Re: (turbine-core) 02/02: Fix for security check to prevent XSS for default Turbine keys from parameters, which might be set or not and e.g. sed in templates and other places.

Hi Georg

> Am 21.02.2025 um 11:55 schrieb [email protected]:
>=20
> +    public static boolean keyRequiresClean(String parameter) {
> +        Matcher testMatcher =3D =
Pattern.compile(CHARACTERS_NOT_ALLOWED_IN_KEY).matcher(parameter);
> +        return testMatcher.find();

It would probably be better to compile the Pattern statically, as this =
method will possibly be called multiple times *per request*.

Bye, Thomas=20=