From Calico...@gmail.com on January 15, 2009 11:07:19

The default ESAPI.properties has some validation patterns that only allow
one character. :

Validator.HTTPServerName=^[a-zA-Z0-9_.-]$
Validator.HTTPContextPath=^[a-zA-Z0-9.-]$
Validator.HTTPPath=^[a-zA-Z0-9.-]$
Validator.HTTPQueryString=^[a-zA-Z0-9()-=_.?;,+/:&_ ]$
Validator.HTTPURI=^[a-zA-Z0-9()-=_.?;,+/:&_ ]$

We needed to add a quantifier to each defined character class to support
more characters.

Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=11