Heads-up: These two should have "*Requires Extension:* ESAPI extension" added to their details: • https://docs.lucee.org/reference/functions/canonicalize.html • https://docs.lucee.org/reference/functions/decodefromurl.html Both are implemented in that extension (see https://github.com/lucee/extension-esapi/tree/master/source/java/src/org/lucee/extension/esapi/functions) The option to add that flag is not available when editing the docs, otherwise would have done so myself. --- Second. The docs for https://github.com/lucee/extension-esapi/tree/master/source/java/src/org/lucee/extension/esapi/functions imply that these are part of the extension: • HTMLEditFormat • URLDecode • URLEncode • URLEncodedFormat They are not. Thanks to @Matt Jones for pointing me in the right direction to make sense of the various sources of info to derive these snags. --- Third. Could we get the full list (without those latter four) added more clearly for the docs for the extension itself. At the moment it simply links back to a docs page which is not specifically about the extension, just lists some OWASPish type functions (not all of which are in the extension, as per above). I can raise one or more Jira tickets if that's the best approach here?

diving in...

1. 👍 2. The readme.md in the GitHub project says:

Docs: https://docs.lucee.org/categories/esapi.html

That lists HTMLEditFormat, URLDecode, URLEncode, URLEncodedFormat Ergo the docs for the ESAPI extension implies HTMLEditFormat, URLDecode, URLEncode, URLEncodedFormat is part of it. They are not. 3. 👍

those two functions should self report as coming from an extension when we release the next version https://luceeserver.atlassian.net/browse/LDEV-4687 along the way I found two ghost function definitions https://luceeserver.atlassian.net/browse/LDEV-4686