You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-dev@jackrabbit.apache.org by Tobias Bocanegra <tr...@apache.org> on 2014/03/26 22:36:46 UTC
Names with trailing spaces
Hi,
I just encountered, that it is possible in oak to create nodes with
trailing spaces, which is not allowed in Jackrabbit. see
https://issues.apache.org/jira/browse/OAK-1624
I'm not sure where to put this kind of tests, as the PathParserTest
actually covers those cases.
FWIW, the JCR spec allows but discourages leading and trailing spaces:
---
JCR 2.0, 3.2.4 Naming Restrictions
...
The characters declared invalid within a local name (“/”, “:”, “[“,
“]”, “|”, “*”) represent only those characters which are used as
metacharacters in JCR names, paths and name-matching patterns (see
§5.2.2 Iterating Over Child Items). These restrictions are not
necessarily sufficient to enforce best practices in the creation of
JCR names. In particular, the minimal grammar defined here permits JCR
names with leading and trailing whitespace as well as characters which
may appear superficially identical while representing different code
points, creating a potential security issue.
---
If we now allow trailing spaces we might get interopability issues
with JR2 content, and/or code that uses JR PathParser to parse or
validate JCR paths and names.
regards, toby
Re: Names with trailing spaces
Posted by Julian Reschke <ju...@gmx.de>.
On 2014-03-26 22:36, Tobias Bocanegra wrote:
> Hi,
>
> I just encountered, that it is possible in oak to create nodes with
> trailing spaces, which is not allowed in Jackrabbit. see
> https://issues.apache.org/jira/browse/OAK-1624
> I'm not sure where to put this kind of tests, as the PathParserTest
> actually covers those cases.
>
> FWIW, the JCR spec allows but discourages leading and trailing spaces:
>
> ---
> JCR 2.0, 3.2.4 Naming Restrictions
> ...
> The characters declared invalid within a local name (“/”, “:”, “[“,
> “]”, “|”, “*”) represent only those characters which are used as
> metacharacters in JCR names, paths and name-matching patterns (see
> §5.2.2 Iterating Over Child Items). These restrictions are not
> necessarily sufficient to enforce best practices in the creation of
> JCR names. In particular, the minimal grammar defined here permits JCR
> names with leading and trailing whitespace as well as characters which
> may appear superficially identical while representing different code
> points, creating a potential security issue.
> ---
>
> If we now allow trailing spaces we might get interopability issues
> with JR2 content, and/or code that uses JR PathParser to parse or
> validate JCR paths and names.
> ...
Absolutely; we should reject those (some with leading WS).
Best regards, Julian