DefaultEncoder.canonicalize() should respect value of Encoder.AllowMultipleEncoding property

[GoogleCodeExporter]

The Encoder.AllowMultipleEncoding property in ESAPI.properties does not seem to 
be used anywhere. In DefaultEncoder, the canonicalize() method uses 
IntrusionDetector.Disable instead: 

    public String canonicalize( String input ) {
        if ( input == null ) {
            return null;
        }
        return canonicalize( input, !ESAPI.securityConfiguration().getDisableIntrusionDetection() );
    }

This method should use the Encoder.AllowMultipleEncoding property, with the 
possible addition of another property for Encoder.AllowMixedEncoding. This 
would allow us to handle special cases where we need to allow multiple 
encoding, but not mixed encoding, without disabling intrusion detection across 
the board for all of ESAPI. 

Original issue reported on code.google.com by augu...@gmail.com on 29 Oct 2010 at 9:56

[GoogleCodeExporter]

Proposed patch attached. 

Original comment by augu...@gmail.com on 29 Oct 2010 at 10:08

Attachments:

• ESAPI-160.diff

[GoogleCodeExporter]

Original comment by manico.james@gmail.com on 29 Oct 2010 at 10:37

[GoogleCodeExporter]

Original comment by manico.james@gmail.com on 29 Oct 2010 at 10:37

• Changed state: Verified

[GoogleCodeExporter]

Patch committed to SVN as revision #1630.

Original comment by augu...@gmail.com on 29 Oct 2010 at 5:11

• Changed state: Fixed