[JIRA] Commented: (JOST-184) It would be nice if ESAPI.encodeForURL could be made to work

[coding@idp.protectnetwork.org (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/JOST-184?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14319#comment-14319 ] 

coding at idp.protectnetwork.org commented on JOST-184:
----------------------------------------------------

Actually, I just ran into this. We use ESAPI for our application (separate usage from OpenSAML). I have tracked down a bug (same null is affecting us).

Turns out that doing this:


    /**
     * Initializes the OWASPI ESAPI library.
     */
    protected static void initializeESAPI() {
        ESAPI.initialize("org.opensaml.ESAPISecurityConfig");
    }


Is really a no-no for libraries. The reason for this is because OpenSAML as a library assumes that no one else is using ESAPI. This code should almost certainly be removed as it re-sets ESAPI's static instances to use the OpenSAML configuration.

We're reverting back to 2.4.x until OpenSAML 2 removes this method or finds another way to leverage ESAPI.

> It would be nice if ESAPI.encodeForURL could be made to work
> ------------------------------------------------------------
>
>                 Key: JOST-184
>                 URL: https://issues.shibboleth.net/jira/browse/JOST-184
>             Project: OpenSAML 2 - Java
>          Issue Type: Improvement
>          Components: Security
>    Affects Versions: 2.5.3
>            Reporter: Rod Widdowson
>            Assignee: Chad La Joie
>            Priority: Trivial
>
> I have just "borrowed" esapi from OpenSAML to do nearly all the escaping for the DS jsp page.  I appreciate that this very much stretches the bounds of what it was initially intended for and is a bit of 'creature feep'...
> I couldn't use encodeForURL because it throws a nested exception.  The root cause is that ESAPI.securityConfiguration().getCharacterEncoding() (line 400 of org.owasp.esapi.reference.DefaultEncoder) returns null.  This in turn throws an exception in the error handling but we needn't worry about that.
> I took a _very_ brief look at the esapi security configuration and it looked to be hard wired (which feels like what it should be).  So, might it be possible to add "utf-8" as a CharacterEncoding (assuming that it makes sense for the entire stack).

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira