Skip to content

Commit f185e5b

Browse files
kwwallkwwall
authored
Preparation for ESAPI release 2.6.0.0 (#860)
* Add more detailed, improved notes regarding CVE-2017-10355. * Update to support latest versions of dependencies and Maven plugins that ESAPI can support while still retaining Java 8 as the miminal JDK. * Revert from version 2.0.0 to 2.0.0-M11 for 'maven-fluido-skin', otherwise 'mvn site' fails. * Delete code referring to the previously deprecated Validator.isValidSafeHTML methods. This is wrap up GHSA-r68h-jhhj-9jvm. * Adjust release date so it agrees with Maven Central repository. Release was started on 10/7 but did not complete until after midnight. * Set previous release date in pom. * For release 2.6.0.0 info * Update to reference latest release, 2.6.0.0. * Release notes for ESAPI 2.6.0.0 release.
1 parent 0b0f86c commit f185e5b

File tree

11 files changed

+236
-264
lines changed

11 files changed

+236
-264
lines changed

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ specific Jakarta version of ESAPI, in Maven, you would specify your ESAPI depend
3030
<dependency>
3131
<groupId>org.owasp.esapi</groupId>
3232
<artifactId>esapi</artifactId>
33-
<version>2.5.5.0</version> <!-- Preferably the latest version, but > 2.5.3.0 -->
33+
<version>2.6.0.0</version> <!-- Preferably the latest version, but > 2.5.3.0 -->
3434
<classifier>jakarta</classifier>
3535
</dependency>
3636
```
@@ -105,7 +105,7 @@ link to the specific release notes.
105105
the ESAPI GitHub Discussion https://github.com/ESAPI/esapi-java-legacy/discussions/841.
106106

107107
# Locating ESAPI Jar files
108-
The [latest ESAPI release](https://github.com/ESAPI/esapi-java-legacy/releases/latest) is 2.5.4.0.
108+
The [latest ESAPI release](https://github.com/ESAPI/esapi-java-legacy/releases/latest) is 2.6.0.0.
109109
All the *regular* ESAPI jars, with the exception of the ESAPI configuration
110110
jar (i.e., esapi-2.#.#.#-configuration.jar) and its associated detached
111111
GPG signature, are available from Maven Central. The ESAPI configuration

‎documentation/esapi4java-core-2.6.0.0-release-notes.txt

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
Release notes for ESAPI 2.6.0.0
2+
Release date: 2024-11-25
3+
Project leaders:
4+
-Kevin W. Wall <kevin.w.wall@gmail.com>
5+
-Matt Seil <matt.seil@owasp.org>
6+
7+
Previous release: ESAPI 2.5.5.0, 2024-10-08
8+
9+
10+
Executive Summary: Important Things to Note for this Release
11+
------------------------------------------------------------
12+
This ESAPI release removes the Validator.isValidSafeHTML methods and references to it from ESAPI code. We will NOT be replacing it. This is to fulfill GitHub Security Advisory https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-r68h-jhhj-9jvm and GitHub issue #859.
13+
14+
ESAPI was also updated to use the latest version of AntiSamy, 1.7.7.
15+
16+
Notes if you are not updating from the immediate previous release. release 2.5.5.0:
17+
* You need to read through the series of release notes FIRST, going in order.
18+
* For example, if you were updating from an older ESAPI release (say, 2.3.0.0), you should go back and FIRST read all the subsequent release notes in turn. For instance, if you are currently on release 2.3.0.0 and upgrading to (say) release 2.x.y.z, you should MINIMALLY read the sections "Changes Requiring Special Attention" in each of the subsequent release notes. So, going from release 2.3.0.0 to 2.x.y.z, you should in turn, read:
19+
20+
esapi4java-core-2.4.0.0-release-notes.txt
21+
esapi4java-core-2.5.0.0-release-notes.txt
22+
esapi4java-core-2.5.1.0-release-notes.txt
23+
esapi4java-core-2.5.2.0-release-notes.txt
24+
...etc., up through the current set of release notes...
25+
esapi4java-core-2.x.y.z-release-notes.txt
26+
27+
in that order. YOU HAVE BEEN WARNED!!! (These release notes are too large to put all this in a given document; very few read them thoroughly as it is.)
28+
29+
If your SCA tool is reporting any CVE from a direct or transitive dependency in ESAPI, before reporting it as an GitHub issue, please make sure that you review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md. Please email us or contact us in our GitHub Discussions page if you have questions about this. See also the SECURITY.md file to report any security issues with ESAPI.
