You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ofbiz.apache.org by "Gareth Carter (JIRA)" <ji...@apache.org> on 2015/01/09 10:09:34 UTC
[jira] [Comment Edited] (OFBIZ-5910) WidgetWorker.buildHyperlinkUrl
generates invalid url when using certain sequences of characters
[ https://issues.apache.org/jira/browse/OFBIZ-5910?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14262219#comment-14262219 ]
Gareth Carter edited comment on OFBIZ-5910 at 1/9/15 9:08 AM:
--------------------------------------------------------------
More info:
This only affects the target method param in buildHyperlinkUrl if target contains url params or javascript code with url params
eg
/someapp/control/someurl?abc=123&orderId=987
javascript:someFunction('abc=123&orderId=987')
The UtilCodec.canonicalize method must decode & to & and then detect &or, &, < or > and convert to values which would incorrect for urls
My suggesstion would be to ditch UtilCodec.canonicalize and use StringEscapeUtils.unescapeHtml
was (Author: gareth.carter):
More info:
This only affects the target method param in buildHyperlinkUrl if target contains url params or javascript code with url params
eg
/someapp/control/someurl?abc=123&orderId=987
javascript:someFunction('abc=123&orderId=987')
The UtilCodec.canonicalize method must decode & to & and then detect &or, &, < or > and convert to values which would incorrect for urls
My suggesstion would be to ditch UtilCodec.canonicalize and use StringEscapeUtils.unescapeHtml
> WidgetWorker.buildHyperlinkUrl generates invalid url when using certain sequences of characters
> -----------------------------------------------------------------------------------------------
>
> Key: OFBIZ-5910
> URL: https://issues.apache.org/jira/browse/OFBIZ-5910
> Project: OFBiz
> Issue Type: Bug
> Components: framework
> Affects Versions: Trunk
> Reporter: Gareth Carter
> Attachments: WidgetWorker.patch
>
>
> If you define a url with parameters or contains url encoded parameters, the output from WidgetWorker.buildHyperlinkUrl may be invalid. This is because of using StringUtil.defaultWebEncoder.canonicalize(localRequestName).
> eg
> abc=&or1=123 -> abc=?1=123
> abc=&to1=123 -> abc=&to1=123 (this one is fine)
> abc=&and1=123 -> abc=?1=123
> abc=&gtabc=123 -> abc=>abc=123
> The owasp HTMLEntityCodec seems to look for special sequences (or, and, gt, lt etc) and change them. This to me is invalid because url encoding and html encoding are different
> Why are the urls encoding the ampersands anyway? (String localRequestName = UtilHttp.encodeAmpersands(target);).
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)