Adding HTML encoding to default 404 error message.

[jaxley]

No description provided.

[rossabaker]

I like the idea, but spring-web seems heavy for HTML escaping. Could we just implement that as a function and not take on more weight?

[jaxley]

Their library is one of the best for doing HTML encoding. Can you
implement the similar logic? It should ideally match their implementation.

-Jason

On Thu, Apr 7, 2016 at 1:15 PM Ross A. Baker notifications@github.com
wrote:

I like the idea, but spring-web seems heavy for HTML escaping. Could we
just implement that as a function and not take on more weight?

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub
#566 (comment)

[rossabaker]

Would scala.xml.Utility.escape get the job done?

[jaxley]

Absolutely not. XML encoding only tends to encode the main metacharacters
of XML and leave all other characters unencoded, leaving lots of room for
shenanigans. It's best practice to encode as much as you can of the
special characters. Plus, HTML encoders deal with the wide variety of
named entities in HTML that aren't in XML.

Scalatra really should not be taking on the task of building and
maintaining an secure HTML encoder IMO. Is spring-web really that large
that it's worth taking on this burden and risk? You could use OWASP
ESAPI's HTML encoder as well, but that library has not necessarily been
maintained tightly and is not a flagship OWASP tool.

-Jason
On Fri, Apr 8, 2016, 9:04 PM Ross A. Baker notifications@github.com wrote:

Would scala.xml.Utility.escape get the job done?

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub
#566 (comment)

[rossabaker]

I agree that we would not want to maintain a general purpose HTML encoder. But the rules are context sensitive. This context is the one described by Rule 1 of the OWASP guidelines, which is the simple one.

I took a closer look at scala.xml.Utility, and it misses ' and /. So that's out. But spring-web seems like bloat for a function that needs to sanitize six characters.

[pgingras]

Is there any follow up on this PR? It's a fix I would need at work.