You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Radu Cotescu (Jira)" <ji...@apache.org> on 2019/11/14 15:04:00 UTC
[jira] [Created] (SLING-8845) URL query parameter values are
double-escaped for cases where namespace mangling has to be performed
Radu Cotescu created SLING-8845:
-----------------------------------
Summary: URL query parameter values are double-escaped for cases where namespace mangling has to be performed
Key: SLING-8845
URL: https://issues.apache.org/jira/browse/SLING-8845
Project: Sling
Issue Type: Bug
Components: XSS Protection API
Affects Versions: XSS Protection API 2.0.8
Reporter: Radu Cotescu
Fix For: XSS Protection API 2.1.12
URL query parameter values are double-escaped for cases where namespace mangling has to be performed:
{code:java}
xssAPI.getValidHref("/path/to/page?key=%25text"); // -> /path/to/page?key=%25text (which is correct)
xssAPI.getValidHref("/path/to/page/jcr:content/par?key=%25text"); // -> /path/to/page/_jcr_content/par?key=%2525text (which is wrong)
{code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)