Java: url encoding leaves "allowed" character intact

Question

A simple question from a Java newbie. I want to encode the URL so that non-standard characters are converted to their hexadecimal value (i.e.% XX), while the characters that everyone expects to see in the letter-letter, numbers, slashes, question marks, etc. Will be left untouched.

For example, coding

"hi/hello?who=moris\\boris"

should appear with

"hi/hello?who=moris%5cboris"

ideas?

Answer 1

This is actually a rather complicated problem. And the reason this is complicated is because different parts of the URL need to be processed (encoded) differently.

, - URL- URL URI, .

---

, , , . , () "?" ( ) (escape it).

Answer 2

OWASP Enterprise Security API .

, . http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.235_-_URL_Escape_Before_Inserting_Untrusted_Data_into_HTML_URL_Parameter_Values

http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/PercentCodec.java

Answer 3

, URL-. URL

public static String escapeSpecialCharacters(String input) {
        StringBuilder resultStr = new StringBuilder();
        for (char ch : input.toCharArray()) {
            if (isSafe(ch)) {
                resultStr.append(ch);
            } else{
                resultStr.append('%');
                resultStr.append(toHex(ch / 16));
                resultStr.append(toHex(ch % 16));                   
            }
        }

        return resultStr.toString();
    }

    private static char toHex(int ch) {
        return (char) (ch < 10 ? '0' + ch : 'A' + ch - 10);
    }

    private static boolean isSafe(char ch) {
    return ((ch>='A' && ch<='Z') || (ch>='a' && ch<='z') || (ch>='0' && ch<='9') || "-_.~".indexOf(ch)>=0); 
}

Answer 4

URLEncoder.encode(url, "UTF-8"), . Javadoc.

Answer 5

org.apache.commons.codec.net.URLCodec (, \, ). , , URL-, . , ? = , , .

Answer 6

spring UriUtils., , / URL- URL-.

http://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/util/UriUtils.html