apache/wicket — pull request #9 by tgoetz (2012-05-15 07:16:30+00:00)
Title: WICKET-4219: Enable markup escaping of WizardStep's labels by default due to security aspects

WizardStep's Header Labels now inherit the escape settings from Header, thus escaping can now be configured by overriding getHeader in WizardStep:

@Override
public Component getHeader(String id, Component parent, IWizard wizard) {
return super.getHeader(id, parent, wizard).setEscapeModelStrings(true|false);
}

Thus the default is that the Strings will be escaped.