title: Can't seem to get ESAPI Validator getValidInput() Working for URL Parameters
body: <p>I am trying to use ESAPI Encoder to identify and canonicalize URL-encoded query parameters. It sort of works, but not in the way the API seems to indicate. Here is my class, and below is the output it generates:</p>
  
  <p><strong>CODE</strong></p>
  
  <pre><code>package test.test;
  
  import org.owasp.esapi.ESAPI;
  import org.owasp.esapi.Validator;
  import org.owasp.esapi.errors.EncodingException;
  import org.owasp.esapi.errors.IntrusionException;
  import org.owasp.esapi.errors.ValidationException;
  
  public class ESAPITester {
  
      public static void main(String argsp[]) throws ValidationException, 
      IntrusionException, EncodingException {
  
          String searchString = "-/+=_ !$*?@";
          String singleEncoded = ESAPI.encoder().encodeForURL(searchString);
          String doubleEncoded = ESAPI.encoder().encodeForURL(singleEncoded);
          Validator validator = ESAPI.validator();
          System.out.println("Searched        : " + searchString);
          System.out.println("Single encoded  : " + singleEncoded);
          System.out.println("Double encoded  : " + doubleEncoded);
          System.out.println("Decode from URL : " + ESAPI.encoder().decodeFromURL(singleEncoded));
          System.out.println("Canonicalized   : " + ESAPI.encoder().canonicalize(singleEncoded));
          System.out.println("Valid input     : " + validator.getValidInput("http", 
                  searchString, "HTTPParameterValue", 100, true, true));
          System.out.println("Valid from Encoded : " + validator.getValidInput("http", 
                  singleEncoded, "HTTPParameterValue", 100, true, true));
  
      }
  }
  </code></pre>
  
  <p><strong>OUTPUT</strong></p>
  
  <pre><code>Searched        : -/+=_ !$*?@
  Single encoded  : -%2F%2B%3D_+%21%24*%3F%40
  Double encoded  : -%252F%252B%253D_%2B%2521%2524*%253F%2540
  Decode from URL : -/ =_ !$*?@
  Canonicalized   : -/+=_+!$*?@
  Valid input     : -/+=_ !$*?@
  log4j:WARN No appenders could be found for logger (IntrusionDetector).
  log4j:WARN Please initialize the log4j system properly.
  log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
  Exception in thread "main" org.owasp.esapi.errors.ValidationException: http: Invalid input. Please conform to regex ^[\p{L}\p{N}.\-/+=_ !$*?@]{0,1000}$ with a maximum length of 100
      at org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:144)
      at org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:160)
      at org.owasp.esapi.reference.validation.StringValidationRule.getValid(StringValidationRule.java:284)
      at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:214)
      at test.test.ESAPITester.main(ESAPITester.java:25)
  </code></pre>
  
  <p>My question is: Why does the getValidInput() not canonicalize the URL-encoded input parameter? I'm curious as to why the canonicalize() method does so, but getValidInput() with the final argument ('canonicalize') set to true doesn't.</p>