dashorst opened a new issue, #1864: URL: https://github.com/apache/wicket/issues/1864
`XmlPullParser` ends an unquoted attribute value at the first character outside `[\w\-.]`, so a value such as a URL or a path is cut off, and the rest of it is parsed as further attributes. HTML allows unquoted values containing anything except whitespace, `"`, `'`, `=`, `<`, `>` and `` ` ``, so `<a href=foo/bar.html>` is valid markup. ```text <a href=foo/bar.html> -> href="foo" bar.html="" <a href=https://example.org/x> -> href="https" :="" example.org="" x="" <html xmlns:wicket=http://wicket.apache.org> -> xmlns:wicket="http" :="" wicket.apache.org="" ``` Markup that Wicket passes through as raw text is not affected, because it is written out as authored. A tag that Wicket writes from its parsed attributes is: every component tag, a tag changed by a markup filter, and, after #1848, the `<html>` tag of a page. The rendered tag then carries the truncated value and the stray attributes. The cause is the unquoted alternative of `MetaPattern._STRING` in wicket-util, `[\w\-\.]+`, which `VariableAssignmentParser` uses for attribute values. Widening it to `[^\s"'=<>`]+` would match the HTML rules; `MetaPattern.STRING` is public, so the change, or a separate pattern for attribute values, needs a look at its other users. Found while working on #1848, where the `OpenCloseTagExpander` test markup had `xmlns:wicket=http://wicket.apache.org/dtds.data/wicket-xhtml1.4-strict.dtd` unquoted. That test now quotes the value. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
