Emond Papegaaij

Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource

Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names

Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data

Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name

Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in

Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication