Explain how Wicket's PackageResourceGuard works and why CVE-2026-43646 mattered?

PackageResourceGuard is the gatekeeper Wicket uses to decide which files packaged alongside application classes (images, CSS, JS shipped in the same package as a Page or Panel) are actually allowed to be served as web-accessible resources, versus files that should stay inaccessible even though they technically live in an accessible package.

By default it works off an allow-list of file extensions considered safe to serve (like .css, .js, .png) and blocks anything else, which is meant to stop an attacker from crafting a resource URL that reaches, say, a .java source file, a .properties file with configuration secrets, or a .class file sitting in the same package directory as legitimate static assets.

CVE-2026-43646 mattered because it was a way to craft a URL that bypassed this extension-based check entirely — meaning the guard's core protection (blocking access to non-allow-listed files) could be circumvented under specific conditions, undermining the whole point of having the guard in the first place. The fix, shipped simultaneously across the 8.18.0, 9.23.0, and 10.9.0/10.10.0 releases, closed that specific bypass path so the extension check reliably applies to every crafted URL variant, not just the straightforward ones.