Adobe Community: Message List - encodeForHTML

Re: encodeForHTML

forums_noreply@adobe.com — Thu, 23 May 2013 14:05:20 GMT

Just FYI, I did some analysis here:

According to the docs for OWASP’s encodeForHtml(), this function ought to be escaping characters in these ranges: 00-08, 0B-0C, 0E-1F, and 7F-9F. However, obviously, there are no characters in those ranges in that input string.

Now I can see what’s going on: a THORN is HTML character entity 222, which is DE in hex, so if one was to treat "%DE" as a percent-encoded hex charcter, then that’d be a thorn. However percent encoding has got nothing to do with HTML (it’s to do with URIs), so that interpretation seems irrelevant to me. What I do know is that in the context of HTML, "%device%" doesn’t need encoding to be "safe", so it shouldn’t be touched by this function.

Not that this helps you, but it helps understand what's going on.

I've voted for the bug.

Adam

Re: encodeForHTML

forums_noreply@adobe.com — Thu, 23 May 2013 13:58:32 GMT

Alright, until I know more I'm sticking with the old HTMLEditFormat. In the mean time I've added Bug 3566150.

Re: encodeForHTML

forums_noreply@adobe.com — Wed, 22 May 2013 22:33:35 GMT

I see the same. I'd raise a bug if I was you. As for a work-around, not sure, given I don't see why it's messing with your string in the first place (it already seems safe to me?)

Adam

Re: encodeForHTML

forums_noreply@adobe.com — Wed, 22 May 2013 13:56:33 GMT

When I try "EncodeForHTML('%Device%')" I end up with "Þvice%" which displays on the page as "Þvice%" Obviously this isn't what I intended. Is there a way to prevent this function from assuming the input string is encoded?

Re: encodeForHTML

forums_noreply@adobe.com — Tue, 15 May 2012 12:41:48 GMT

Hi Adam,

Thank you for your feedback. The docs have been pushed live for CF10 http://www.adobe.com/support/coldfusion. We will make the necessary changes during the next doc refresh cycle.

Regards,

Suhas Yogin

Re: encodeForHTML

forums_noreply@adobe.com — Tue, 15 May 2012 12:32:39 GMT

This page should cross-ref to the page for htmlEditFormat() (http://help.adobe.com/en_US/ColdFusion/10.0/CFMLRef/WSc3ff6d0ea77859461172e0811cbec22c24-7 847.html), as well as discuss the differences and merits of each; both in the context of intended usage and functionality.

encodeForHTML

forums_noreply@adobe.com — Tue, 15 May 2012 12:32:39 GMT

This question was posted in response to the following article: http://help.adobe.com/en_US/ColdFusion/10.0/CFMLRef/WS932f2e4c7c04df8f-6f7941141353e2963af -7fff.html