-
Type: Bug
-
Status: Resolved
-
Priority: Major
-
Resolution: Fixed
-
Affects Version/s: 5.5
-
Fix Version/s: 5.5.0-HF04, 5.6-RC1, 5.6
-
Component/s: Seam / JSF UI
Numerous Nuxeo xhtml files have script tags with a src attribute url that is not encoded. For example, see line 24 in nuxeo-user-activity-stream/src/main/resources/web/nuxeo.war/incl/includes.xhtml:
<script type="text/javascript" src="#
{baseURL}js/?scripts=confirmAlerts.js|DragAndDrop.js|tableSelections.js|customSeamRemotingWaiter.js|custom-javascript.js|default-contextmenu-actions.js|custom-contextmenu-actions.js|tooltip.js"></script>
The url includes the vertical pipe/bar character '|' which is "unsafe" and should be encoded as %7C. Other xhtml files have this problem as well. According to RFC1738:
All unsafe characters must ALWAYS be encoded within a URL.
This compliance violation causes problems for downstream gateways and other transport agents.