zberentey/liferay-portal — pull request #172 by lipusz (2012-11-19 13:30:00+00:00)
Title: [TECHNICAL-SUPPORT] LPS-31038 No need to escape URLTitle in JournalArticleAssetRenderer.getURLViewInContext() method, since it is normalized by FriendlyURLNormalizer on creation time

Hi, Zsolt,

Hi,

I've found that no need to escape URLTitle (added by Juan, LPS-22659) in JournalArticleAssetRenderer.getURLViewInContext() method, since it's normalized by FriendlyURLNormalizerImpl.normalize(String friendlyURL, char[] replaceChars)) on creation time.

char[] replaceChars = new char[] {
' ', ',', '\\', '\'', '\"', '(', ')', '[', ']', '{', '}', '?', '#',
'@', '+', '~', ';', '$', '%', '!', '=', ':', '&'
};

At least, all of these characters will be replaced by a dash if they present in the URLTitle. After this normalization, it's not possible to do much harm, beside a JS error on the page.

After all, I think, just removing that useless "HtmlUtil.escape()" from JAAR is enough to fix this particular problem.
IMHO, refactoring the whole source to not do early escaping would require more discussion and other LPSs.

See the MB about this issue at: http://in.liferay.com/web/global.engineering/forums/-/message_boards/view_message/894544#_19_message_880081

Please, review my changes and let me know if I was wrong at any points.

Thanks,
Tibor