[jira] [Resolved] (SLING-5869) htl doesn't escape '%' character in uri context

["Radu Cotescu (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SLING-5869?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Radu Cotescu resolved SLING-5869.
---------------------------------
    Resolution: Not A Bug

After a chat with [~npeltier], I've found out that the issue was more or less similar to something like:
{code:html}
<div data-sly-use.l="logic.js">
    <a href="/search.html?q=${l.interest}">Click</a>
</div>
{code}
{code:javascript}
use(function () {
   'use strict';
    return {
        interest: '0% APR'
    };
});
{code}

In this context percent encoding should be performed by the developer and not by Sightly / the XSS bundle, because the latter cannot make a difference between {{nhttp://www.example.org/search.html?q=0%25%20APR}} and {{http://www.example.org/search.html?q=0% APR}}.

> htl doesn't escape '%' character in uri context
> -----------------------------------------------
>
>                 Key: SLING-5869
>                 URL: https://issues.apache.org/jira/browse/SLING-5869
>             Project: Sling
>          Issue Type: Bug
>          Components: Scripting
>    Affects Versions: Scripting Sightly Engine 1.0.2
>            Reporter: Nicolas Peltier
>            Assignee: Radu Cotescu
>
> % char in an href will not be escaped by sightly. This will cause an issue in case a space is immediately after it, e.g.
> "?message=5% fat only" will be escaped like "5%%20fat%20only", and %%20 will crash some servers' request processing, at least it crashes sling's with something like:
> {noformat}
> org.apache.sling.engine.impl.parameters.ParameterSupport getRequestParameterMapInternal: Error parsing request
> java.lang.IllegalArgumentException: Bad escape sequence: %=l
> at org.apache.sling.engine.impl.parameters.Util.parseNVPairString(Util.java:330)
> at org.apache.sling.engine.impl.parameters.Util.parseQueryString(Util.java:215)
> at org.apache.sling.engine.impl.parameters.ParameterSupport.getRequestParameterMapInternal(ParameterSupport.java:247)
> at org.apache.sling.engine.impl.parameters.ParameterSupport.getParameter(ParameterSupport.java:
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)