Wicket 口中的javascript注入(inject)

Question

我有一个使用 wicket 框架的 J2EE 项目。我想知道如何防止在 wicket 中注入(inject) javascript？

Answer 1

尽管我认为您提出问题的方式不值得(没有详细信息、没有背景、没有示例问题陈述、隐含的注入(inject)敏感性等)，但我还是从 Excellent Wicket in Action 中挖掘了一些细节。 :

Wicket 默认是安全的

You never need to worry about pimple-faced 14-year-olds trying to hack your web application. To do so, they would have to hijack the session and then guess the right page identifiers and version numbers, which would be relative to the session and the relevant component paths. You’d have to be a persistent hacker to pull that off. You can make your Wicket application even more secure from the default by encrypting requests with, for instance, CryptedUrlWebRequestCodingStrategy.