[WW-5056] Standard Accepted Patterns in DefaultAcceptedPatternsChecker

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 6.0.0
• Component/s: Core Interceptors
• Assignee: Unassigned
• Reporter: Andrea Vettori
• Created: 29/Jan/20 13:45
• Updated: 14/Jun/22 09:47
• Resolved: 10/Jan/21 10:53

Description

Currently the regex used to match allowed parameters is

 

   public static final String[] ACCEPTED_PATTERNS = {
           "\\w+((\\.\\w+)|(\\[\\d+\\])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'\\])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*"
   };

 

 

For parameters that are mapped to a map, this restricts the keys to letters, numbers and underscore.

It would be nice to allow all characters that are allowed in POST data and URLs, for example a parameter like map['key-subkey'] is currently not allowed, but it should cause no harm.

 

Issue Links

• links to: GitHub Pull Request #466