JSF / primefaces handling of control character (form feed hex: 0x0c) in ajax requests?
I am curious about a edge case I have run across when using ajax requests in JSF / primefaces.
I found that if I input a form feed character ("/f" in java or 0x0C in hex) into a request that is handled via ajax it causes the ajax request to fail because the xml generated is considered invalid. I would only expect this scenario to come up if a user is copying and pasting something from another document which happens to contain this character or more likely a QA person (or malicious user) input the character in an attempt to ruin my day.
Exact response I see in chrome developer tools:
<partial-responseid="j_id1">
<parsererror>
<h3>This page contains the following errors:</h3>
<div>
error on line 2 at column 68: Input is not proper UTF-8, indicate encoding !
Bytes: 0x0C 0x20 0x63 0x61
</div>
<h3>Below is a rendering of the page up to the first error.</h3>
</parsererror>
<changes>
<update id="j_idt5"/>
</changes>
</partial-response>
Sample Project to reproduce the error
There seems to be a limitation in XML that this character cannot be included in XML 1.0 so is there anything that JSF / primefaces can do to avoid this scenario or am I asking too much from the framework? If I cannot get JSF / primefaces to handle this gracefully how can I make it so that a proper error page is generated and the issue is logged somewhere other then the users console?
primefaces escaping jsf-2.2
asked Jul 16 '18 at 16:08
booja234booja234
61
add a comment |
I am curious about a edge case I have run across when using ajax requests in JSF / primefaces.
I found that if I input a form feed character ("/f" in java or 0x0C in hex) into a request that is handled via ajax it causes the ajax request to fail because the xml generated is considered invalid. I would only expect this scenario to come up if a user is copying and pasting something from another document which happens to contain this character or more likely a QA person (or malicious user) input the character in an attempt to ruin my day.
Exact response I see in chrome developer tools:
<partial-responseid="j_id1">
<parsererror>
<h3>This page contains the following errors:</h3>
<div>
error on line 2 at column 68: Input is not proper UTF-8, indicate encoding !
Bytes: 0x0C 0x20 0x63 0x61
</div>
<h3>Below is a rendering of the page up to the first error.</h3>
</parsererror>
<changes>
<update id="j_idt5"/>
</changes>
</partial-response>
Sample Project to reproduce the error
There seems to be a limitation in XML that this character cannot be included in XML 1.0 so is there anything that JSF / primefaces can do to avoid this scenario or am I asking too much from the framework? If I cannot get JSF / primefaces to handle this gracefully how can I make it so that a proper error page is generated and the issue is logged somewhere other then the users console?
primefaces escaping jsf-2.2
asked Jul 16 '18 at 16:08
booja234booja234
61
let me investigate this and get back to you. We have been doing a lot of proper escaping in PrimeFaces to handle characters i wonder if this example is a case that fell through the cracks or is a real problem. I will report back.
– Melloware
Jul 16 '18 at 16:28
I have definitely confirmed your error on PF 6.2.
– Melloware
Jul 16 '18 at 16:52
Looks like it is a JSF/Mojarra bug. I updated my comment below.
– Melloware
Nov 21 '18 at 12:47
add a comment |
I am curious about a edge case I have run across when using ajax requests in JSF / primefaces.
I found that if I input a form feed character ("/f" in java or 0x0C in hex) into a request that is handled via ajax it causes the ajax request to fail because the xml generated is considered invalid. I would only expect this scenario to come up if a user is copying and pasting something from another document which happens to contain this character or more likely a QA person (or malicious user) input the character in an attempt to ruin my day.
Exact response I see in chrome developer tools:
<partial-responseid="j_id1">
<parsererror>
<h3>This page contains the following errors:</h3>
<div>
error on line 2 at column 68: Input is not proper UTF-8, indicate encoding !
Bytes: 0x0C 0x20 0x63 0x61
</div>
<h3>Below is a rendering of the page up to the first error.</h3>
</parsererror>
<changes>
<update id="j_idt5"/>
</changes>
</partial-response>
Sample Project to reproduce the error
There seems to be a limitation in XML that this character cannot be included in XML 1.0 so is there anything that JSF / primefaces can do to avoid this scenario or am I asking too much from the framework? If I cannot get JSF / primefaces to handle this gracefully how can I make it so that a proper error page is generated and the issue is logged somewhere other then the users console?
primefaces escaping jsf-2.2
asked Jul 16 '18 at 16:08
booja234booja234
61
I am curious about a edge case I have run across when using ajax requests in JSF / primefaces.
I found that if I input a form feed character ("/f" in java or 0x0C in hex) into a request that is handled via ajax it causes the ajax request to fail because the xml generated is considered invalid. I would only expect this scenario to come up if a user is copying and pasting something from another document which happens to contain this character or more likely a QA person (or malicious user) input the character in an attempt to ruin my day.
Exact response I see in chrome developer tools:
<partial-responseid="j_id1">
<parsererror>
<h3>This page contains the following errors:</h3>
<div>
error on line 2 at column 68: Input is not proper UTF-8, indicate encoding !
