Sean Flanigan created DELTASPIKE-1074:
-----------------------------------------
Summary: Potential problem in setUrlParam() (windowhandler.js)
Key: DELTASPIKE-1074
URL: https://issues.apache.org/jira/browse/DELTASPIKE-1074
Project: DeltaSpike
Issue Type: Bug
Components: JSF-Module
Affects Versions: 1.5.3
Reporter: Sean Flanigan
I noticed a potential problem with the URI manipulation while reviewing
https://github.com/apache/deltaspike/commit/323c7d38e9d949385eb9d90c47e8971548ab5ed4
:
> {{a.href = uri.replace('?&', '?').replace('&&', '&');}}
I think it's only safe to coalesce multiple '&'s in the query part (after '?),
not in the path path (before '?'). In the path part, '&'s are just characters,
not parameter delimiters.
Also, it's possible that the URI could be like this:
{{?&&&dswid=1234&&&}}
with more than two ampersands in a row, perhaps at the beginning of the query
string.
(Attn: [~tandraschko])
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
