You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Radu Cotescu (JIRA)" <ji...@apache.org> on 2018/06/26 16:07:00 UTC
[jira] [Updated] (SLING-7741)
org.apache.sling.xss.impl.XSSAPIImpl#getValidHref doesn't correctly handle
the ":" character in URL fragments
[ https://issues.apache.org/jira/browse/SLING-7741?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Radu Cotescu updated SLING-7741:
--------------------------------
Attachment: SLING-7741.correct_uri_parsing.patch
> org.apache.sling.xss.impl.XSSAPIImpl#getValidHref doesn't correctly handle the ":" character in URL fragments
> -------------------------------------------------------------------------------------------------------------
>
> Key: SLING-7741
> URL: https://issues.apache.org/jira/browse/SLING-7741
> Project: Sling
> Issue Type: Bug
> Components: XSS Protection API
> Affects Versions: XSS Protection API 1.0.0, XSS Protection API 2.0.0, XSS Protection API Compat 1.1.0
> Reporter: Radu Cotescu
> Assignee: Radu Cotescu
> Priority: Major
> Fix For: XSS Protection API 2.0.8
>
> Attachments: SLING-7741.correct_uri_parsing.patch
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> {{org.apache.sling.xss.impl.XSSAPIImpl#getValidHref}} doesn't correctly handle the ":" character in URL fragments:
> {code}
> https://sling.apache.org/#fragment:test -> https://sling.apache.org/_#fragment_test
> {code}
> Namespace mangling should only occur for the path section of the URL.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)