DefaultEncoder does not use custom codecs

[meg23]

From rpal...@gmail.com on May 21, 2009 12:51:27

What steps will reproduce the problem? 1. Call the DefaultEncoder constructor with List of Codecs as parameter and
pass a list containing a customized JavaScriptCodec that implements Codec
interface
2. Then call the encodeForJavascript method and pass a string.
3. The encoding performed on the string is the default encoding and not the
intended custom encoding as per the codec object passed in the codecs list
that is passed to the constructor What is the expected output? What do you see instead? The encoding should be done as per the customized encodeCharacter method
but it is done using the default encodeCharacter method (belonging to the
org.owasp.esapi.codecs.JavaScriptCodec class) What version of the product are you using? On what operating system? Using owasp-esapi-full-java-1.4.jar, Windows XP. Please provide any additional information below. I saw the DefaultEncoder code and in the DefaultEncoder(List list) at line
70, I see that codecs member is being updated but then the private Codec
variables are not being updated with the ones that are contained the codec
list.
Fix in my opinion:
I think the codec list should be looped through and based on the codec
objects contained, the corresponding private codec memebers should be
updated. For eg: If the codecs list passed has a JavaScriptCodec object,
the private memeber javaScriptCodec should be updated with the object in
the codecs list so that eventually, its encodeCharacter will be called
instead of the method from the default value (to the
org.owasp.esapi.codecs.JavaScriptCodec class)

Attachment: DefaultEncoder.java

Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=16

[meg23]

From cyounk...@gmail.com on July 22, 2009 08:52:38

While the documentation does not indicate this, what's going on here is that the
constructor for the DefaultEncoder is designed to take in a list of codecs for
canonicalization, not for regular encodeFor...() methods.

I don't see any information in the interface doc about this constructor
functionality, which is problem #1. I guess we just made this up for the Default :-)

Problem #2 is that if someone wants to do something reasonable like you are doing,
just replace a specific codec, they must also replace DefaultEncoder with their own
implementation to press the new codec into use. I think it would be much better to
move to a plug-in architecture where plug-ins register themselves with the encoder
with a specific target ('javascript'), and the encoder, when called, can hand the
request off to whichever plug-in is registered with the appropriate target.

Such a plug-in system wouldn't need to modify the API, and would make the
DefaultEncoder much easier to extend.

[meg23]

From chrisisbeef on December 01, 2009 23:53:17

This should be resolved with the Encoder API Cleanup - Issue 68 https://code.google.com/p/owasp-esapi-java/issues/detail?id=68 If this does not address the problem fully, please reopen this issue, for the time
being I am marking this as a duplicate and closing.

Status: Duplicate
Mergedinto: 68