{"action":"opened","issue":{"url":"https://api.github.com/repos/dotCMS/core/issues/7075","labels_url":"https://api.github.com/repos/dotCMS/core/issues/7075/labels{/name}","comments_url":"https://api.github.com/repos/dotCMS/core/issues/7075/comments","events_url":"https://api.github.com/repos/dotCMS/core/issues/7075/events","html_url":"https://github.com/dotCMS/core/issues/7075","id":55489355,"number":7075,"title":"XSS detector does not give enough information to fix","user":{"login":"wezell","id":934364,"avatar_url":"https://avatars.githubusercontent.com/u/934364?v=3","gravatar_id":"","url":"https://api.github.com/users/wezell","html_url":"https://github.com/wezell","followers_url":"https://api.github.com/users/wezell/followers","following_url":"https://api.github.com/users/wezell/following{/other_user}","gists_url":"https://api.github.com/users/wezell/gists{/gist_id}","starred_url":"https://api.github.com/users/wezell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wezell/subscriptions","organizations_url":"https://api.github.com/users/wezell/orgs","repos_url":"https://api.github.com/users/wezell/repos","events_url":"https://api.github.com/users/wezell/events{/privacy}","received_events_url":"https://api.github.com/users/wezell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-26T14:41:07Z","updated_at":"2015-01-26T14:41:07Z","closed_at":null,"body":"When I run a spider on the starter site, I am getting this all over the logs:\r\n```\r\n15-01-26 09:03:11,636 WARN  IntrusionDetector - [SECURITY FAILURE Anonymous:null@unknown -> /dotcms/IntrusionDetector] Invalid input: context=URLContext, type(HTTPParameterValue)=^[\\p{L}\\p{N}.\\-/+=_ !$*?@\\#,]{0,1000}$, input=Quick Picks & Lists\r\ncom.dotcms.repackage.org.owasp.esapi.errors.ValidationException: URLContext: Invalid input. Please conform to regex ^[\\p{L}\\p{N}.\\-/+=_ !$*?@\\#,]{0,1000}$ with a maximum length of 19\r\n\tat com.dotcms.repackage.org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:144)\r\n\tat com.dotcms.repackage.org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:160)\r\n\tat com.dotcms.repackage.org.owasp.esapi.reference.validation.StringValidationRule.getValid(StringValidationRule.java:284)\r\n\tat com.dotcms.repackage.org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:214)\r\n\tat com.dotcms.repackage.org.owasp.esapi.reference.DefaultValidator.isValidInput(DefaultValidator.java:152)\r\n\tat com.dotcms.repackage.org.owasp.esapi.reference.DefaultValidator.isValidInput(DefaultValidator.java:143)\r\n\tat com.liferay.util.Xss.URLHasXSS(Xss.java:184)\r\n\tat com.dotmarketing.viewtools.RequestWrapper.getParameter(RequestWrapper.java:199)\r\n\tat com.dotmarketing.viewtools.RequestWrapper.getParameter(RequestWrapper.java:198)\r\n```\r\n\r\nThe error, while verbose, does not provide enough information for the \"error\" to be traced down and  fixed.  We should at least spit out the page (and/or referer)  the error is found on."}}