From 364690f0ed21ad2efc1c6fa11a66842949678caa Mon Sep 17 00:00:00 2001 From: Pedro Santos Date: Sat, 4 Jul 2026 16:48:13 -0300 Subject: [PATCH] WICKET-7183 fix popupsettings#setTarget regression --- .../core/util/string/JavaScriptUtils.java | 27 +++++++++++++++++++ .../wicket/markup/html/link/ExternalLink.java | 6 +++-- .../apache/wicket/markup/html/link/Link.java | 6 +++-- .../markup/html/link/PopupSettings.java | 9 ++++--- 4 files changed, 41 insertions(+), 7 deletions(-) diff --git a/wicket-core/src/main/java/org/apache/wicket/core/util/string/JavaScriptUtils.java b/wicket-core/src/main/java/org/apache/wicket/core/util/string/JavaScriptUtils.java index 2eb4a28ed9..f3871fb316 100644 --- a/wicket-core/src/main/java/org/apache/wicket/core/util/string/JavaScriptUtils.java +++ b/wicket-core/src/main/java/org/apache/wicket/core/util/string/JavaScriptUtils.java @@ -95,6 +95,33 @@ public static CharSequence escapeQuotesAndBackslash(final CharSequence input) return s; } + /** + * Removes the surrounding single quotes from a string after trimming + * leading and trailing whitespace. + * + *

Examples:

+ * 
+	 * unquoteSingleQuoted(" 'url'   ") -> "url"
+	 * unquoteSingleQuoted("'url'")     -> "url"
+	 * unquoteSingleQuoted("''")        -> ""
+	 *
+ * + * @param s the single-quoted string + * @return the contents between the outer single quotes + */ + public static String unquoteSingleQuoted(String s) + { + if (s != null) + { + var trimmed = s.trim(); + if (trimmed.length() > 1 && trimmed.startsWith("'") && trimmed.endsWith("'")) + { + s = trimmed.substring(1, trimmed.length() - 1); + } + } + return s; + } + /** * Write a reference to a javascript file to the response object * diff --git a/wicket-core/src/main/java/org/apache/wicket/markup/html/link/ExternalLink.java b/wicket-core/src/main/java/org/apache/wicket/markup/html/link/ExternalLink.java index 09607c8fc8..229f77d8f9 100644 --- a/wicket-core/src/main/java/org/apache/wicket/markup/html/link/ExternalLink.java +++ b/wicket-core/src/main/java/org/apache/wicket/markup/html/link/ExternalLink.java @@ -27,6 +27,8 @@ import org.apache.wicket.request.cycle.RequestCycle; import org.apache.wicket.request.flow.RedirectToUrlException; +import static org.apache.wicket.core.util.string.JavaScriptUtils.escapeQuotesAndBackslash; + /** *

* A simple anchor link (<a href="http://url">) pointing to any URL. Usually this is used for @@ -189,7 +191,7 @@ public void renderHead(IHeaderResponse response) { if (popupSettings != null) { - popupSettings.setTarget(url); + popupSettings.setTarget("'" + url + "'"); response.render(OnEventHeaderItem.forComponent(this, "click", popupSettings.getPopupJavaScript())); return; @@ -208,7 +210,7 @@ public void renderHead(IHeaderResponse response) response.render(OnEventHeaderItem.forComponent(this, "click", "var win = this.ownerDocument.defaultView || this.ownerDocument.parentWindow; " // + "if (win == window) { window.location.href='" // - + JavaScriptUtils.escapeQuotes(url) // + + escapeQuotesAndBackslash(url) // + "'; } ;return false")); return; } diff --git a/wicket-core/src/main/java/org/apache/wicket/markup/html/link/Link.java b/wicket-core/src/main/java/org/apache/wicket/markup/html/link/Link.java index a2b8486403..cf0fb445c8 100644 --- a/wicket-core/src/main/java/org/apache/wicket/markup/html/link/Link.java +++ b/wicket-core/src/main/java/org/apache/wicket/markup/html/link/Link.java @@ -28,6 +28,8 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.request.mapper.parameter.PageParameters; +import static org.apache.wicket.core.util.string.JavaScriptUtils.escapeQuotesAndBackslash; + /** * Implementation of a hyperlink component. A link can be used with an anchor (<a href...) * element or any element that supports the onclick javascript event handler (such as buttons, td @@ -414,7 +416,7 @@ public void renderHead(IHeaderResponse response) // next check for popup settings if (popupSettings != null) { - popupSettings.setTarget(url.toString()); + popupSettings.setTarget("'" + url.toString() + "'"); response.render(OnEventHeaderItem.forComponent(this, "click", popupSettings.getPopupJavaScript())); return; @@ -431,7 +433,7 @@ public void renderHead(IHeaderResponse response) // generated during page load. This check ensures that the click is ignored response.render(OnEventHeaderItem.forComponent(this, "click", "var win = this.ownerDocument.defaultView || this.ownerDocument.parentWindow; " - + "if (win == window) { window.location.href='" + url + + "if (win == window) { window.location.href='" + escapeQuotesAndBackslash(url) + "'; } ;return false")); } } diff --git a/wicket-core/src/main/java/org/apache/wicket/markup/html/link/PopupSettings.java b/wicket-core/src/main/java/org/apache/wicket/markup/html/link/PopupSettings.java index e62b3e01be..bb20ed711a 100644 --- a/wicket-core/src/main/java/org/apache/wicket/markup/html/link/PopupSettings.java +++ b/wicket-core/src/main/java/org/apache/wicket/markup/html/link/PopupSettings.java @@ -21,6 +21,9 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import static org.apache.wicket.core.util.string.JavaScriptUtils.escapeQuotesAndBackslash; +import static org.apache.wicket.core.util.string.JavaScriptUtils.unquoteSingleQuoted; + /** * A popup specification can be used as a property of the {@link Link}classes to specify that the @@ -156,10 +159,10 @@ public String getPopupJavaScript() windowTitle = windowTitle.replaceAll("\\W", "_"); } + var escapedTarget = escapeQuotesAndBackslash(unquoteSingleQuoted(target)); StringBuilder script = new StringBuilder(// - "var w = window.open('"// - + JavaScriptUtils.escapeQuotes(target) // - + "', '").append(windowTitle).append("', '"); + "var w = window.open('" + escapedTarget + "', '" // + ).append(windowTitle).append("', '"); script.append("scrollbars=").append(flagToString(SCROLLBARS)); script.append(",location=").append(flagToString(LOCATION_BAR));