This is an automated email from the ASF dual-hosted git repository. dashorst pushed a commit to branch wicket-8.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 05bdcbbee3e8b10e4ae6a6086a863ecc4f2c17ba Author: Pedro Santos <[email protected]> AuthorDate: Sat Oct 3 12:59:24 2026 -0300 Escape the starting text of the upload progress bar UploadProgressBar reads the text it shows while an upload starts from the application's resource bundles and writes it into a JavaScript string literal of its initialization script as it stands. A translation carrying an apostrophe did not hold as the literal it was pasted into, and the javadoc invites one by naming the resource key for customising that text. It now goes through JavaScriptUtils#escapeQuotes, as the delete label of MultiFileUploadField does. The ids the same script writes stay as they are: an id is restricted where it enters, and a text from a bundle is not. Co-Authored-By: Claude Fable 5 <[email protected]> --- .../markup/html/form/upload/UploadProgressBar.java | 3 +- .../html/form/upload/UploadProgressBarTest.java | 88 ++++++++++++++++++++++ 2 files changed, 90 insertions(+), 1 deletion(-) diff --git a/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java b/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java index f6d3f4b8dd..c25e3c9b23 100644 --- a/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java +++ b/wicket-extensions/src/main/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBar.java @@ -21,6 +21,7 @@ import java.util.Formatter; import org.apache.wicket.Application; import org.apache.wicket.IInitializer; import org.apache.wicket.MarkupContainer; +import org.apache.wicket.core.util.string.JavaScriptUtils; import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow; import org.apache.wicket.markup.head.CssHeaderItem; import org.apache.wicket.markup.head.IHeaderResponse; @@ -243,7 +244,7 @@ public class UploadProgressBar extends Panel formatter.format( "new Wicket.WUPB('%s', '%s', '%s', '%s', '%s', '%s');", getCallbackForm().getMarkupId(), statusDiv.getMarkupId(), barDiv.getMarkupId(), url, uploadFieldId, - status); + JavaScriptUtils.escapeQuotes(status)); response.render(OnDomReadyHeaderItem.forScript(builder.toString())); } diff --git a/wicket-extensions/src/test/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBarTest.java b/wicket-extensions/src/test/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBarTest.java new file mode 100644 index 0000000000..6faad869eb --- /dev/null +++ b/wicket-extensions/src/test/java/org/apache/wicket/extensions/ajax/markup/html/form/upload/UploadProgressBarTest.java @@ -0,0 +1,88 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.wicket.extensions.ajax.markup.html.form.upload; + +import static org.junit.Assert.assertTrue; + +import java.util.Locale; + +import org.apache.wicket.Component; +import org.apache.wicket.MarkupContainer; +import org.apache.wicket.markup.IMarkupResourceStreamProvider; +import org.apache.wicket.markup.html.WebPage; +import org.apache.wicket.markup.html.form.Form; +import org.apache.wicket.resource.loader.IStringResourceLoader; +import org.apache.wicket.util.resource.IResourceStream; +import org.apache.wicket.util.resource.StringResourceStream; +import org.apache.wicket.util.tester.WicketTestCase; +import org.junit.Test; + +/** + * Tests for {@link UploadProgressBar}. + */ +public class UploadProgressBarTest extends WicketTestCase +{ + /** + * The starting text from the resource bundle is written into a JavaScript string literal. + */ + @Test + public void startingTextIsEscapedForJavaScript() + { + tester.getApplication().getResourceSettings().getStringResourceLoaders().add(0, + new IStringResourceLoader() + { + @Override + public String loadStringResource(Class<?> clazz, String key, Locale locale, + String style, String variation) + { + return UploadProgressBar.RESOURCE_STARTING.equals(key) ? "l'\\envoi" : null; + } + + @Override + public String loadStringResource(Component component, String key, Locale locale, + String style, String variation) + { + return loadStringResource((Class<?>)null, key, locale, style, variation); + } + }); + + tester.startPage(new TestPage()); + + String response = tester.getLastResponseAsString(); + assertTrue(response, response.contains("'l\\'\\\\envoi'")); + } + + private static class TestPage extends WebPage implements IMarkupResourceStreamProvider + { + private static final long serialVersionUID = 1L; + + TestPage() + { + Form<Void> form = new Form<Void>("form"); + add(form); + form.add(new UploadProgressBar("bar", form)); + } + + @Override + public IResourceStream getMarkupResourceStream(MarkupContainer container, + Class<?> containerClass) + { + return new StringResourceStream("<html><head></head><body>" + + "<form wicket:id=\"form\"><div wicket:id=\"bar\"></div></form></body></html>"); + } + } +}
