[
https://issues.apache.org/jira/browse/MYFACES-3731?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13668206#comment-13668206
]
dennis hoersch commented on MYFACES-3731:
-----------------------------------------
After adding a lowercase check in the following methods the '%2b' is not
re-escaped.
- encodeURIAtributte(final String string, final String characterEncoding)
- encodeURIAtributte(Writer writer, final String string, final String
characterEncoding)
- encodeURIQuery(final String string, final String characterEncoding)
- encodeURIQuery(Writer writer, final String string, int offset, final String
characterEncoding)
if ((( c1 >= '0' && c1 <='9') || (c1 >='A' && c1 <='Z') || (c1 >='a' && c1
<='z')) &&
(( c2 >= '0' && c2 <='9') || (c2 >='A' && c2 <='Z') || (c2 >='a' && c2
<='z')))
{
// do not percent encode, because it could be already encoded
// and we don't want encode it twice
}
> HTMLEncoder.encodeURIAtributte re-escapes already percent-encoded string
> ------------------------------------------------------------------------
>
> Key: MYFACES-3731
> URL: https://issues.apache.org/jira/browse/MYFACES-3731
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.11
> Reporter: dennis hoersch
>
> In HTMLEncoder.encodeURIAtributte is a check to not re-escape already
> percent-encoded parts. But that code assumes the percent-encoded symbols to
> be uppercase letters.
> So in the following link the '%2b' is escaped to '%252b':
> Original:
> "http://host/app/?ae=Item&a=Open&t=IPM.Note&id=RgAAAAB4E8INIm43RZNuTeFByn9IBwCfBp1RvH2jT7X5YNYS8KZjAAAApBU%2bAABNyiydsdzWRbj76MCJ9qhxAAAAmaj0AAAJ&exvsurl=1";;
> Encoded:
> "http://host/app/?ae=Item&a=Open&t=IPM.Note&id=RgAAAAB4E8INIm43RZNuTeFByn9IBwCfBp1RvH2jT7X5YNYS8KZjAAAApBU%252bAABNyiydsdzWRbj76MCJ9qhxAAAAmaj0AAAJ&exvsurl=1
> (http://tools.ietf.org/html/rfc3986#page-12 says uppercase and lowercase
> letters have to be considered as equal.)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
