[SLING-7741] org.apache.sling.xss.impl.XSSAPIImpl#getValidHref doesn't correctly handle the ":" character in URL fragments

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: XSS Protection API 1.0.0, XSS Protection API 2.0.0, XSS Protection API Compat 1.1.0
• Fix Version/s: XSS Protection API 2.0.8
• Component/s: XSS Protection API
• Assignee: Radu Cotescu
• Reporter: Radu Cotescu
• Created: 15/Jun/18 14:16
• Updated: 08/Aug/18 09:30
• Resolved: 29/Jun/18 15:48

Description

org.apache.sling.xss.impl.XSSAPIImpl#getValidHref doesn't correctly handle the ":" character in URL fragments:

https://sling.apache.org/#fragment:test -> https://sling.apache.org/_#fragment_test

Namespace mangling should only occur for the path section of the URL.

Issue Links

• causes: SLING-7770 URLs ending in "/" get filtered by AntiSamy
• causes: SLING-7814 URLs with JCR namespaces can get double encoded by XSSAPI.getValidHref
• links to: GitHub Pull Request #2
• links to: GitHub Pull Request #3