[jira] [Commented] (OFBIZ-12249) Unexpected decoding of url encoded textarea data after submission

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-12249?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17359183#comment-17359183 ]

Jacques Le Roux commented on OFBIZ-12249:
-----------------------------------------

Hi Wang,

It was much fun to work on that :)

 [^OFBIZ-12249.patch] is my best answer:

 !Image 006.png!



I'm not sure my solution is complete. On the other hand, as I said:
bq. Ah, forgot to say that using html="safe" for is not a solution in case of textarea. I tried with internalNote in createWorkEffortNote and updateWorkEffortNote services.
So to answer to your point:
bq. If we do output encoding completely, any text can be accepted, so my point is that we should accept any text user submitted for free-form text input widgets, and encode that properly before html rendering.
this is what UtilCodec::checkStringForHtmlSafe does. It's obviously incomplete to treat special chars in URLs. I guess I could rather add the change in  [^OFBIZ-12249.patch] in UtilCodec::checkStringForHtmlSafe. But I prefer to have them even when no safety is required. You might want to have a look at owasp.properties and create your own policy...

For now, if it's OK with you, I suggest that we push these changes in the meantime.

> Unexpected decoding of url encoded textarea data after submission
> ------------------------------------------------------------------
>
>                 Key: OFBIZ-12249
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-12249
>             Project: OFBiz
>          Issue Type: Bug
>    Affects Versions: Trunk
>            Reporter: Xin Wang
>            Assignee: Jacques Le Roux
>            Priority: Major
>         Attachments: Image 005.png, Image 006.png, OFBIZ-12249.patch, OFBIZ-12249.patch
>
>
> When trying to add a note to WorkEffort entity, I found that url encoded characters are unescaped, which is not expected.
> e.g.:
> 1. Go to page: https://demo-trunk.ofbiz.apache.org/workeffort/control/EditWorkEffortNotes?workEffortId=TASK01
> 2. Add a note with content: https://example.com/a%20link
> 3. After submission, it will turned to be: https://example.com/a link
>  
>  

--
This message was sent by Atlassian Jira
(v8.3.4#803005)