30+
31+
You are encouraged to review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md and email us or contact us in our GitHub Discussions page if you have questions.
32+
33+
34+
=================================================================================================================
35+
36+
Basic ESAPI facts
37+
-----------------
38+
39+
ESAPI 2.5.5.0 release:
40+
207 Java source files
41+
4297 JUnit tests in 131 Java test files
42+
43+
ESAPI 2.6.0.0 release:
44+
207 Java source files
45+
4312 JUnit tests in 133 Java source files
46+
47+
2 GitHub Issues closed in this release, including those we've decided not to fix (marked 'wontfix' and 'falsepositive').
48+
(Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D2024-10-08)
49+
50+
Issue # GitHub Issue Title
51+
----------------------------------------------------------------------------------------------
52+
204 DefalutValidator.isValidSafeHTML() doesn't work (wontfix)
53+
859 Remove deprecated Validator.isValidSafeHTML methods
54+
-----------------------------------------------------------------------------
55+
56+
Changes Requiring Special Attention
57+
58+
-----------------------------------------------------------------------------
59+
Breaking Change - deprecated methods removed
60+
* As of 2.6.0.0, the methods Validator.isValidSafeHTML are deleted. We won't be bring them back. See https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-r68h-jhhj-9jvm and the associated Security Bulletin for details.
61+
62+
Important JDK Support Announcement
63+
* ESAPI 2.3.0.0 was the last Java release to support Java 7. ESAPI 2.4.0 requires using Java 8 or later. See the ESAPI 2.4.0.0 release notes (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.4.0.0-release-notes.txt) for details as to the reason.
64+
- This means if your project requires Java 7, you must use ESAPI 2.3.0.0 or earlier.
65+
66+
Important ESAPI Logging Changes
67+
68+
* Since ESAPI 2.5.0.0, support for logging directly via Log4J 1 has been removed. (This was two years after it haveing first been deprecated.) Thus, you only choice of ESAPI logging are
69+
- java.util.logging (JUL), which as been the default since ESAPI 2.2.1.0.
70+
* Set ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory in your ESAPI.properties file.
71+
- SLF4J (which your choice of supported SLF4J logging implemmentation)
72+
* Set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in your ESAPI.properties file.
73+
* Logger configuration notes - If you are migrating from prior to ESAPI 2.2.1.1, you will need to update your ESAPI.properties file as logging-related configuration as per the ESAPI 2.2.1.1 release notes, which may be found at:
74+
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.2.1.1-release-notes.txt#L39-L78
75+
76+
If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the root cause if you still have your ESAPI.Logger property set to use Log4J because the org.owasp.esapi.logger.log4j.Log4JFactory class has been completely removed from the ESAPI jar. If you are dead set on continuing to use Log4J 1, you ought to be able to do so via SLF4J. The set up for Log4J 1 (which has not be tested), should be similar to configure ESAPI to use SLF4J with Log4J 2 as described here:
77+
https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J#slf4j-using-log4j-2x
78+
79+
-----------------------------------------------------------------------------
80+
81+
Remaining Known Issues / Problems
82+
83+
-----------------------------------------------------------------------------
84+
None known, other than the remaining open issues on GitHub.
85+
86+
-----------------------------------------------------------------------------
87+
88+
Other changes in this release, some of which not tracked via GitHub issues
89+
90+
-----------------------------------------------------------------------------
91+
92+
* Minor updates to README.md file with respect to version information.
93+
94+
-----------------------------------------------------------------------------
95+
96+
Developer Activity Report (Changes between release 2.5.5.0 and 2.6.0.0, i.e., between 2024-10-08 and 2024-11-25)
