[jira] [Updated] (WICKET-6731) CSP: inline JS in SubmitLink

["Emond Papegaaij (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WICKET-6731?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Emond Papegaaij updated WICKET-6731:
------------------------------------
    Issue Type: Improvement  (was: Bug)

> CSP: inline JS in SubmitLink
> ----------------------------
>
>                 Key: WICKET-6731
>                 URL: https://issues.apache.org/jira/browse/WICKET-6731
>             Project: Wicket
>          Issue Type: Improvement
>          Components: wicket-core
>    Affects Versions: 9.0.0-M4
>            Reporter: Emond Papegaaij
>            Priority: Major
>
> {{org.apache.wicket.markup.html.formSubmitLink}} uses inline Javascript in two places.
> The href attribute is replaced with empty JS. This will cause a CSP violation. A different solution needs to be found. Probably via a JS event handler that calls {{event.preventDefault()}}.
> {code:java}
> tag.put("href", "javascript:;");
> {code}
> The trigger javascript is rendered as onclick. This needs to be an event handler.
> {code:java}
> tag.put("onclick", getTriggerJavaScript());
> {code}



--
This message was sent by Atlassian Jira
(v8.3.4#803005)