search

rjatkins / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

Linking to .NET URL Munged URL Is blocked #51

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Create an HTML page with an
href="http://subdomain.domain/(S(ke0lpq54bw0fvp53a10e1a45))/MyPage.aspx"
2. Parse with anythinggoes policy

What is the expected output? 
An href="http://subdomain.domain/(S(ke0lpq54bw0fvp53a10e1a45))/MyPage.aspx"
What do you see instead?
Empty tag

Please provide any additional information below.
The offsiteURL regex doesn't permit brackets. These are valid in the path
according to RFC2396 and http://www.w3.org/Addressing/URL/url-spec.txt.

Original issue reported on code.google.com by PhilMatt...@gmail.com on 21 Aug 2009 at 1:52

GoogleCodeExporter commented 9 years ago 
This has been verified and fixed in the base policy files. In the meantime, you 
can
add the parentheses to your policy file (see the offsiteURL regexp towards the 
top).

I have also introduced a test case to confirm it. This will be out in the next 
minor
release.

Original comment by arshan.d...@gmail.com on 15 Oct 2009 at 3:54