javascript injection in wicket

java, javascript, wicket

Solution

Although I didn't think the way in which you formulated your question deserved it (no details, no background, no example problem statement, implied susceptability to injection, etc), I dug up some details from the Excellent Wicket in Action:

Wicket is secure by default

You never need to worry about pimple-faced 14-year-olds trying to hack your web application. To do so, they would have to hijack the session and then guess the right page identifiers and version numbers, which would be relative to the session and the relevant component paths. You’d have to be a persistent hacker to pull that off. You can make your Wicket application even more secure from the default by encrypting requests with, for instance, CryptedUrlWebRequestCodingStrategy.

Problem

Original source