This is an automated email from the ASF dual-hosted git repository. dashorst pushed a commit to branch wicket-8.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 8549904b1599f41ef561fe0bfbb5923ae4398ebd Author: Pedro Santos <[email protected]> AuthorDate: Fri Oct 2 19:59:52 2026 -0300 Say in the javadoc that a listener url is written into the script as it stands Form#getJsForListenerUrl writes the url it is handed into the single-quoted string literal the form action is assigned from. A url Wicket rendered is safe there, because UrlEncoder percent-encodes the quote and the backslash, but the method is public and nothing told a caller that builds a url itself that the value ends up in JavaScript. Where the framework writes a value the caller supplies into JavaScript, the contract belongs in the javadoc of the method that takes it, as PopupSettings#setTarget states the shape its target has to have. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../src/main/java/org/apache/wicket/markup/html/form/Form.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java index fc64c33364..b401e78f44 100644 --- a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java +++ b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/Form.java @@ -528,6 +528,12 @@ public class Form<T> extends WebMarkupContainer * Warning: This code should only be called in the rendering phase for form components inside * the form because it uses the css/javascript id of the form which can be stored in the markup. * + * <strong>Note</strong>: the url is written into the generated script as it stands, inside the + * single-quoted string literal the form action is assigned from. A url Wicket rendered is safe + * there, because {@link org.apache.wicket.util.encoding.UrlEncoder} percent-encodes the quote + * and the backslash; a url the caller builds itself stays the caller's to encode, for example + * with {@link org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes(CharSequence)}. + * * @param url * The listener url to be submitted to * @return the javascript code that submits the form.
