Skip to content

2.6.1.0 release prep #879

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 18, 2025
Merged

2.6.1.0 release prep #879

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2f7885f
New release notes for ESAPI 2.6.1.0
kwwall May 18, 2025
14678f6
Env vars for new ESAPI version
kwwall May 18, 2025
2904144
Changes to replace manually created Developer Activity Report with a …
kwwall May 18, 2025
a34b00d
Changes for new release, 2.6.1.0
kwwall May 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
189 changes: 189 additions & 0 deletions documentation/esapi4java-core-2.6.1.0-release-notes.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,189 @@
Release notes for ESAPI 2.6.1.0
Release date: 2025-05-18
Project leaders:
-Kevin W. Wall <[email protected]>
-Matt Seil <[email protected]>

Previous release: ESAPI 2.6.0.0, 2024-11-25


Executive Summary: Important Things to Note for this Release
------------------------------------------------------------
This is a patch release with the primary intent of updating the AntiSamy dependency from v1.7.7 to v1.7.8. Among other fixes, AntiSamy 1.7.8 updated HttpClient 5.x to address CVE-2025-27820, which potentially could affect ESAPI users if they had customized their aAntiSamy Policy File (by default, antisamy-esapi.xml) to allow certain CSS constructs. (The default policy file does not allow CSS markup at all, and I don't believe that it would be exploitable via ESAPI.)


Notes if you are not updating from the immediate previous release. release 2.6.0.0:
* You need to read through the series of release notes FIRST, going in order.
* For example, if you were updating from an older ESAPI release (say, 2.3.0.0), you should go back and FIRST read all the subsequent release notes in turn. For instance, if you are currently on release 2.3.0.0 and upgrading to (say) release 2.x.y.z, you should MINIMALLY read the sections "Changes Requiring Special Attention" in each of the subsequent release notes. So, going from release 2.3.0.0 to 2.x.y.z, you should in turn, read:

esapi4java-core-2.4.0.0-release-notes.txt
esapi4java-core-2.5.0.0-release-notes.txt
esapi4java-core-2.5.1.0-release-notes.txt
esapi4java-core-2.5.2.0-release-notes.txt
...etc., up through the current set of release notes...
esapi4java-core-2.x.y.z-release-notes.txt

in that order. YOU HAVE BEEN WARNED!!! (These release notes are too large to put all this in a given document; very few read them thoroughly as it is.)

If your SCA tool is reporting any CVE from a direct or transitive dependency in ESAPI, before reporting it as an GitHub issue, please make sure that you review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md. Please email us or contact us in our GitHub Discussions page if you have questions about this. See also the SECURITY.md file to report any security issues with ESAPI.

You are encouraged to review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md and email us or contact us in our GitHub Discussions page if you have questions.


=================================================================================================================

Basic ESAPI facts
-----------------

ESAPI 2.6.0.0 release:
207 Java source files
4312 JUnit tests in 133 Java source files

ESAPI 2.6.1.0 release:
207 Java source files
4312 JUnit tests in 133 Java source files

9 GitHub Issues closed in this release, including those we've decided not to fix (marked 'wontfix' and 'falsepositive').
(Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D2024-11-25)

Issue # GitHub Issue Title
----------------------------------------------------------------------------------------------
204 DefalutValidator.isValidSafeHTML() doesn't work - bug, Component-Validator, imported, Milestone-Release2.2, Priority-Medium, wontfix
838 Getting org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException Encoder class (org.owasp.esapi.reference.DefaultEncoder) CTOR threw exception. - bug, wontfix
858 Fail to run Linux command with double quotes using executeSystemCommand - question, ConvertedToDiscussion
859 Remove deprecated Validator.isValidSafeHTML methods - bug (Note: fixed in previous release, 2.6.0.0)
863 2.6.0.0 still using javax HttpServletRequest - enhancement, falsepositive
867 How to turn off ESAPI logs or change its log level - question, ConvertedToDiscussion
868 Do not depend on commons-collections4 milestone (use 4.4 instead) - bug, Vulnerable Dependencies, wontfix
874 jakarta.servlet-api 5.0(Jakarta EE 9) change the package name from javax.xxx to jakarta.xxxx - enhancement, duplicate, NothingToFixHere
876 Upgrade version of antisamy to 1.7.8 to update transitive dependency affected by CVE-2025-27820 - enhancement, duplicate, NothingToFixHere

