Re: [org.apache.sling.xss] namespace mangling

2019-11-25 Thread Julian Sedding
IIRC there was at least one other reason for namespace mangling: to support a filesystem based caching proxy where URLs are mapped to FS paths. AFAIK windows doesn't allow the colon character in file or folder names. Whether that's an architecturally sound implementation choice is of course

Re: [org.apache.sling.xss] namespace mangling

2019-11-20 Thread Daniel Klco
Makes sense to me! I definitely agree this is unexpected behavior and given current browser support the risk is low. On Tue, Nov 19, 2019 at 12:03 PM Radu Cotescu wrote: > Hi Dan, > > > On 19 Nov 2019, at 16:18, Daniel Klco wrote: > > > > I've seen issues with this in the wild. A client was

Re: [org.apache.sling.xss] namespace mangling

2019-11-19 Thread Radu Cotescu
Hi Dan, > On 19 Nov 2019, at 16:18, Daniel Klco wrote: > > I've seen issues with this in the wild. A client was attempting to link to > external URLs containing colons (bad practice I know, but you get health > care web services to get out of the 1990's) in a HTL script which was > getting

RE: [org.apache.sling.xss] namespace mangling

2019-11-19 Thread Stefan Seifert
in my understanding the namespace mangling was only introduced in the olden days of sling to work around problems in some old browsers that did not support URLs with colons in it. i think those old browsers are no longer in use for many, many years. so i assume it is no problem to not mangle

Re: [org.apache.sling.xss] namespace mangling

2019-11-19 Thread Daniel Klco
I've seen issues with this in the wild. A client was attempting to link to external URLs containing colons (bad practice I know, but you get health care web services to get out of the 1990's) in a HTL script which was getting mangled even though the URL was not a JCR path. My concern is that if