Can Lucee 7 be configured to use the same XSS encoding as Lucee 6?

I’m trying to test our application under Lucee 7 (7.0.2.51-SNAPSHOT), but running into an issue with encodings which is causing a ton of unit tests to fail, which makes it hard to figure out which tests are actually broken vs ones that are failing because of encoding differences.

For example, in Lucee 6 and below, running the following:

encodeForHtmlAttribute('hello world')

Would produce:

hello world

However, in Lucee 7 you get:

hello world

While technically I prefer the output in v7, because it was encoding a lot of characters that did not need to be encoded, but this is breaking a lot of our tests which are testing for encoding.

While I can certainly refactor all of our failing tests, is there a way to get encoding to match Lucee 6 and earlier? If I could add in an environment switch, it would at least temporarily help reveal parts of our code that are actually problematic.

2 posts were split to a new topic: ESAPI v3 Encoder Changes

Does that mean esapiEncode() must be renamed to owaspEncode() :slight_smile:

1 Like

nah, i think esapiEncode(modern=true) is better :slight_smile:

I have created a ticket for this

https://luceeserver.atlassian.net/browse/LDEV-6075