From manico.james@gmail.com on January 15, 2010 18:49:40

While doing an assessment for a client we came across an issue where the
null check was not work for their code. They had a null check based on
SafeRequest.getParameter(String). If the value was not null they did one
thing if it was they did another thing, which based on SafeRequest this
means it always will do the first thing. In their specific case they had
centralized menu code and sometimes different parameters are submitted, but
those parameters not submitted will never be null. SafeRequest and
SecurityRequestWrapper both default to setting any getParameter (including
a parameter that is not submitted) that returns null to the empty string.
This will break any applications that rely on null checks. This should be
a high priority fix as the getParameter should default to allowing null.

Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=90