title: /ExampleApplication/IntrusionException] INTRUSION - Mixed encoding (2x) detected in URL
body: <p>I am retrieving URL from database and it contains special characters like % - = / ? etc. so while I try to populate that in my page JSON is not able to parse that URL and it is giving me some exception when I was debugging I got like this </p>
  
  <pre><code>(Log4JLogger.java:log:449) [SECURITY FAILURE Anonymous:null@unknown -&gt; /ExampleApplication/IntrusionException] INTRUSION - Mixed encoding (2x) detected
  </code></pre>
  
  <p>I tried from these link <a href="https://stackoverflow.com/questions/23434156/esapi-xss-prevention-for-user-supplied-url-property/23448264#23448264">here</a> this my offending URL <a href="https://www.checkTherooms.com/sp-sp/pkrst-hill-a-sterling-resort/aspinado-in.html?asq=pilke%2BTzFRfuhqqI6cDagPyf0TvDus6m%2Fqzj%2F5d4b7Fe%2BEYa7HIBnYC6%2B7c8xXRhVmwjPyWxMCZQj7nMnGFdz4QPYpbse8WbUnZ4COBykfTQQW%2FmefF68ZdJ%2F1dxV0si%2F7F4R%2Bzf1pxnnNnEBG7RMQ1Dr2YuhE%2BWGjx6kzVsylmJbmDE48DxN&amp;resort=267tick=636153269108&amp;peid=7&amp;origin=SP&amp;cid=-145&amp;htmlLanguage=sp-sp&amp;checkIn=2016-11-21&amp;checkout=2016-11-22&amp;childs=0&amp;ckuid=f0d31795-503d-4fc5-9a47-5ab3a5bc6186)" rel="nofollow noreferrer">here</a></p>
  
  <p>but it is not working he mentioned that bug is solved. but for which version version here I am using is 2.1.0 below is my code</p>
  
  <pre><code>package com.ghn.repufact.review.extractor;
  
  import java.net.URI;
  import java.net.URISyntaxException;
  import java.util.List;
  
  import javax.ws.rs.core.UriBuilder;
  
  import org.apache.http.NameValuePair;
  import org.apache.http.client.utils.URLEncodedUtils;
  import org.apache.log4j.Logger;
  import org.owasp.esapi.ESAPI;
  import org.owasp.esapi.Encoder;
  import org.owasp.esapi.Validator;
  import org.owasp.esapi.errors.EncodingException;
  import org.owasp.esapi.reference.DefaultValidator;
  import org.springframework.stereotype.Component;
  
  @Component
  public class ValidateURL {
      private static final Logger logger=Logger.getLogger(ValidateResponse.class);
      public  String parseOrgConsumerLink(String myLink) throws URISyntaxException {
          if(myLink==null || "".equalsIgnoreCase(myLink))
              return myLink;
          Encoder enc=ESAPI.encoder();
          URI mixURI=new URI(myLink);
          UriBuilder uriBuider=UriBuilder.fromUri(enc.canonicalize(mixURI.getAuthority()+mixURI.getPath()));
          uriBuider.path(enc.canonicalize(mixURI.getAuthority() + mixURI.getPath()));
          logger.info("Uri after URIbuilder:"+uriBuider.build().toString());
          List&lt;NameValuePair&gt; params = URLEncodedUtils.parse(mixURI, "UTF-8");
          for (NameValuePair nameValuePair : params) 
              uriBuider.queryParam(enc.canonicalize(nameValuePair.getName()), enc.canonicalize(nameValuePair.getValue()));
          String canonicalizedUrl = uriBuider.build().toString();
          logger.info("canonicaliz URI:"+canonicalizedUrl);
          return canonicalizedUrl;
      }
  
      public boolean isCanonicalizedURI(String myLink) throws EncodingException {
          Validator validator=DefaultValidator.getInstance();
          //boolean flag=validator.isValidInput("test", myLink, "URI", 200, false);
          myLink = ESAPI.encoder().encodeForURL(myLink);
  
          boolean flag = validator.isValidInput("APPNAME", myLink, "URLSTRING", 600, true, false);
          logger.info("checking for URI:"+myLink+" isCanonical:"+flag);
          return flag;
      }
  
  
  }
  </code></pre>
  
  <p>please let me know if any work around here. By the way I am using spring MVC</p>