97+
Generated manually (this time) -- all errors are the fault of kwwall and his inability to do simple arithmetic.
98+
Figures do not include rejected PRs.
99+
100+
Developer Total Total Number # Merged
101+
(GitHub ID) commits of Files Changed PRs
102+
========================================================
103+
kwwall 12 11 1
104+
========================================================
105+
Total PRs: 1
106+
107+
-----------------------------------------------------------------------------
108+
109+
CHANGELOG: Create your own. May I suggest:
110+
111+
git log --stat --since=2024-10-08 --reverse --pretty=medium
112+
113+
which will show all the commits since just after the previous (2.5.5.0) release.
114+
115+
Alternately, you can download the most recent ESAPI source and run
116+
117+
mvn site
118+
119+
which will create a CHANGELOG file named 'target/site/changelog.html'
120+
121+
122+
-----------------------------------------------------------------------------
123+
124+
Direct and Transitive Runtime and Test Dependencies:
125+
126+
$ mvn -B dependency:tree
127+
...
128+
[INFO] --- maven-dependency-plugin:3.8.0:tree (default-cli) @ esapi ---
129+
[INFO] org.owasp.esapi:esapi:jar:2.6.0.0-SNAPSHOT
130+
[INFO] +- javax.servlet:javax.servlet-api:jar:3.1.0:provided
131+
[INFO] +- javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3:provided
132+
[INFO] +- xom:xom:jar:1.3.9:compile
133+
[INFO] +- commons-beanutils:commons-beanutils:jar:1.9.4:compile
134+
[INFO] | +- commons-logging:commons-logging:jar:1.2:compile
135+
[INFO] | \- commons-collections:commons-collections:jar:3.2.2:compile
136+
[INFO] +- commons-configuration:commons-configuration:jar:1.10:compile
137+
[INFO] +- commons-lang:commons-lang:jar:2.6:compile
138+
[INFO] +- commons-fileupload:commons-fileupload:jar:1.5:compile
139+
[INFO] +- org.apache.commons:commons-collections4:jar:4.5.0-M2:compile
140+
[INFO] +- org.apache-extras.beanshell:bsh:jar:2.0b6:compile
141+
[INFO] +- org.owasp.antisamy:antisamy:jar:1.7.7:compile
142+
[INFO] | +- commons-io:commons-io:jar:2.18.0:compile
143+
[INFO] | +- org.apache.httpcomponents.client5:httpclient5:jar:5.4.1:compile
144+
[INFO] | | \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.3.1:compile
145+
[INFO] | +- org.apache.httpcomponents.core5:httpcore5:jar:5.3.1:compile
146+
[INFO] | +- org.apache.xmlgraphics:batik-css:jar:1.18:compile
147+
[INFO] | | +- org.apache.xmlgraphics:batik-shared-resources:jar:1.18:compile
148+
[INFO] | | +- org.apache.xmlgraphics:batik-util:jar:1.18:compile
149+
[INFO] | | | +- org.apache.xmlgraphics:batik-constants:jar:1.18:compile
150+
[INFO] | | | \- org.apache.xmlgraphics:batik-i18n:jar:1.18:compile
151+
[INFO] | | \- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.10:compile
152+
[INFO] | +- org.htmlunit:neko-htmlunit:jar:4.6.0:compile
153+
[INFO] | +- xerces:xercesImpl:jar:2.12.2:compile
154+
[INFO] | \- xml-apis:xml-apis-ext:jar:1.3.04:compile
155+
[INFO] +- org.slf4j:slf4j-api:jar:2.0.16:compile
156+
[INFO] +- xml-apis:xml-apis:jar:1.4.01:compile
157+
[INFO] +- com.github.spotbugs:spotbugs-annotations:jar:4.8.6:compile (optional)
158+
[INFO] | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile (optional)
159+
[INFO] +- commons-codec:commons-codec:jar:1.17.1:test
160+
[INFO] +- junit:junit:jar:4.13.2:test
161+
[INFO] +- org.bouncycastle:bcprov-jdk18on:jar:1.78.1:test
162+
[INFO] +- org.hamcrest:hamcrest-core:jar:2.2:test
163+
[INFO] | \- org.hamcrest:hamcrest:jar:2.2:test
164+
[INFO] +- org.powermock:powermock-api-mockito2:jar:2.0.9:test
165+
[INFO] | \- org.powermock:powermock-api-support:jar:2.0.9:test
166+
[INFO] +- org.mockito:mockito-core:jar:3.12.4:test
167+
[INFO] | +- net.bytebuddy:byte-buddy:jar:1.11.13:test
168+
[INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test
169+
[INFO] | \- org.objenesis:objenesis:jar:3.2:test
170+
[INFO] +- org.powermock:powermock-core:jar:2.0.9:test
171+
[INFO] | \- org.javassist:javassist:jar:3.27.0-GA:test
172+
[INFO] +- org.powermock:powermock-module-junit4:jar:2.0.9:test
173+
[INFO] | \- org.powermock:powermock-module-junit4-common:jar:2.0.9:test
174+
[INFO] +- org.powermock:powermock-reflect:jar:2.0.9:test
175+
[INFO] \- org.openjdk.jmh:jmh-core:jar:1.37:test
