ofbiz-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jacopo Cappellato (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (OFBIZ-5910) WidgetWorker.buildHyperlinkUrl generates invalid url when using certain sequences of characters
Date Thu, 12 Feb 2015 18:14:11 GMT

    [ https://issues.apache.org/jira/browse/OFBIZ-5910?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14318677#comment-14318677
] 

Jacopo Cappellato commented on OFBIZ-5910:
------------------------------------------

Ok, I am giving up for today but I would like to summarize the following:
1) the changes in this method, that are causing the issue reported here, have been committed
from OFBIZ-3382; they were happening (since October 2014) before the recent upgrade/refactoring
of ESAPI
2) the bug reported there is still not completely clear to me and I suspect that the fix was
not the right solution to it; I would like to spend more time on that
3) in the meantime we could apply the fix proposed by [~gareth.carter] in this ticket.

> WidgetWorker.buildHyperlinkUrl generates invalid url when using certain sequences of
characters
> -----------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-5910
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-5910
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework
>    Affects Versions: Trunk
>            Reporter: Gareth Carter
>            Assignee: Jacques Le Roux
>         Attachments: WidgetWorker.patch
>
>
> If you define a url with parameters or contains url encoded parameters, the output from
WidgetWorker.buildHyperlinkUrl may be invalid. This is because of using StringUtil.defaultWebEncoder.canonicalize(localRequestName).
> eg
> abc=&amp;or1=123    ->   abc=?1=123
> abc=&amp;to1=123    ->   abc=&to1=123 (this one is fine)
> abc=&amp;and1=123    ->    abc=?1=123
> abc=&amp;gtabc=123   ->    abc=>abc=123
> The owasp HTMLEntityCodec seems to look for special sequences (or, and, gt, lt etc) and
change them. This to me is invalid because url encoding and html encoding are different
> Why are the urls encoding the ampersands anyway? (String localRequestName = UtilHttp.encodeAmpersands(target);).




--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message