You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "cziegeler (via GitHub)" <gi...@apache.org> on 2026/06/01 06:16:02 UTC

[PR] feat(SLING-13162): [Code Quality] High: The regex constant PATH_PARAMETERS_REGEX contains a typo [sling-org-apache-sling-api]

cziegeler opened a new pull request, #80:
URL: https://github.com/apache/sling-org-apache-sling-api/pull/80

   Relates-to: SLING-13162
   
   ## Source issue
   - Reference: SLING-13162
   - Title: [Code Quality] High: The regex constant PATH_PARAMETERS_REGEX contains a typo
   
   ## Implementation context
   h2. Maia Finding
    - Report: Code Quality
    - Severity: High
    - Location: `[src/main/java/org/apache/sling/api/uri/SlingUriBuilder.java:85`|https://github.com/apache/sling-org-apache-sling-api/blob/master/src/main/java/org/apache/sling/api/uri/SlingUriBuilder.java#L85]
    - Report generated: 2026-04-04T13:16:04.601Z
    - Model: claude-sonnet-4.6
   
   h2. Description
   
   The regex constant PATH_PARAMETERS_REGEX contains a typo: '[a-zA-z0-9]' uses a lowercase 'z' instead of uppercase 'Z'. The range 'A-z' in a character class spans ASCII 65–122, inadvertently matching six non-alphanumeric characters ([ \ ] ^ _ `) between 'Z' (90) and 'a' (97). This means path parameter keys containing those characters are silently accepted, potentially leading to unexpected parsing behaviour.
   h2. Recommendation
   
   Change 'A-z' to 'A-Z' in PATH_PARAMETERS_REGEX: ";([a-zA-Z0-9]{+})=(?:\'([^']*)\'|([^/]{+}))". Add a unit test that asserts keys with characters such as '[' or '\' are rejected.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(SLING-13162): [Code Quality] High: The regex constant PATH_PARAMETERS_REGEX contains a typo [sling-org-apache-sling-api]

Posted by "cziegeler (via GitHub)" <gi...@apache.org>.
cziegeler merged PR #80:
URL: https://github.com/apache/sling-org-apache-sling-api/pull/80


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(SLING-13162): [Code Quality] High: The regex constant PATH_PARAMETERS_REGEX contains a typo [sling-org-apache-sling-api]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #80:
URL: https://github.com/apache/sling-org-apache-sling-api/pull/80#issuecomment-4590347434

   ## [![Quality Gate Failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-failed-20px.png 'Quality Gate Failed')](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-api&pullRequest=80) **Quality Gate failed**  
   Failed conditions  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/failed-16px.png '') [1 Security Hotspot](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-api&pullRequest=80&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
     
   <!-- sqra:qg_revision=199702fe34ec03ae1078a18ddb74899c90e98409e7eac67f5251a2a9886276ca -->
   <!-- sqra-placement-anchor -->
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-api&pullRequest=80)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(SLING-13162): [Code Quality] High: The regex constant PATH_PARAMETERS_REGEX contains a typo [sling-org-apache-sling-api]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #80:
URL: https://github.com/apache/sling-org-apache-sling-api/pull/80#issuecomment-4590050467

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-api&pullRequest=80) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-api&pullRequest=80&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-api&pullRequest=80&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-api&pullRequest=80&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-api&pullRequest=80&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-api&pullRequest=80&metric=new_duplicated_lines_density&view=list)  
     
   <!-- sqra-placement-anchor -->
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-api&pullRequest=80)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org