Since Tomcat 5.5.22 I think there is a system property which can allow or disallow such encoded value, what about JBoss Web? Btw anyone can tell me how do I see which version of Tomcat is the base of JBoss Web in AS 4.2.1.GA?