reiern70 opened a new issue, #1884:
URL: https://github.com/apache/wicket/issues/1884
**Affects:** 11.0.0; also current master (a7a4a4018d).
**Component:** wicket-core, `AbstractTextComponent`, `EmailAddressValidator`
## What happens
A page with an `EmailTextField` renders:
```html
<input type="email" ...
pattern="^[_A-Za-z0-9-]+(\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*((\.[A-Za-z]{2,}){1}$)">
```
Chrome logs this error on the page, and again on each form submit:
```
Pattern attribute value ^[_A-Za-z0-9-]+(\.[_A-Za-z0-9-]+)*@... is not a
valid regular expression:
Uncaught SyntaxError: Invalid regular expression: /^[_A-Za-z0-9-]+(...)$/v:
Invalid character class
```
The browser then ignores the `pattern` attribute. The field still works,
because `type="email"` makes the browser check the address, and
`EmailAddressValidator` checks it again on the server. The result is console
noise on every page with an email field, plus a `pattern` attribute that does
nothing.
## Cause
`AbstractTextComponent#onComponentTag` copies the Java regular expression of
every `PatternValidator` into the HTML `pattern` attribute (`tag.put("pattern",
((PatternValidator)validator).getPattern().toString())`).
The HTML standard compiles `pattern` with the `v` flag (unicodeSets mode),
and current browsers follow it. In `v` mode, a `-` that is not escaped inside a
character class is a syntax error. That makes `[_A-Za-z0-9-]` invalid there,
although Java accepts it.
## Fix proposed
Escape the hyphens in `EmailAddressValidator`. The pattern below is valid in
Java, and valid in the browser in `v` mode. It matches the same addresses
(checked in Java and in Node with `new RegExp(..., "v")`):
```java
"^[_A-Za-z0-9\\-]+(\\.[_A-Za-z0-9\\-]+)*@[A-Za-z0-9\\-]+(\\.[A-Za-z0-9\\-]+)*((\\.[A-Za-z]{2,}){1}$)"
```
Two broader options:
- Note in the javadoc of `PatternValidator` that its pattern is sent to the
browser, and must also be valid as a JavaScript regular expression in `v` mode.
- Let an application keep a `PatternValidator` on the server without the
attribute, for patterns that Java and JavaScript do not share.
## Workaround
Add a behavior to the field after the validator, which removes the attribute:
```java
email.add(new Behavior() {
@Override
public void onComponentTag(Component component, ComponentTag tag) {
tag.remove("pattern");
}
});
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
