[WW-4448] Parameters are not encoded by ServletRedirectAction before checking for valid URI

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.20
• Fix Version/s: 2.3.24
• Component/s: Core Actions
• Labels: encoding redirect url
• Assignee: Lukasz Lenart
• Reporter: Mitth'raw'nuruodo
• Created: 13/Jan/15 23:56
• Updated: 30/Nov/15 14:47
• Resolved: 21/Jan/15 07:47

Description

WW-4187 changed ServletRedirectResult to use java.net.URI to check whether a redirect URL is actually a path. However, it does not encode parameters first, which will often result in a URL being deemed invalid (eg if one of the parameters contains spaces) and thus being treated as a path.

Where I work, we actually don't want parameters to be appended to our absolute redirects at all, but I can't see a way to disable this...DefaultResultFactory doesn't seem to be configurable.

Issue Links

• is broken by: WW-4187 ServletRedirectResult only works with a limited set of hardcoded URL protocols