cziegeler opened a new pull request, #80:
URL: https://github.com/apache/sling-org-apache-sling-api/pull/80
Relates-to: SLING-13162
## Source issue
- Reference: SLING-13162
- Title: [Code Quality] High: The regex constant PATH_PARAMETERS_REGEX
contains a typo
## Implementation context
h2. Maia Finding
- Report: Code Quality
- Severity: High
- Location:
`[src/main/java/org/apache/sling/api/uri/SlingUriBuilder.java:85`|https://github.com/apache/sling-org-apache-sling-api/blob/master/src/main/java/org/apache/sling/api/uri/SlingUriBuilder.java#L85]
- Report generated: 2026-04-04T13:16:04.601Z
- Model: claude-sonnet-4.6
h2. Description
The regex constant PATH_PARAMETERS_REGEX contains a typo: '[a-zA-z0-9]' uses
a lowercase 'z' instead of uppercase 'Z'. The range 'A-z' in a character class
spans ASCII 65–122, inadvertently matching six non-alphanumeric characters ([ \
] ^ _ `) between 'Z' (90) and 'a' (97). This means path parameter keys
containing those characters are silently accepted, potentially leading to
unexpected parsing behaviour.
h2. Recommendation
Change 'A-z' to 'A-Z' in PATH_PARAMETERS_REGEX:
";([a-zA-Z0-9]{+})=(?:\'([^']*)\'|([^/]{+}))". Add a unit test that asserts
keys with characters such as '[' or '\' are rejected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
