[Esapi-user] ESAPI development process
jim.manico at owasp.org
Wed Sep 8 23:36:04 EDT 2010
Can we just hard-code the replacement char? Is there a compelling reason to make it configurable? This is a big deal - I'd like to push this fix into both versions and soon.
Thanks for this, Ed.
On Sep 8, 2010, at 2:51 PM, Ed Schaller <schallee at darkmist.net> wrote:
>> I agree with Jeff. Encoders should never throw exceptions; they are so UI heavy
>> and we don't want JSPs and the like to throw exceptions (nor do we want
>> extensive exception handling requirements in UI code).
>> +1 for making this a config issue.
> Sounds good to me as well. Having the choice is best and I'm ok with a
> good default.
> One thought before implementation, is it worth adding a encoder
> attribute/feature/property/config level setting for this so it can be
> chosen at runtime as well? Let me clarify a bit. Perhaps something like:
> Codec#setConfig(String name, Object value)
> could be added. If a dev wanted the specific instance to throw an
> exception they could do something like:
> or a different replacement:
> with constants for know names. The default would come from the config.
> This would allow future or codec specific settings without API changes.
More information about the Esapi-user