title: ESAPI XSS prevention for user supplied url property
body: <p>One of my REST APIs is expecting a property "url" which expects a URL as input from the user. I am using ESAPI to prevent from XSS attacks. The problem is that the user supplied URL is something like </p>
  
  <p><code>http://example.com/alpha?abc=def&amp;phil=key%3dbdj</code> </p>
  
  <p>The cannonicalize method from the ESAPI encoder throws intrusion exception here claiming that the input has mixed encoding, since it is url encoded and the piece '&amp;phi' is treated as HTML encoded and thus the exception. </p>
  
  <p>I had a similar problem with sanitizing one of my application urls where the second query parameter started with 'pa' or 'pi' and was converted to delta or pi characters by HTML decoding. Please refer to my <a href="https://stackoverflow.com/questions/17658535/esapi-encoder-canonicalize-changing-query-parameters">previous Stackoverflow question here</a></p>
  
  <p>Now since the problem is that since the entire URL is coming as input from the user, I cannot simply parse out the Query parameters and sanitize them individually, since malicious input can be created combining the two query parameters and sanitizing them individually wont work in that case. </p>
  
  <p>Example: &amp;ltscr comes is last part of first query param value and ipt&amp;gtalert(0); or something comes as first part of the next query param control context. </p>
  
  <p>Has anyone faced a similar problem? I would really like to know what solutions you guys implemented. Thanks for any pointers. </p>
  
  <p><strong>EDIT: The below answer from 'avgvstvs' does not throw the intrusion exception (Thanks!!). However, the cannonicalize method now changes the original input string. ESAPI treats &amp;phi of the query param to be some html encoded char and replaces it to '?' char. Something like my previous question which is linked here. The difference being that was a URL of my application whereas this is user input. Is my only option maintaining a white list here?</strong> </p>