[
https://issues.apache.org/jira/browse/SLING-7814?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Radu Cotescu closed SLING-7814.
-------------------------------
> URLs with JCR namespaces can get double encoded by XSSAPI.getValidHref
> ----------------------------------------------------------------------
>
> Key: SLING-7814
> URL: https://issues.apache.org/jira/browse/SLING-7814
> Project: Sling
> Issue Type: Bug
> Components: Extensions
> Affects Versions: XSS Protection API 2.0.8
> Reporter: Radu Cotescu
> Assignee: Radu Cotescu
> Priority: Major
> Fix For: XSS Protection API 2.0.14
>
>
> The following URLs, when passed to
> {{org.apache.sling.xss.XSSAPI#getValidHref}}, get double encoded:
> # {{/content/page with spaces/jcr:content}}
> # {{/content/page%20with%20spaces/jcr:content}}
> The bug seems to be in the
> {{org.apache.sling.xss.impl.XSSAPIImpl#mangleNamespaces}} method.
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
