[
https://issues.apache.org/jira/browse/OFBIZ-5343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13790856#comment-13790856 ]
Jacques Le Roux commented on OFBIZ-5343:
----------------------------------------
Adrian,
This is certainly possible. But from what I have seen this morning, David had to remove some codecs (at least one IIRW) because he got issues with it/them. So at the moment we slightly differ from the default in esapi which have the javascript coded we do'nt use. So if you mean to simply have a property list with codecs, I don't think it would work as is. We would need to get deeper in code...
Here an extract (from
https://code.google.com/p/owasp-esapi-java/source/browse/tags/releases/1.4.0/source/src/org/owasp/esapi/reference/DefaultEncoder.java) which will tell you more than my explanation (show me the code way ;) )
{code}
/**
* Instantiates a new DefaultEncoder
*
*/
public DefaultEncoder() {
// initialize the codec list to use for canonicalization
codecs.add( htmlCodec );
codecs.add( percentCodec );
codecs.add( javaScriptCodec );
// leave this out because it eats / characters
// codecs.add( cssCodec );
// leave this out because it eats " characters
// codecs.add( vbScriptCodec );
}
{code}
As you can see, even them had to comment out their own codecs by default...
Ha, found David's change:
http://svn.apache.org/viewvc?view=revision&revision=746292> Update owasp-esapi-java
> -----------------------
>
> Key: OFBIZ-5343
> URL:
https://issues.apache.org/jira/browse/OFBIZ-5343> Project: OFBiz
> Issue Type: Task
> Components: framework
> Affects Versions: SVN trunk
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Minor
> Labels: esapi
> Fix For: SVN trunk
>
> Attachments: commons-configuration-1.9.jar, esapi-2.1.0.jar, logkit-1.0.1.jar, OFBIZ-5343-Update owasp-esapi-java.patch
>
>
> As reported by Christoph Neuroth at OFBIZ-5254, we still use a patched version from OFBIZ-3135 and it's time to update to last version
--
This message was sent by Atlassian JIRA
(v6.1#6144)
Locked
