From coa...@gmail.com on November 12, 2010 17:21:58

The attached TestNG unit test will expose the bug within the union() method of the src\main\java\org\owasp\esapi\EncoderConstants.java source, and demonstrate the expected output.

Note: We appear to be using version 1.4, as this method has now been moved to the StringUtilities.java class. The logic is the same, though.

This issue isn't specific to an operating system or browser.

Here is a solution that fixes the problem –

 public static char[] union(char[]... list) {

   StringBuilder sb = new StringBuilder();



   for (char[] characters : list) {

           for (int i = 0; i < characters.length; i++) {

               if (!contains(sb, characters[i])) {

                   sb.append(characters[i]);

               }

           }

   }



     char[] toReturn = new char[sb.length()];

     sb.getChars(0, sb.length(), toReturn, 0);

     Arrays.sort(toReturn);

     return toReturn;

 }

Attachment: EncoderConstantsTest.java

Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=184