-----------------------------------------------------------------------------

Changes Requiring Special Attention

-----------------------------------------------------------------------------
Important JDK Support Announcement
* ESAPI 2.3.0.0 was the last Java release to support Java 7. ESAPI 2.4.0 requires using Java 8 or later. See the ESAPI 2.4.0.0 release notes (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.4.0.0-release-notes.txt) for details as to the reason.
- This means if your project requires Java 7, you must use ESAPI 2.3.0.0 or earlier.

Important ESAPI Logging Changes

* Since ESAPI 2.5.0.0, support for logging directly via Log4J 1 has been removed. (This was two years after it haveing first been deprecated.) Thus, you only choice of ESAPI logging are
- java.util.logging (JUL), which as been the default since ESAPI 2.2.1.0.
* Set ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory in your ESAPI.properties file.
- SLF4J (which your choice of supported SLF4J logging implemmentation)
* Set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in your ESAPI.properties file.
* Logger configuration notes - If you are migrating from prior to ESAPI 2.2.1.1, you will need to update your ESAPI.properties file as logging-related configuration as per the ESAPI 2.2.1.1 release notes, which may be found at:
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.2.1.1-release-notes.txt#L39-L78

If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the root cause if you still have your ESAPI.Logger property set to use Log4J because the org.owasp.esapi.logger.log4j.Log4JFactory class has been completely removed from the ESAPI jar. If you are dead set on continuing to use Log4J 1, you ought to be able to do so via SLF4J. The set up for Log4J 1 (which has not be tested), should be similar to configure ESAPI to use SLF4J with Log4J 2 as described here:
https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J#slf4j-using-log4j-2x

-----------------------------------------------------------------------------

Remaining Known Issues / Problems

-----------------------------------------------------------------------------
None known, other than the remaining open issues on GitHub.

-----------------------------------------------------------------------------

Other changes in this release, some of which not tracked via GitHub issues

-----------------------------------------------------------------------------

* Changes since last release 2.6.0.0 and 2.6.1.0, i.e., changes between 2025-11-25 and 2025-05-18.

Note: I am no longer going to provide the 'Developer Activity Report' that I used to this manually create in tabluar form. This is in part because I use to use 'mvn site' to assist with its creation, but neither the 'Developer Activiity' nor 'File Activity' sections of the 'mvn site' output is currently working.

That said, I don't care as this was always a major PITA and I think it had dubious value to start with.

Therefore, I am replacing it to a stock GitHub tag comparison of the current and previous release, which I can automate.

Please see,

https://github.com/ESAPI/esapi-java-legacy/compare/esapi-2.6.0.0...esapi-2.6.1.0

for details. It contains all the information that the previous 'Developer Activity Reports' did and then some.


CHANGELOG: Create your own. May I suggest:

git log --stat --since=2024-11-25 --reverse --pretty=medium

which will show all the commits since just after the previous (2.6.0.0) release.

Alternately, you can download the most recent ESAPI source and run

mvn site

which will create a CHANGELOG file named 'target/site/changelog.html'


-----------------------------------------------------------------------------

Direct and Transitive Runtime and Test Dependencies:

