Discussion

1
Replies
99
Views
Close popover
Kensho Tsuchihashi (KenshoTsuchihashi)
PEGA
Project Delivery Leader
Pegasystems Inc.
JP
KenshoTsuchihashi Member since 2010 137 posts
PEGA
Posted: March 18, 2021
Last activity: March 27, 2021

% sign gets scrambled as % with getRuleMessage

Hi,

 

"%" sign gets scrambled as "%" when you use @getRuleMessage RUF. In this post, I am sharing how to fix the issue.

 

  • Issue

Here is how to reproduce the error.

1. Create a Message rule that takes Text parameter.

Message rule with parameter

Message parameters

2. Pass "%" sign to the Message rule by @getRuleMessage RUF. You can use Log-Message, or Page-Set-Message, or any method to print.

Print % sign with Log-Message

3. "%" sign is automatically converted into "%" as below.

% is scrambled

 

  • Root cause

This is the side effect of encoding some of the characters in the HTTP request to avoid Cross-site Scripting (XSS) attacks. pzpega_tools_security.js does this part.

pzpega_tools_security.js

1 = =
2 &lt; <
3 &gt; >
4 &quot; \
5 &#39; '
6 &#37; %
7 &#59; ;
8 &#40; (
9 &#41; )
10 &#43; +
11 &amp; &

 

  • How to fix it

This issue will be fixed in the future release. If you are using an old version prior to the fixed release, you can still perform a local change by other two means below. Either approach is fine. The difference is, (2) approach doesn't do cross script filtering. Cross script filtering was added to getRuleMessage because it is called in the out-of-the-box activity during log in. If you are planning to use it externally, use (1) approach as it is more secure. Also be noted that FormatMessage needs the Message rule to be @baseclass, while getRuleMessage can process Message rule of any class.

 

(1) Put the message into a parameter and use restoreFilteredString API to decode it.

String str = tools.getParamValue("Message");
str = com.pega.pegarules.pub.util.StringUtils.restoreFilteredString("{rcsf}"+str);
tools.getParameterPage().putParamValue( "Message", str );

getRuleMessage Workaround

(2) Use @FormatMessage instead of @getRuleMessage.

FormatMessage

 

* Either of above approach prints "%" sign correctly as below.

% sign is now fixed

 

Thanks,

 

***Edited by Moderator: Pooja Gadige to add Developer Knowledge Share tag, add support case exists tag, add platform capability tag***
Pega Platform 8.4.1 Low-Code App Development Developer Knowledge Share Support Case Exists