[SLING-7516] ResourceRuntimeExtension: Selectors containing a comma are not treated correctly

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Scripting HTL Engine 1.0.48-1.3.1
• Fix Version/s: Scripting HTL Engine 1.0.54-1.4.0
• Component/s: Scripting
• Labels: patch-available
• Assignee: Radu Cotescu
• Reporter: Konrad Windszus
• Created: 26/Feb/18 17:15
• Updated: 06/Aug/21 14:59
• Resolved: 19/Mar/18 12:41

Description

Due to the way how the request dispatcher options are serialized into one big string in https://github.com/apache/sling-org-apache-sling-scripting-sightly/blob/cd7d67e66f624c66fe88dd208c4d2b8f7e85c8ec/src/main/java/org/apache/sling/scripting/sightly/impl/engine/extension/ResourceRuntimeExtension.java#L214 you cannot use e.g. selectors which contain a comma. This is a problem because currently selectors are the only way to propagate parameters from one HTL script to another script/servlet (compare with SLING-7515).

The method createDispatcherOptions generates a String from a Map where the entries are separated by , i.e. comma. If either the map key or the map value contain a comma itself the tokenization in https://github.com/apache/sling-org-apache-sling-api/blob/ec3dcf291b26e833b07a1f9c485bbe713a7ad4d5/src/main/java/org/apache/sling/api/request/RequestDispatcherOptions.java#L100 works incorrectly!

Therefore instead of using the constructor with a string (with very simple/incorrect parsing) the RequestDispatcherOptions should rather be created with an empty string and then the map should be filled with the according put/set methods.

Issue Links

• is related to: SLING-10707 Comma in selector not correctly escaped in capability header
• relates to: SLING-7515 ResourceRuntimeExtension: Allow to pass arbitrary options a request attributes via data-sly-resource
• links to: GitHub Pull Request #2