$ mvn -B dependency:tree
...
[INFO] --- maven-dependency-plugin:3.8.1:tree (default-cli) @ esapi ---
[INFO] org.owasp.esapi:esapi:jar:2.6.1.0
[INFO] +- javax.servlet:javax.servlet-api:jar:3.1.0:provided
[INFO] +- javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3:provided
[INFO] +- xom:xom:jar:1.3.9:compile
[INFO] +- commons-beanutils:commons-beanutils:jar:1.9.4:compile
[INFO] | +- commons-logging:commons-logging:jar:1.2:compile
[INFO] | \- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] +- commons-configuration:commons-configuration:jar:1.10:compile
[INFO] +- commons-lang:commons-lang:jar:2.6:compile
[INFO] +- commons-fileupload:commons-fileupload:jar:1.5:compile
[INFO] +- org.apache.commons:commons-collections4:jar:4.5.0-M2:compile
[INFO] +- org.apache-extras.beanshell:bsh:jar:2.0b6:compile
[INFO] +- org.owasp.antisamy:antisamy:jar:1.7.8:compile
[INFO] | +- commons-io:commons-io:jar:2.19.0:compile
[INFO] | +- org.apache.httpcomponents.client5:httpclient5:jar:5.4.4:compile
[INFO] | | \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.3.4:compile
[INFO] | +- org.apache.httpcomponents.core5:httpcore5:jar:5.3.4:compile
[INFO] | +- org.apache.xmlgraphics:batik-css:jar:1.19:compile
[INFO] | | +- org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile
[INFO] | | +- org.apache.xmlgraphics:batik-util:jar:1.19:compile
[INFO] | | | +- org.apache.xmlgraphics:batik-constants:jar:1.19:compile
[INFO] | | | \- org.apache.xmlgraphics:batik-i18n:jar:1.19:compile
[INFO] | | \- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile
[INFO] | +- org.htmlunit:neko-htmlunit:jar:4.11.0:compile
[INFO] | +- xerces:xercesImpl:jar:2.12.2:compile
[INFO] | \- xml-apis:xml-apis-ext:jar:1.3.04:compile
[INFO] +- org.slf4j:slf4j-api:jar:2.0.16:compile
[INFO] +- xml-apis:xml-apis:jar:1.4.01:compile
[INFO] +- com.github.spotbugs:spotbugs-annotations:jar:4.9.3:compile (optional)
[INFO] | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile (optional)
[INFO] +- commons-codec:commons-codec:jar:1.17.1:test
[INFO] +- junit:junit:jar:4.13.2:test
[INFO] +- org.bouncycastle:bcprov-jdk18on:jar:1.78.1:test
[INFO] +- org.hamcrest:hamcrest-core:jar:2.2:test
[INFO] | \- org.hamcrest:hamcrest:jar:2.2:test
[INFO] +- org.powermock:powermock-api-mockito2:jar:2.0.9:test
[INFO] | \- org.powermock:powermock-api-support:jar:2.0.9:test
[INFO] +- org.mockito:mockito-core:jar:3.12.4:test
[INFO] | +- net.bytebuddy:byte-buddy:jar:1.11.13:test
[INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test
[INFO] | \- org.objenesis:objenesis:jar:3.2:test
[INFO] +- org.powermock:powermock-core:jar:2.0.9:test
[INFO] | \- org.javassist:javassist:jar:3.27.0-GA:test
[INFO] +- org.powermock:powermock-module-junit4:jar:2.0.9:test
[INFO] | \- org.powermock:powermock-module-junit4-common:jar:2.0.9:test
[INFO] +- org.powermock:powermock-reflect:jar:2.0.9:test
[INFO] \- org.openjdk.jmh:jmh-core:jar:1.37:test
[INFO] +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:test
[INFO] \- org.apache.commons:commons-math3:jar:3.6.1:test
[INFO] ------------------------------------------------------------------------

-----------------------------------------------------------------------------

Acknowledgments:
A special thanks to the AntiSamy team in getting a new AntiSamy release out in short order. And thanks to Matt Seil, Jeremiah Stacey, and all the ESAPI users who make this worthwhile. This is for you.

A special thanks to the ESAPI community from the ESAPI project co-leaders:
Kevin W. Wall (kwwall) <== The irresponsible party for these release notes!
Matt Seil (xeno6696)
47 changes: 26 additions & 21 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<modelVersion>4.0.0</modelVersion>
<groupId>org.owasp.esapi</groupId>
<artifactId>esapi</artifactId>
<version>2.7.0.0-SNAPSHOT</version>
<version>2.6.1.0</version>
<packaging>jar</packaging>

