ComponentUtils.getHrefURL: lack of encoding

[cnsgithub]

As already mentioned in this commit comment parameter keys are not encoded. This may lead to HTTP parameter pollution.

Fragments are also not encoded. See comment below

[cnsgithub]

PR: #3410

[cnsgithub]

@jasonex7 Your method seems to assume that the baseUrl already is correctly encoded in all parts: paths, parameters, fragment. Is that correct? Then we should make it a convention in javadoc or maybe annotate the baseUrl parameter with @Encoded (borrow from javax.ws.rs?) to avoid double encoding. What do you think?

[jasonex7]

@cnsgithub I encode only the values of OutcomeTarget.getParams() because the original request had only EL in value attribute, but it's good that param key was also encoded. Thanks for the observation and commit.

[cnsgithub]

@jasonex7 Ok. However, as getHrefURL is located in ComponentUtils, you have to expect it to be used in other locations as well in future.