It's unclear here what the exact problem is. What method are you using? Validation?

The likely culprit here is canonicalization, and in 99% of cases where I've seen this problem come up, it's a legitmate problem. Meaning, ESAPI is doing the right thing.

There's plenty of other missing context on this problem, is the input a URL? An email address?

Recommend writing a small web app demonstrating the exact problem with the exact input, with the exact method call. Otherwise, @kwwall , I recommend closing this issue.

Is what the creator of this issue saying is that the regex for Validator.URL in validation.properties contains '&' rather than '&'? Note that it is within [] and thus a character class. Here's what we have for it:

Validator.URL=^(ht|f)tp(s?)\\:\\/\\/[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z])*(:(0-9)*)*(\\/?)([a-zA-Z0-9\\-\\.\\?\\,\\:\\'\\/\\\\\\+=&%\\$#_]*)?$

Is Anton simply stating that instead, it should be:

Validator.URL=^(ht|f)tp(s?)\\:\\/\\/[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z])*(:(0-9)*)*(\\/?)([a-zA-Z0-9\\-\\.\\?\\,\\:\\'\\/\\\\\\+=&%\\$#_]*)?$

(or maybe '&', but I don't think '&' is special within [...]? If so, it would be an easy fix, but note that changing '&' to just '&' would remove ';' so that could be an unintended side-effect so we may need to re-add ';' separately.

Thoughts?

I'll throw this in unit-test later today. Your interpretation makes sense, but does ESAPI assume that these regexes are HTML-entity encoded? (I don't think so, but I'm suspicious now)

I don't believe so either. I think the regex is likely wrong and should
just be '&'. But not sure off top of my head whether ; will need to be
included. As you say, it needs to start with better unit tests.

-kevin
Sent from my Droid; please excuse typos.
On Jan 17, 2016 10:52 AM, "Matt Seil" notifications@github.com wrote:

I'll throw this in unit-test later today. Your interpretation makes sense,
but does ESAPI assume that these regexes are HTML-entity encoded? (I don't
think so, but I'm suspicious now)

—
Reply to this email directly or view it on GitHub
#327 (comment)
.

Well... I changed &amp to & and it works fine... of course, the reason it works is because &amp already contains the ampersand as well as superfluous amp chars already covered.