[
https://issues.apache.org/jira/browse/DELTASPIKE-1074?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Thomas Andraschko updated DELTASPIKE-1074:
------------------------------------------
Fix Version/s: 1.6.0
> Potential problem in setUrlParam() (windowhandler.js)
> -----------------------------------------------------
>
> Key: DELTASPIKE-1074
> URL: https://issues.apache.org/jira/browse/DELTASPIKE-1074
> Project: DeltaSpike
> Issue Type: Bug
> Components: JSF-Module
> Affects Versions: 1.5.3
> Reporter: Sean Flanigan
> Assignee: Thomas Andraschko
> Fix For: 1.6.0
>
>
> I noticed a potential problem with the URI manipulation while reviewing
> https://github.com/apache/deltaspike/commit/323c7d38e9d949385eb9d90c47e8971548ab5ed4
> :
> > {{a.href = uri.replace('?&', '?').replace('&&', '&');}}
> I think it's only safe to coalesce multiple '&'s in the query part (after
> '?), not in the path path (before '?'). In the path part, '&'s are just
> characters, not parameter delimiters.
> Also, it's possible that the URI could be like this:
> {{?&&&dswid=1234&&&}}
> with more than two ampersands in a row, perhaps at the beginning of the query
> string.
> (Attn: [~tandraschko])
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
