You could add a custom filter to the spring security filter chain to look for semicolons and filter away the request before it hits the servlet code.
Seth
2010-10-22 18:17:54
+2
A:
I don't necessarily know if this resolves the issue, sure I filter away semicolons, but I'm only pretty sure there are more ways to send information across my server
Woot4Moo
2010-10-22 18:30:11
A:
We have decided that the best course of action is to encode all data that is processed through the query string. Why this was not previously implemented is beyond me.
Woot4Moo
2010-10-27 11:32:35