SITES-14313: rfc allowed characters in fragment (#2542)

Co-authored-by: bcenusa <bcenusa@adobe.com>
adobe · Jul 10, 2023 · 312e3d6 · 312e3d6
1 parent 8e178c7
commit 312e3d6
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 3 deletions.
diff --git a/bundles/core/src/main/java/com/adobe/cq/wcm/core/components/internal/link/LinkUtil.java b/bundles/core/src/main/java/com/adobe/cq/wcm/core/components/internal/link/LinkUtil.java
@@ -99,10 +99,12 @@ public static String escape(final String path, final String queryString, final S
                         escaped = sb.insert(path.indexOf(fragment), "#" + fragment).toString();
                     }
                 } else {
-                    escaped = sb.append("#").append(URLEncoder.encode(fragment, StandardCharsets.UTF_8.name())
-                            .replace("+", "%20")).toString();
+                    escaped = sb.append("#")
+                                .append(replaceEncodedCharacters(URLEncoder.encode(fragment, StandardCharsets.UTF_8.name())))
+                                .toString();
                 }
             }
+
         } catch (Exception e) {
             LOG.error(e.getMessage(), e);
             StringBuilder sb = new StringBuilder(path);
@@ -191,4 +193,20 @@ private static String newPlaceholder(final String str) {
 
         return placeholderBuilder.toString();
     }
+
+    private static String replaceEncodedCharacters(final String str) {
+        return str.replace("%2B", "+")
+            .replace("%3D", "=")
+            .replace("%7E", "~")
+            .replace("%24", "$")
+            .replace("%26", "&")
+            .replace("%3B", ";")
+            .replace("%3A", ":")
+            .replace("%40", "@")
+            .replace("%21", "!")
+            .replace("%27", "'")
+            .replace("%28", "(")
+            .replace("%29", ")")
+            .replace("%2C", ",");
+    } 
 }
diff --git a/...rc/test/java/com/adobe/cq/wcm/core/components/internal/link/DefaultPathProcessorTest.java b/...rc/test/java/com/adobe/cq/wcm/core/components/internal/link/DefaultPathProcessorTest.java
@@ -88,12 +88,14 @@ void testSanitizeExternalLink() {
                 underTest.sanitize("https://test.com?categ=cat1|cat2", request));
         assertEquals("https://test.com?categ=cat1%7Ccat2#top",
                 underTest.sanitize("https://test.com?categ=cat1|cat2#top", request));
-        assertEquals("https://test.com?categ=cat1%7Ccat2#top%20level",
+        assertEquals("https://test.com?categ=cat1%7Ccat2#top+level",
                 underTest.sanitize("https://test.com?categ=cat1|cat2#top level", request));
         assertEquals("https://test.com?recipient=<%= recipient.id %>",
                 underTest.sanitize("https://test.com?recipient=<%= recipient.id %>", request));
         assertEquals("https://test.com/#/downloads/file.html?name=/content/file.zip",
                 underTest.sanitize("https://test.com/#/downloads/file.html?name=/content/file.zip", request));
+        assertEquals("https://test.com#page=1-._~!$&'()*+,;=:@",
+                underTest.sanitize("https://test.com#page=1-._~!$&'()*+,;=:@", request));
     }
 
     @Test