Fix NXmessagesRenderer to display messages containing % character

Test case:

1. create an automation chain like the following:

   - Context.FetchDocument
   - WebUI.AddMessage:
       message: "hello % percent"
       severity: INFO

2. create a button to trigger this chain
3. create a document allowing the button to be shown
4. click the button
5. a blanc page is displayed and the logs show the following stack trace:

   2016-09-26 10:38:56,957 ERROR [http-bio-0.0.0.0-8080-exec-34] [nuxeo-error-log] javax.servlet.ServletException: Conversion = 'p'
   	at javax.faces.webapp.FacesServlet.service(FacesServlet.java:659)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
   	at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
   	at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
   	at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45)
   	at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
   	at org.nuxeo.elasticsearch.web.sync.UIThreadMarker.doFilter(UIThreadMarker.java:46)
   	at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
   	at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.core.management.jtajca.internal.Log4jWebFilter.doFilter(Log4jWebFilter.java:67)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.doFilterInternal(NuxeoAuthenticationFilter.java:432)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:36)
   	at org.nuxeo.ecm.platform.ui.web.auth.oauth.NuxeoOAuthFilter.doFilter(NuxeoOAuthFilter.java:120)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:34)
   	at org.nuxeo.ecm.platform.ui.web.auth.oauth2.NuxeoOAuth2Filter.doFilter(NuxeoOAuth2Filter.java:68)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:34)
   	at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.doFilter(NuxeoAuthenticationFilter.java:400)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.exceptionhandling.NuxeoExceptionFilter.doFilter(NuxeoExceptionFilter.java:75)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.encoding.NuxeoEncodingFilter.doFilter(NuxeoEncodingFilter.java:73)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:748)
   	at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:486)
   	at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:411)
   	at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:338)
   	at org.nuxeo.ecm.platform.ui.web.rest.FancyURLFilter.doFilter(FancyURLFilter.java:110)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.requestcontroller.filter.NuxeoRequestControllerFilter.doFilter(NuxeoRequestControllerFilter.java:144)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.webdav.service.WIRequestFilter.doFilter(WIRequestFilter.java:59)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.doFilterInternal(NuxeoAuthenticationFilter.java:590)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:36)
   	at org.nuxeo.ecm.platform.ui.web.auth.oauth.NuxeoOAuthFilter.doFilter(NuxeoOAuthFilter.java:120)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:34)
   	at org.nuxeo.ecm.platform.ui.web.auth.oauth2.NuxeoOAuth2Filter.doFilter(NuxeoOAuth2Filter.java:68)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:34)
   	at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.doFilter(NuxeoAuthenticationFilter.java:400)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.apidoc.filter.BaseApiDocFilter.doFilter(BaseApiDocFilter.java:56)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:208)
   	at com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:274)
   	at org.nuxeo.ecm.platform.web.common.requestcontroller.filter.NuxeoCorsFilter.doFilter(NuxeoCorsFilter.java:64)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.exceptionhandling.NuxeoExceptionFilter.doFilter(NuxeoExceptionFilter.java:75)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.encoding.NuxeoEncodingFilter.doFilter(NuxeoEncodingFilter.java:73)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
   	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
   	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
   	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
   	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
   	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
   	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
   	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)
   	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
   	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
   	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
   	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
   	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   	at java.lang.Thread.run(Thread.java:745)
   Caused by: java.util.UnknownFormatConversionException: Conversion = 'p'
   	at java.util.Formatter$FormatSpecifier.conversion(Formatter.java:2691)
   	at java.util.Formatter$FormatSpecifier.<init>(Formatter.java:2720)
   	at java.util.Formatter.parse(Formatter.java:2560)
   	at java.util.Formatter.format(Formatter.java:2501)
   	at java.util.Formatter.format(Formatter.java:2455)
   	at java.lang.String.format(String.java:2940)
   	at org.nuxeo.ecm.platform.ui.web.component.message.NXMessagesRenderer.encodeEnd(NXMessagesRenderer.java:165)
   	at javax.faces.component.UIComponentBase.encodeEnd(UIComponentBase.java:919)
   	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1864)
   	at org.nuxeo.ecm.web.resources.jsf.ResourceInsertRenderer.encodeChildren(ResourceInsertRenderer.java:55)
   	at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:889)
   	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1857)
   	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1860)
   	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1860)
   	at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:461)
   	at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:133)
   	at org.jboss.seam.jsf.SeamViewHandler.renderView(SeamViewHandler.java:188)
   	at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:337)
   	at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:120)
   	at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
   	at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:219)
   	at javax.faces.webapp.FacesServlet.service(FacesServlet.java:647)
   	... 83 more
   

This is due to % sign not being escaped in NXMessagesRenderer.encodeEnd:

if (showDetail) {
                message = String.format(scriptContent,
                        StringEscapeUtils.escapeJavaScript(StringEscapeUtils.escapeHtml(detail)),
                        StringEscapeUtils.escapeJavaScript(StringEscapeUtils.escapeHtml(summary)), errorType,
                        severityStyleClass, timeout);
            } else {
                message = String.format(scriptContent, "",
                        StringEscapeUtils.escapeJavaScript(StringEscapeUtils.escapeHtml(summary)), errorType,
                        severityStyleClass, timeout);
            }

The StringEscapeUtils methods don't escape % meaning abc%abc&abc$abc will become abc%abc&abc$abc.

The String.format method then interprets the % as a formatting directive, see Formatter javadoc.

The $ character is not an issue though.

As a workaround customer can escape manually the % character by using

%

.