/*
 * Licensed to the Apache Software Foundation (ASF) under one or more contributor license
 * agreements. See the NOTICE file distributed with this work for additional information regarding
 * copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance with the License. You may obtain a
 * copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable
 * law or agreed to in writing, software distributed under the License is distributed on an "AS IS"
 * BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License
 * for the specific language governing permissions and limitations under the License.
 */
package org.apache.wicket.examples.csp;

import org.apache.wicket.AttributeModifier;
import org.apache.wicket.ajax.AjaxRequestTarget;
import org.apache.wicket.ajax.markup.html.AjaxLink;
import org.apache.wicket.examples.WicketExamplePage;
import org.apache.wicket.markup.head.CssHeaderItem;
import org.apache.wicket.markup.head.IHeaderResponse;
import org.apache.wicket.markup.head.JavaScriptHeaderItem;
import org.apache.wicket.markup.html.WebMarkupContainer;
import org.apache.wicket.markup.html.basic.Label;
import org.apache.wicket.model.IModel;
import org.apache.wicket.model.Model;
import org.apache.wicket.request.resource.CssResourceReference;
import org.apache.wicket.request.resource.JavaScriptResourceReference;
import org.apache.wicket.request.resource.ResourceReference;

/**
 * Page which disallows execution of inline scripts without nonce
 */
public class NonceDemoPage extends WicketExamplePage
{

	private static final ResourceReference JS_DELAYED =
		new JavaScriptResourceReference(NonceDemoPage.class, "delayedVisible.js");

	private static final ResourceReference CSS_DELAYED =
		new CssResourceReference(NonceDemoPage.class, "delayedVisible.css");

	private final IModel<Integer> clickMeCountModel = Model.of(0);

	public NonceDemoPage()
	{
		super();
		add(new Label("testNonceScript", getString("testNonceScript")));
		add(new Label("testNoNonceScript", getString("testNoNonceScript")));

		final Label clickMeCount = new Label("clickMeCount", clickMeCountModel);
		clickMeCount.setOutputMarkupId(true);
		add(clickMeCount);

		final WebMarkupContainer delayedVisible = new WebMarkupContainer("delayedVisible")
		{
			private static final long serialVersionUID = 1L;

			@Override
			public void renderHead(IHeaderResponse response)
			{
				super.renderHead(response);

				response.render(JavaScriptHeaderItem.forReference(JS_DELAYED));
				response.render(CssHeaderItem.forReference(CSS_DELAYED));
			}
		};
		delayedVisible.setOutputMarkupPlaceholderTag(true);
		delayedVisible.setVisible(false);
		add(delayedVisible);
		
		WebMarkupContainer blacktext = new WebMarkupContainer("blacktext");
		blacktext.setOutputMarkupId(true);
		add(blacktext);

		add(new AjaxLink<String>("clickMe")
		{
			private static final long serialVersionUID = 1L;

			@Override
			public void onClick(AjaxRequestTarget target)
			{
				clickMeCountModel.setObject(clickMeCountModel.getObject() + 1);

				// target.add (works even without unsafe-eval)
				target.add(clickMeCount);

				// append javascript (works even without unsafe-eval)
				target.appendJavaScript(
					"document.querySelector(\".click-me-text\").innerHTML = \"replaced\";");

				delayedVisible.setVisible(true);
				target.add(delayedVisible);
				
				blacktext.add(AttributeModifier.replace("style", "color: red"));
				target.add(blacktext);
			}
		}.setOutputMarkupId(true));
	}

	@Override
	public void renderHead(IHeaderResponse response)
	{
		super.renderHead(response);
		// Add inline script with nonce
		response.render(JavaScriptHeaderItem.forScript(
			"$(function(){$(\".test-nonce-script\").html(\"Text injected by script with nonce: success\");});",
			"test-nonce-script"));
		// Add inline css with nonce
		response.render(
			CssHeaderItem.forCSS(".injected-style--with-nonce{color: green; font-weight: bold;}",
				"injected-style-with-nonce"));
	}

	@Override
	public void detachModels()
	{
		super.detachModels();
		clickMeCountModel.detach();
	}
}

@@ -65,16 +65,19 @@
  or more
+%0A *
  contrib
@@ -88,19 +88,16 @@
  license
-%0A *
  agreeme
@@ -100,16 +100,17 @@
 eements.
+ 
  See the
@@ -138,16 +138,19 @@
 ted with
+%0A *
  this wo
@@ -188,19 +188,16 @@
 egarding
-%0A *
  copyrig
@@ -209,16 +209,19 @@
 nership.
+%0A *
  The ASF
@@ -288,16 +288,16 @@
  2.0
+%0A *
  (the
-%0A *
  %22Li
@@ -356,16 +356,19 @@
 nce with
+%0A *
  the Lic
@@ -372,16 +372,17 @@
 License.
+ 
  You may
@@ -390,19 +390,16 @@
 obtain a
-%0A *
  copy of
@@ -413,16 +413,27 @@
 cense at
+%0A *%0A *     
  http://
@@ -467,16 +467,22 @@
 ENSE-2.0
+%0A *%0A *
  Unless 
@@ -503,19 +503,16 @@
 plicable
-%0A *
  law or 
@@ -541,16 +541,19 @@
 software
+%0A *
  distrib
@@ -607,18 +607,18 @@
  IS%22
-%0A *
  BASIS,
+%0A *
  WIT
@@ -686,16 +686,19 @@
 implied.
+%0A *
  See the
@@ -705,19 +705,16 @@
  License
-%0A *
  for the
@@ -757,16 +757,19 @@
 ions and
+%0A *
  limitat

Fix the ASL licence for NonceDemoPage