176+
[INFO] +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:test
177+
[INFO] \- org.apache.commons:commons-math3:jar:3.6.1:test
178+
[INFO] ------------------------------------------------------------------------
179+
[INFO] BUILD SUCCESS
180+
[INFO] ------------------------------------------------------------------------
181+
[INFO] Total time: 0.884 s
182+
[INFO] Finished at: 2024-11-25T15:35:40-05:00
183+
[INFO] ------------------------------------------------------------------------
184+
185+
-----------------------------------------------------------------------------
186+
187+
Acknowledgments:
188+
Another hat tip to Dave Wichers and the AntiSamy crew for promptly releasing AntiSamy 1.7.7. And thanks to Matt Seil, Jeremiah Stacey, and all the ESAPI users who make this worthwhile. This is for you.
189+
190+
A special thanks to the ESAPI community from the ESAPI project co-leaders:
191+
Kevin W. Wall (kwwall) <== The irresponsible party for these release notes!
192+
Matt Seil (xeno6696)

‎pom.xml

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -132,16 +132,16 @@
132132
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
133133
<version.jmh>1.37</version.jmh>
134134
<version.findsecbugs>2.0.0-M3</version.findsecbugs>
135-
<version.fluido>2.0.0-M11</version.fluido>
135+
<version.fluido>2.0.0-M11</version.fluido> <!-- 2.0.0 fails on 'mvn site', but this works. -->
136136
<version.powermock>2.0.9</version.powermock>
137137
<version.spotbugs>4.8.6</version.spotbugs>
138-
<version.spotbugs.maven>4.8.6.4</version.spotbugs.maven>
139-
<version.surefire>3.5.1</version.surefire>
138+
<version.spotbugs.maven>4.8.6.6</version.spotbugs.maven>
139+
<version.surefire>3.5.2</version.surefire>
140140
<project.java.target>1.8</project.java.target>
141141
<!-- TODO: Be sure to update. Should be date of previous official release -->
142142
<!-- Exact date in the form 'yyyy-dd-yy 00:00:00' should be used. You can find the previous release date -->
143143
<!-- in the previous release notes file under the 'documentation/' directory. -->
144-
<date.prev_release>2024-05-30 00:00:00</date.prev_release>
144+
<date.prev_release>2024-10-08 00:00:00</date.prev_release>
145145
</properties>
146146

147147
<dependencies>
@@ -243,7 +243,7 @@
243243
<dependency>
244244
<groupId>org.owasp.antisamy</groupId>
245245
<artifactId>antisamy</artifactId>
246-
<version>1.7.6</version>
246+
<version>1.7.7</version>
247247
<exclusions>
248248
<!-- excluded because we directly import newer version below. -->
249249
<exclusion>
@@ -740,6 +740,9 @@
740740
<plugin>
741741
<groupId>org.owasp</groupId>
742742
<artifactId>dependency-check-maven</artifactId>
743+
<!-- Version 11.x is the latest, but 10.0.4 is the latest that we can use beccause 11.x has a breaking
744+
change that requires Java 11 or later and our mimimal JDK is Java 8.
745+
-->
743746
<version>10.0.4</version>
744747
<configuration>
745748
<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
@@ -949,7 +952,7 @@
949952
<plugin>
950953
<groupId>org.eclipse.transformer</groupId>
951954
<artifactId>transformer-maven-plugin</artifactId>
952-
<version>0.5.0</version>
955+
<version>0.5.0</version> <!-- 1.0.0 is available, but requires newer JDK than ESAPI minimum. -->
953956
<extensions>true</extensions>
954957
<configuration>
955958
<rules>

‎scripts/vars.2.5.5.0

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ VERSION=2.5.5.0
88
PREV_VERSION=2.5.4.0
99

1010
# Release date of current version in yyyy-mm-dd format
11-
YYYY_MM_DD_RELEASE_DATE=2024-10-07
11+
YYYY_MM_DD_RELEASE_DATE=2024-10-08
1212

1313
# Previous ESAPI release date in same format
1414
PREV_RELEASE_DATE=2024-05-30

‎scripts/vars.2.6.0.0

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Do NOT edit this file directly. It will be created by the new createVarsFile.sh script,
2+
# which should be run prior to the newReleaseNotes.sh script.
3+
4+
# ESAPI (new / current) version
5+
VERSION=2.6.0.0
6+
7+
# Previous ESAPI version
8+
PREV_VERSION=2.5.5.0
9+
10+
# Release date of current version in yyyy-mm-dd format
11+
YYYY_MM_DD_RELEASE_DATE=2024-11-25
12+
13+
# Previous ESAPI release date in same format
14+
PREV_RELEASE_DATE=2024-10-08

0 commit comments

Comments
 (0)