nonce and nothing is evaluated. The class javadoc shows a complete listener. `getOnSelectJavaScriptExpression` is `@Deprecated(since = "11.0.0", forRemoval = true)` and keeps working where `'unsafe-eval'` is allowed: its result becomes the initial `detail.value`, and the expression still sees the text value as `input` and `arguments[0]`. Applications that do not override it see no change. Migration: move the expression into a `wicket-autocomplete-select` listener and expose the values it needs through `getChoiceData`. ### Tests - `mvn clean verify -Pjs-test -pl wicket-extensions,testing/wicket-js-tests -amd` (JDK 21, after `mvn clean install -DskipTests -Pfast`): BUILD SUCCESS. wicket-extensions 114/114, wicket-examples 67 run with 0 failures (14 skipped), QUnit 162/162 (jQuery) and 161/161 (vanilla). japicmp and javadoc ran clean. - New `ChoiceFilterTest`: checks there is no inline `onchange` and that the header registers the change handler. It fails on the base code. - `AbstractAutoCompleteRendererTest`: checks `getChoiceData` escaping, skipping of `null` values, and rejection of invalid attribute names. - New QUnit `autocomplete-test.js` + `autocomplete.html`, wired into `Gruntfile.js` for both engines and listed in `JAVASCRIPTTESTING.md`. It covers the event and its detail, a listener replacing the value, a listener cancelling the selection, and a deprecated expression still getting the text value as `arguments[0]`. Against the base `wicket-autocomplete.js` its 3 event assertions fail. ### Follow-ups - On master after this lands: remove `getOnSelectJavaScriptExpression` and the `eval()` fallback. - Separate change: core still builds string Ajax call listeners with `new Function()`, which also needs `'unsafe-eval'`. This change was prepared with AI assistance and reviewed and tested by me. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
