Skip to content

Commit 9692d31

Browse files
authored
Merge pull request ESAPI#378 from sunnypav/develop
ESAPI#302 HTMLEntityCodec Now decodes cased accented letters properly
2 parents 4a95ab3 + b496305 commit 9692d31

File tree

1 file changed

+12
-3
lines changed

1 file changed

+12
-3
lines changed

src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -250,12 +250,21 @@ private Character getNamedEntity( PushbackString input ) {
250250
// kludge around PushbackString....
251251
len = Math.min(input.remainder().length(), entityToCharacterTrie.getMaxKeyLength());
252252
for(int i=0;i<len;i++)
253-
possible.append(Character.toLowerCase(input.next()));
253+
possible.append(input.next());
254254

255255
// look up the longest match
256256
entry = entityToCharacterTrie.getLongestMatch(possible);
257-
if(entry == null)
258-
return null; // no match, caller will reset input
257+
if(entry == null) {
258+
// We are lowercasing & comparing the result because of this all the upper case named entities are getting converted lowercase named entities.
259+
// check is there any exact match https://github.com/ESAPI/esapi-java-legacy/issues/302
260+
String possibleString = possible.toString();
261+
String possibleStringLowerCase = possibleString.toLowerCase();
262+
if(!possibleString.equals(possibleStringLowerCase)) {
263+
Map.Entry<CharSequence,Character> exactEntry = entityToCharacterTrie.getLongestMatch(possibleStringLowerCase);
264+
if(exactEntry != null) entry = exactEntry;
265+
}
266+
if(entry == null) return null; // no match, caller will reset input
267+
}
259268

260269
// fixup input
261270
input.reset();

0 commit comments

Comments
 (0)