[OFBIZ-3135] In owasp-esapi-java, htmlCodec.decode is broken for all entities where entity.substr(0, x) exists

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Trunk
• Fix Version/s: Release Branch 09.04, Trunk
• Component/s: framework
• Assignee: Jacques Le Roux
• Reporter: Patrick Antivackis
• Created: 31/Oct/09 20:14
• Updated: 09/Oct/13 07:03
• Resolved: 27/Nov/09 08:32

Description

It's because HTMLEntityCodec.getNamedEntity stop at the first entity found
so it will never return &sup2 or &sup3 because &sup exists, neither &piv
because &pi exists and all other entities where a shorter entity exists.

See bug reports :
http://code.google.com/p/owasp-esapi-java/issues/detail?id=45

Attach is a recompile patched version of the library based on
owasp-esapi-java-src-1.4.zip
and a diff of src/org/owasp/esapi/codecs/HTMLEntityCodec.java

Issue Links

• relates to: OFBIZ-5343 Update owasp-esapi-java