I encountered this issue in Lucee 6.0.0.585 today. After server restart:

Type: org.owasp.esapi.errors.ConfigurationException
Message: java.lang.reflect.InvocationTargetException Encoder class (org.owasp.esapi.reference.DefaultEncoder) CTOR threw exception.
Detail: (ID:FA1C41F9-8B7B-422C-927ABE3CBD3E32DB)
Extended Info:
Tag Context: ...\loginform.cfm:145

Stopped/restarted the server and it magically worked again.

Also one of our customers reported this issue on Lucee 5.4.3.16, same code but other error message:

Open

@Scott O'Connell Thanks for your test, we have a ticket related to this canonicalize issue on esapi.https://luceeserver.atlassian.net/browse/LDEV-4743

I will chime in that we have just seen this error for the first time. We were having trouble with upgrading our Lucee version to 5.4.4.38. There seemed to be a bug in the latest ESAPI extension 2.2.4.15, and so we downgraded that to 2.2.4.13 but we see this error in both.

Not all strings throw it, however, this reliably reproduces the error for us.

I know that v is not a URL in this test, and when using ESAPIDecode('html', v) it works. Also using URLDecode(v)works, which is the solution we have.

Perhaps this will help you track down the error, even though I may be “using it wrong” in the above example.

PS: I don’t know if this is related or not, but the problem that caused us to downgrade the ESAPI extension was something else. It was that the canonicalize function was erroring. I haven’t found a ticket for this yet. With ESAPI extension version 2.2.4.15 this throws the error “URLDecoder: Incomplete trailing escape (%) pattern":

You can see this error in the lucee docs script runner as well but only engine 5

Thanks! I’ll give that a go

@Chris Duehrsen correct, I simply overwrote the files I had previously placed into “/lucee/tomcat/lib/” with those from the ESAPI extension GitHub. Your milage may vary. Just note this was done on a Development server that was rolled to test 5.3.9.141 against our services, and I cannot speak to wether those properties files are Production ready - only that by using them in my case they resolved those specific errors and allowed Lucee to function.