Bytes: 0x0C 0x20 0x63 0x61
</div>
<h3>Below is a rendering of the page up to the first error.</h3>
</parsererror>
<changes>
<update id="j_idt5"/>
</changes>
</partial-response>
Sample Project to reproduce the error
There seems to be a limitation in XML that this character cannot be included in XML 1.0 so is there anything that JSF / primefaces can do to avoid this scenario or am I asking too much from the framework? If I cannot get JSF / primefaces to handle this gracefully how can I make it so that a proper error page is generated and the issue is logged somewhere other then the users console?
primefaces escaping jsf-2.2
primefaces escaping jsf-2.2
asked Jul 16 '18 at 16:08
booja234booja234
61
asked Jul 16 '18 at 16:08
booja234booja234
61
asked Jul 16 '18 at 16:08
booja234booja234
61
asked Jul 16 '18 at 16:08
booja234booja234
61
asked Jul 16 '18 at 16:08
booja234booja234
61
61
let me investigate this and get back to you. We have been doing a lot of proper escaping in PrimeFaces to handle characters i wonder if this example is a case that fell through the cracks or is a real problem. I will report back.
– Melloware
Jul 16 '18 at 16:28
I have definitely confirmed your error on PF 6.2.
– Melloware
Jul 16 '18 at 16:52
Looks like it is a JSF/Mojarra bug. I updated my comment below.
– Melloware
Nov 21 '18 at 12:47
add a comment |
let me investigate this and get back to you. We have been doing a lot of proper escaping in PrimeFaces to handle characters i wonder if this example is a case that fell through the cracks or is a real problem. I will report back.
– Melloware
Jul 16 '18 at 16:28
I have definitely confirmed your error on PF 6.2.
– Melloware
Jul 16 '18 at 16:52
Looks like it is a JSF/Mojarra bug. I updated my comment below.
– Melloware
Nov 21 '18 at 12:47
let me investigate this and get back to you. We have been doing a lot of proper escaping in PrimeFaces to handle characters i wonder if this example is a case that fell through the cracks or is a real problem. I will report back.
– Melloware
Jul 16 '18 at 16:28
let me investigate this and get back to you. We have been doing a lot of proper escaping in PrimeFaces to handle characters i wonder if this example is a case that fell through the cracks or is a real problem. I will report back.
– Melloware
Jul 16 '18 at 16:28
I have definitely confirmed your error on PF 6.2.
– Melloware
Jul 16 '18 at 16:52
I have definitely confirmed your error on PF 6.2.
– Melloware
Jul 16 '18 at 16:52
Looks like it is a JSF/Mojarra bug. I updated my comment below.
– Melloware
Nov 21 '18 at 12:47
Looks like it is a JSF/Mojarra bug. I updated my comment below.
– Melloware
Nov 21 '18 at 12:47
add a comment |
1 Answer
1
active
oldest
votes
I believe it to be a bug and reported it here: https://github.com/primefaces/primefaces/issues/3875
I will report back once the issue has been addressed.
Update: It turns out to be a Mojarra issue:
https://github.com/eclipse-ee4j/mojarra/issues/4516
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f51366022%2fjsf-primefaces-handling-of-control-character-form-feed-hex-0x0c-in-ajax-req%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I believe it to be a bug and reported it here: https://github.com/primefaces/primefaces/issues/3875
I will report back once the issue has been addressed.
Update: It turns out to be a Mojarra issue:
https://github.com/eclipse-ee4j/mojarra/issues/4516
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
add a comment |
I believe it to be a bug and reported it here: https://github.com/primefaces/primefaces/issues/3875
I will report back once the issue has been addressed.
Update: It turns out to be a Mojarra issue:
https://github.com/eclipse-ee4j/mojarra/issues/4516
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
add a comment |
I believe it to be a bug and reported it here: https://github.com/primefaces/primefaces/issues/3875
I will report back once the issue has been addressed.
Update: It turns out to be a Mojarra issue:
https://github.com/eclipse-ee4j/mojarra/issues/4516
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
I believe it to be a bug and reported it here: https://github.com/primefaces/primefaces/issues/3875
I will report back once the issue has been addressed.
Update: It turns out to be a Mojarra issue:
https://github.com/eclipse-ee4j/mojarra/issues/4516
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
edited Nov 21 '18 at 12:46
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
answered Jul 16 '18 at 18:33
MellowareMelloware
2,91711935
2,91711935
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f51366022%2fjsf-primefaces-handling-of-control-character-form-feed-hex-0x0c-in-ajax-req%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
let me investigate this and get back to you. We have been doing a lot of proper escaping in PrimeFaces to handle characters i wonder if this example is a case that fell through the cracks or is a real problem. I will report back.
– Melloware
Jul 16 '18 at 16:28
I have definitely confirmed your error on PF 6.2.
– Melloware
Jul 16 '18 at 16:52
Looks like it is a JSF/Mojarra bug. I updated my comment below.
– Melloware
Nov 21 '18 at 12:47