CODEWITHSUNDEEP
javaescapingtapestry
Scott
Scott

Reputation: 131

Tapestry 5.3.8 form fields containing backslash characters are corrupted

Text fields in a form in Tapestry 5.3.8 that a user enters a string into containing backslash characters seem to get corrupted on the server side after the form POST.

say I have a field in a form for a city name:

<t:textfield t:id="inputCity" t:label="message:city" value="agency.city" t:validate="required" size="40" maxlength="50" />

if I enter this in that field

test\fred

and inspect the agency.city value in the debugger at the top of the onSuccess() method. The value will be 

test?red

where ? is the form feed character. It doesn't make any difference how many \'s I add. They are all removed except the last one and it is interpreted not taken literally.

Looking in the browser debugger it appears that the data is POSTed to the server side intact. So if I enter 

test\\fred

the POST contains:

inputCity=test%5C%5Cfred

How you make tapestry NOT mess with the character data in a textfield?

Upvotes: 0

Views: 111

Answers (1)

Scott
Scott

Reputation: 131

It turns out we use ESAPI to handle some cross-site scripting issues. ESAPI's encoder uses JavascriptCodec by default, and JavascriptCodec removes all backslashes. Here is the reported issue.

https://code.google.com/p/owasp-esapi-java/issues/detail?id=252

So, not a problem with Tapestry. :)

Upvotes: 1

Related Questions