title: ESAPI canonicalize malforming url
body: <p>We have an application that accepts URLs from users. This data needs validation, and we're using ESAPI for this purpose. However, we're struggling with URLs containing ampersands. </p>
  
  <p>The problem appears when ESAPI canonicalizes the data before validation. &amp;pid=123 in the URL turns into πd=123 for example. Since π is not whitelisted, the validation fails. </p>
  
  <p>I've tried encoding it, but ESAPI is smarter than that and does canonicalization to avoid double encoding and mixed encoding. I'm a bit stumped here and I'm not sure how to proceed. </p>