From schulger...@widmann.de on May 25, 2011 05:43:27

There's a bug in DefaultEncoder.canonicalize(String input).

It's supposed to use the settings
Encoder.AllowMultipleEncoding and
Encoder.AllowMixedEncoding
but it's effectively using
!Encoder.AllowMultipleEncoding and
!Encoder.AllowMixedEncoding

See lines 116-123:

public String canonicalize( String input ) {
if ( input == null ) {
return null;
}
return canonicalize(input,
ESAPI.securityConfiguration().getAllowMultipleEncoding(),
ESAPI.securityConfiguration().getAllowMixedEncoding() );
}

It should be

public String canonicalize( String input ) {
if ( input == null ) {
return null;
}
return canonicalize(input,
!ESAPI.securityConfiguration().getAllowMultipleEncoding(),
!ESAPI.securityConfiguration().getAllowMixedEncoding() );
}

because

canonicalize(String, boolean, boolean)

is defined as

canonicalize(String input, boolean restrictMultiple, boolean restrictMixed)

and not as

canonicalize(String input, boolean allowMultiple, boolean allowMixed)

Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=226