[SLING-7814] URLs with JCR namespaces can get double encoded by XSSAPI.getValidHref

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: XSS Protection API 2.0.8
• Fix Version/s: XSS Protection API 2.0.14
• Component/s: Extensions
• Assignee: Radu Cotescu
• Reporter: Radu Cotescu
• Created: 08/Aug/18 09:29
• Updated: 24/Jan/19 13:29
• Resolved: 08/Aug/18 09:35

Description

The following URLs, when passed to org.apache.sling.xss.XSSAPI#getValidHref, get double encoded:

1. /content/page with spaces/jcr:content
2. /content/page%20with%20spaces/jcr:content

The bug seems to be in the org.apache.sling.xss.impl.XSSAPIImpl#mangleNamespaces method.

 

Issue Links

• is caused by: SLING-7741 org.apache.sling.xss.impl.XSSAPIImpl#getValidHref doesn't correctly handle the ":" character in URL fragments