[ https://issues.apache.org/jira/browse/OFBIZ-5910?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14318677#comment-14318677 ]
Jacopo Cappellato commented on OFBIZ-5910: ------------------------------------------ Ok, I am giving up for today but I would like to summarize the following: 1) the changes in this method, that are causing the issue reported here, have been committed from OFBIZ-3382; they were happening (since October 2014) before the recent upgrade/refactoring of ESAPI 2) the bug reported there is still not completely clear to me and I suspect that the fix was not the right solution to it; I would like to spend more time on that 3) in the meantime we could apply the fix proposed by [~gareth.carter] in this ticket. > WidgetWorker.buildHyperlinkUrl generates invalid url when using certain > sequences of characters > ----------------------------------------------------------------------------------------------- > > Key: OFBIZ-5910 > URL: https://issues.apache.org/jira/browse/OFBIZ-5910 > Project: OFBiz > Issue Type: Bug > Components: framework > Affects Versions: Trunk > Reporter: Gareth Carter > Assignee: Jacques Le Roux > Attachments: WidgetWorker.patch > > > If you define a url with parameters or contains url encoded parameters, the > output from WidgetWorker.buildHyperlinkUrl may be invalid. This is because of > using StringUtil.defaultWebEncoder.canonicalize(localRequestName). > eg > abc=&or1=123 -> abc=?1=123 > abc=&to1=123 -> abc=&to1=123 (this one is fine) > abc=&and1=123 -> abc=?1=123 > abc=&gtabc=123 -> abc=>abc=123 > The owasp HTMLEntityCodec seems to look for special sequences (or, and, gt, > lt etc) and change them. This to me is invalid because url encoding and html > encoding are different > Why are the urls encoding the ampersands anyway? (String localRequestName = > UtilHttp.encodeAmpersands(target);). -- This message was sent by Atlassian JIRA (v6.3.4#6332)