SA-23349

Summary

User upgraded from PRPC 6.2 SP2 to Pega 7.1.8. The application has an activity that uses @getRuleMessage to use a message rule with a parameter:

@getRuleMessage(tools, "(TSK-000026) ") 

Function getRuleMessage does not work with parameter. 

Error Messages

Not Applicable

Steps to Reproduce

In PRPC 6.2 SP2: 
1. Create a getRuleMessage, which has the name beginning with a special character, for example, (abcd). 
2. Create an activity that uses @getRuleMessage to use a message rule with a parameter. 
3. Create a product rule of the application.

In Pega 7.1.8: 
1. Import the product rule. 
2. Run the activity, and observe the error in the tracer "** (abcd)." The naming convention in Pega 7.1.8, does not allow identifiers to begin with special characters.

Root Cause

1. (a) The getRuleMessage() in PRPC 6.2 SP2 has the following Java code: 
return tools.getRuleMessage(messageKey); 
(b) The same rule in Pega 7.1.8 has the following java code:
tools.getRuleMessage(StringUtils.crossScriptingFilter(messageKey)); 

2. In PRPC 6.2 SP2, the pyMessageName/ID contains spaces or accepts special characters as part of it, but in Pega 7.1.8 identifier/pyMessageName does not accept special characters.

Resolution

Removing the XSS filtering leads to XSS attacks. Each getRuleMessage with special characters must be resaved.