Servlet response wrapper has encoding problem
A servlet response wrapper is being used in a Servlet Filter. The idea is that the response is manipulated, with a 'nonce' value being injected into forms, as part of defence against CSRF attacks.

The web app is using UTF-8 everywhere. When the Servlet Filter is absent, no problems. When the filter is added, encoding issues occur. (It seems as if the response is reverting to 8859-1.)

The guts of the code :

    final class CsrfResponseWrapper extends AbstractResponseWrapper {
       ...
       byte[] modifyResponse(byte[] aInputResponse){
          ...
          String originalInput = new String(aInputResponse, encoding);
          String modifiedResult = addHiddenParamToPostedForms(originalInput);
          result = modifiedResult.getBytes(encoding);
          ...
       }
       ...
    }

As I understand it, the transition between byte-land and String-land should specify an encoding. That is done here, as you can see, in two places. The value of the 'encoding' variable is 'UTF-8'; the alteration of the String itself is standard string manipulation (with a regex), and never specifies an encoding (addHiddenParamToPostedForms).

Where am I in error about the encoding?


Servlet response wrapper has encoding problem
===

A servlet response wrapper is being used in a Servlet Filter. The idea is that the response is manipulated, with a 'nonce' value being injected into forms, as part of defence against CSRF attacks.

The web app is using UTF-8 everywhere. When the Servlet Filter is absent, no problems. When the filter is added, encoding issues occur. (It seems as if the response is reverting to 8859-1.)

The guts of the code :

    final class CsrfResponseWrapper extends AbstractResponseWrapper {
       ...
       byte[] modifyResponse(byte[] aInputResponse){
          ...
          String originalInput = new String(aInputResponse, encoding);
          String modifiedResult = addHiddenParamToPostedForms(originalInput);
          result = modifiedResult.getBytes(encoding);
          ...
       }
       ...
    }

As I understand it, the transition between byte-land and String-land should specify an encoding. That is done here, as you can see, in two places. The value of the 'encoding' variable is 'UTF-8'; the alteration of the String itself is standard string manipulation (with a regex), and never specifies an encoding (addHiddenParamToPostedForms).

Where am I in error about the encoding?

