Re: Is WicketFilter.checkCharacterEncoding() safe?

2010-08-16 Thread Martin Grigorov
As solution I can see using HttpServletRequestWrapper instead of dealing directly with the HttpServletRequest passed by the container. This way we can provide custom implementation of HttpServletRequestWrapper that overrides javax.servlet.ServletRequestWrapper.getCharacterEncoding() and if

Is WicketFilter.checkCharacterEncoding() safe?

2010-08-15 Thread Harald Wellmann
I'm not sure if this is severe or not, but I think there's a gap in the implicit assumptions underlying WicketFilter.checkCharacterEncoding(): It seems the author's intention was to guarantee a postcondition of servletRequest.getCharacterEncoding() != null, but this postcondition does not