[ https://issues.apache.org/jira/browse/SLING-5869?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Radu Cotescu resolved SLING-5869. --------------------------------- Resolution: Not A Bug After a chat with [~npeltier], I've found out that the issue was more or less similar to something like: {code:html} <div data-sly-use.l="logic.js"> <a href="/search.html?q=${l.interest}">Click</a> </div> {code} {code:javascript} use(function () { 'use strict'; return { interest: '0% APR' }; }); {code} In this context percent encoding should be performed by the developer and not by Sightly / the XSS bundle, because the latter cannot make a difference between {{nhttp://www.example.org/search.html?q=0%25%20APR}} and {{http://www.example.org/search.html?q=0% APR}}. > htl doesn't escape '%' character in uri context > ----------------------------------------------- > > Key: SLING-5869 > URL: https://issues.apache.org/jira/browse/SLING-5869 > Project: Sling > Issue Type: Bug > Components: Scripting > Affects Versions: Scripting Sightly Engine 1.0.2 > Reporter: Nicolas Peltier > Assignee: Radu Cotescu > > % char in an href will not be escaped by sightly. This will cause an issue in > case a space is immediately after it, e.g. > "?message=5% fat only" will be escaped like "5%%20fat%20only", and %%20 will > crash some servers' request processing, at least it crashes sling's with > something like: > {noformat} > org.apache.sling.engine.impl.parameters.ParameterSupport > getRequestParameterMapInternal: Error parsing request > java.lang.IllegalArgumentException: Bad escape sequence: %=l > at > org.apache.sling.engine.impl.parameters.Util.parseNVPairString(Util.java:330) > at > org.apache.sling.engine.impl.parameters.Util.parseQueryString(Util.java:215) > at > org.apache.sling.engine.impl.parameters.ParameterSupport.getRequestParameterMapInternal(ParameterSupport.java:247) > at > org.apache.sling.engine.impl.parameters.ParameterSupport.getParameter(ParameterSupport.java: > {noformat} -- This message was sent by Atlassian JIRA (v6.3.4#6332)