[
https://issues.apache.org/jira/browse/SLING-13162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18085079#comment-18085079
]
Carsten Ziegeler commented on SLING-13162:
------------------------------------------
This is clearly a typo, we should change this to "[A-Za-z0-9._-]" which seems
to be the usual convention for path parameter names.
In addition SlingUriBuilder seems to compile the static patterns over and over
again - which should only be done once
> [Code Quality] High: The regex constant PATH_PARAMETERS_REGEX contains a typo
> -----------------------------------------------------------------------------
>
> Key: SLING-13162
> URL: https://issues.apache.org/jira/browse/SLING-13162
> Project: Sling
> Issue Type: Task
> Components: API
> Reporter: Carsten Ziegeler
> Priority: Major
>
> h2. Maia Finding
> - Report: Code Quality
> - Severity: High
> - Location:
> `[src/main/java/org/apache/sling/api/uri/SlingUriBuilder.java:85`|https://github.com/apache/sling-org-apache-sling-api/blob/master/src/main/java/org/apache/sling/api/uri/SlingUriBuilder.java#L85]
> - Report generated: 2026-04-04T13:16:04.601Z
> - Model: claude-sonnet-4.6
> h2. Description
> The regex constant PATH_PARAMETERS_REGEX contains a typo: '[a-zA-z0-9]' uses
> a lowercase 'z' instead of uppercase 'Z'. The range 'A-z' in a character
> class spans ASCII 65–122, inadvertently matching six non-alphanumeric
> characters ([ \ ] ^ _ `) between 'Z' (90) and 'a' (97). This means path
> parameter keys containing those characters are silently accepted, potentially
> leading to unexpected parsing behaviour.
> h2. Recommendation
> Change 'A-z' to 'A-Z' in PATH_PARAMETERS_REGEX:
> ";([a-zA-Z0-9]{+})=(?:\'([^']*)\'|([^/]{+}))". Add a unit test that asserts
> keys with characters such as '[' or '\' are rejected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