<distributionManagement>
Expand Down Expand Up @@ -132,16 +132,16 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<version.jmh>1.37</version.jmh>
<version.findsecbugs>2.0.0-M3</version.findsecbugs>
<version.fluido>2.0.0-M11</version.fluido> <!-- 2.0.0 fails on 'mvn site', but this works. -->
<version.fluido>2.0.0-M11</version.fluido> <!-- Version 2.1.0 is available, but fails with this min Maven. -->
<version.powermock>2.0.9</version.powermock>
<version.spotbugs>4.8.6</version.spotbugs>
<version.spotbugs.maven>4.8.6.6</version.spotbugs.maven>
<version.surefire>3.5.2</version.surefire>
<version.spotbugs>4.9.3</version.spotbugs>
<version.spotbugs.maven>4.9.3.0</version.spotbugs.maven>
<version.surefire>3.5.3</version.surefire>
<project.java.target>1.8</project.java.target>
<!-- TODO: Be sure to update. Should be date of previous official release -->
<!-- Exact date in the form 'yyyy-dd-yy 00:00:00' should be used. You can find the previous release date -->
<!-- in the previous release notes file under the 'documentation/' directory. -->
<date.prev_release>2024-10-08 00:00:00</date.prev_release>
<date.prev_release>2024-11-25 00:00:00</date.prev_release>
</properties>

<dependencies>
Expand Down Expand Up @@ -408,7 +408,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<version>3.8.0</version>
<version>3.8.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
Expand All @@ -418,7 +418,7 @@
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>2.17.1</version>
<version>2.18.0</version>
<configuration>
<rulesUri>file:${project.basedir}/versionRuleset.xml</rulesUri>
</configuration>
Expand All @@ -431,7 +431,7 @@
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.8.2</version>
<version>2.9.1</version>
<executions>
<execution>
<phase>package</phase>
Expand Down Expand Up @@ -467,19 +467,24 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-changelog-plugin</artifactId>
<version>2.3</version>
<!-- 3.0.0-M1 is a "milestone" release, which is generally
to an alpha or beta release. Normally we would avoid
those, but generating a changelog is not an essential
task, so we're fine with this.
-->
<version>3.0.0-M1</version>
</plugin>

<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-clean-plugin</artifactId>
<version>3.4.0</version>
<version>3.4.1</version>
</plugin>

<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.13.0</version>
<version>3.14.0</version>
<configuration>
<source>${project.java.target}</source>
<target>${project.java.target}</target>
Expand Down Expand Up @@ -513,7 +518,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-deploy-plugin</artifactId>
<version>3.1.3</version>
<version>3.1.4</version>
</plugin>

<plugin>
Expand All @@ -533,7 +538,7 @@
<dependency>
<groupId>org.codehaus.mojo</groupId>
<artifactId>extra-enforcer-rules</artifactId>
<version>1.9.0</version>
<version>1.10.0</version>
</dependency>
<dependency>
<groupId>org.codehaus.mojo</groupId>
Expand Down Expand Up @@ -615,7 +620,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-install-plugin</artifactId>
<version>3.1.3</version>
<version>3.1.4</version>
</plugin>

<plugin>
Expand All @@ -635,7 +640,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.10.1</version>
<version>3.11.2</version>
<configuration>
<source>8</source>
<doclint>none</doclint>
Expand All @@ -653,19 +658,19 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jxr-plugin</artifactId>
<version>3.5.0</version>
<version>3.6.0</version>
</plugin>

<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
<version>3.25.0</version>
<version>3.26.0</version>
</plugin>

<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-project-info-reports-plugin</artifactId>
<version>3.7.0</version>
<version>3.9.0</version>
</plugin>

<plugin>
Expand Down Expand Up @@ -740,7 +745,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<!-- Version 11.x is the latest, but 10.0.4 is the latest that we can use beccause 11.x has a breaking
<!-- Version 12.x is the latest, but 10.0.4 is the latest that we can use beccause 11.x has a breaking
change that requires Java 11 or later and our mimimal JDK is Java 8.
-->
<version>10.0.4</version>
Expand Down Expand Up @@ -776,7 +781,7 @@
<issueLinkUrl>https://github.com/ESAPI/esapi-java-legacy/issues/%ISSUE%</issueLinkUrl>
<type>date</type>
<dates>
<!-- TODO: Be sure to update. Should be date of previous official release -->
<!-- TODO: Be sure to update. Should be date of 10revious official release -->
<!-- Exact date should be in previous release notes file under 'documentation/' directory. -->
<date>${date.prev_release}</date>
</dates>
Expand Down
Loading