OWASP/owasp-java-encoder

forHtml fails to encode an Ampersand in a stringified Map

privettoli opened this issue · 1 comments

Artifact file that fails:
AmpersandIssue.txt

CloudFoundry buildpack: java_buildpack_offline-3_8_1
OpenJDK JRE: 1.8.0_91-unlimited-crypto
org.owasp.encoder:encoder: 1.1
org.owasp.esapi:esapi: 2.1.0.1

Also tested on:

java version "1.8.0_161"
Java(TM) SE Runtime Environment (build 1.8.0_161-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.161-b12, mixed mode)

Simple code:

Encode.forHtml(new String(Files.readAllBytes(Paths.get("AmpersandIssue.txt")), UTF_8));

The stack trace is:

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException
	at java.lang.String.getChars(String.java:826)
	at org.owasp.encoder.Encode$Buffer.encode(Encode.java:1306)
	at org.owasp.encoder.Encode.encode(Encode.java:1220)
	at org.owasp.encoder.Encode.forXml(Encode.java:739)
	at org.owasp.encoder.Encode.forHtml(Encode.java:155)

Fixed by upgrading to 1.2.1