Where to submit bugs for CFESAPI?

[Sn3akyP3t3]

I see in Google Code many different versions of ESAPI where bugs can be submitted for each type.  Where would one submit bugs for CFESAPI?  I found a url query string that the encoder didn't like.  http://127.0.0.1:8500/?dir=4&num=00000745'%20and%20char(124)%2Buser%2Bchar(124)=0%20and%20'%25'='

LogMessage	Mixed encoding (2x) detected in dir=4&num=00000745%27%20and%20char(124)%2Buser%2Bchar(124)=0%20and%20%27%25%27=%27
Message	Input validation failure
StackTrace	org.owasp.esapi.errors.IntrusionException: Input validation failure at org.owasp.esapi.reference.DefaultEncoder.canonicalize(DefaultEncoder.java:188) at org.owasp.esapi.reference.DefaultEncoder.canonicalize(DefaultEncoder.java:122) at org.owasp.esapi.reference.DefaultEncoder.decodeFromURL(DefaultEncoder.java:415) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at coldfusion.runtime.StructBean.invoke(StructBean.java:508) at coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:2393) at cfapplication2ecfc858064705$funcONREQUESTSTART.runFunction(<drive>:\ColdFusion9\wwwroot\application.cfc:59) at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at coldfusion.runtime.UDFMethod$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321) at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:491) at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:337) at coldfusion.runtime.AppEventInvoker.invoke(AppEventInvoker.java:88) at coldfusion.runtime.AppEventInvoker.onRequestStart(AppEventInvoker.java:258) at coldfusion.filter.ApplicationFilter.invoke(ApplicationFilter.java:349) at coldfusion.filter.RequestMonitorFilter.invoke(RequestMonitorFilter.java:48) at coldfusion.filter.MonitoringFilter.invoke(MonitoringFilter.java:40) at coldfusion.filter.PathFilter.invoke(PathFilter.java:94) at coldfusion.filter.LicenseFilter.invoke(LicenseFilter.java:27) at coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:70) at coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:28) at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38) at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:46) at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38) at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22) at coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62) at coldfusion.CfmServlet.service(CfmServlet.java:200) at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:89) at jrun.servlet.FilterChain.doFilter(FilterChain.java:86) at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:42) at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46) at jrun.servlet.FilterChain.doFilter(FilterChain.java:94) at jrun.servlet.FilterChain.service(FilterChain.java:101) at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106) at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42) at jrun.servlet.JRunRequestDispatcher.invokeNext(JRunRequestDispatcher.java:586) at jrun.servlet.JRunRequestDispatcher.forwardInvoke(JRunRequestDispatcher.java:555) at jrun.servlet.JRunRequestDispatcher.forward(JRunRequestDispatcher.java:203) at jrun.servlet.file.FileServlet.service(FileServlet.java:323) at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106) at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42) at jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:286) at jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:543) at jrun.servlet.http.WebService.invokeRunnable(WebService.java:172) at jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java:320) at jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:428) at jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:266) at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)

Type	org.owasp.esapi.errors.IntrusionException
UserMessage	Input validation failure

[Jason Dean]

I suspect here: https://github.com/damonmiller/cfesapi/issues

Jason

--
You received this message because you are subscribed to the Google Groups "cfesapi" group.
To view this discussion on the web visit https://groups.google.com/d/msg/cfesapi/-/0d1vFPeKIn4J.
To post to this group, send email to cfe...@googlegroups.com.
To unsubscribe from this group, send email to cfesapi+u...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/cfesapi?hl=en.

[Sn3akyP3t3]

Thanks.  I'll post findings there.  Is this redundant or not related to the project, http://code.google.com/p/owasp-esapi-coldfusion/issues/list ?

To unsubscribe from this group, send email to cfesapi+unsubscribe@googlegroups.com.

[Jason Dean]

That's a defunct project. The one I linked you to is the active one. 

Jason

To view this discussion on the web visit https://groups.google.com/d/msg/cfesapi/-/6dalkKMbpqIJ.

To post to this group, send email to cfe...@googlegroups.com.

To unsubscribe from this group, send email to cfesapi+u...@googlegroups.com.