From f1af8031c2e6ae15c68df55a05830daadf8fcaa4 Mon Sep 17 00:00:00 2001 From: Mike Samuel Date: Sat, 23 Mar 2024 00:35:54 -0600 Subject: [PATCH] Shim Java 10 collections APIs This commit adds Maven `` to the parent POM and two small sub-modules: java8-shim and java10-shim. Java8-shim defines an interface with methods like `.listCopyOf` corresponding to Java 10's `java.util.List.copyOf`. On Java 8-9, those APIs delegate to a homegrown equivalent. On Java 10 and later, those APIs just call out to the standard library functions. I did the following experiment to see how well this JIT inlines. The trace far below is derived by adding the main method below to Java8Shim and running the command line second from bottom ```java @Override public void main(String... argv) { List> ls = new ArrayList<>(); for (int i = 0; i < 10000000; ++i) { ls.add(get().listOf(i, i + 1, i + 2)); } } ``` Getting JIT diagnostics: ```sh javac --release 8 -d out src/main/java/org/owasp/shim/Java8Shim.java \ src/main/java/org/owasp/shim/ForJava8.java javac --release 10 -d out -cp out \ src/main/java/org/owasp/shim/ForJava9AndLater.java java -cp out \ -XX:+UnlockDiagnosticVMOptions \ -XX:CompileCommand=print,org/owasp/shim/ForJava9AndLater.listOf \ org.owasp.shim.Java8Shim ```
Dump with -XX:CompileCommand=print ``` 0x00000001144e9380: ; ImmutableOopMap {rbp=Oop [0]=Oop [8]=Oop } ;*anewarray {reexecute=0 rethrow=0 return_oop=1} ; - java.util.List::of@1 (line 847) ; - org.owasp.shim.ForJava9AndLater::listOf@3 (line 21) 0x00000001144e9380: fc83 9bff | 488b d8e9 | 27ff ffff 0x00000001144e938c: ; {metadata('java/util/ImmutableCollections$ListN')} 0x00000001144e938c: 48be 2807 | 1b44 0100 | 0000 488b 0x00000001144e9398: ; {runtime_call _new_instance_Java} 0x00000001144e9398: eb66 90e8 0x00000001144e939c: ; ImmutableOopMap {rbp=Oop [8]=Oop } ;*new {reexecute=0 rethrow=0 return_oop=1} ; - java.util.ImmutableCollections::listFromTrustedArray@115 (line 220) ; - java.util.List::of@16 (line 847) ; - org.owasp.shim.ForJava9AndLater::listOf@3 (line 21) 0x00000001144e939c: 60ad 9bff | ebac bd01 | 0000 004c | 8bc9 eb05 | bd02 0000 | 004c 890c | 24eb 0633 | ed4c 8914 0x00000001144e93bc: 24be 45ff 0x00000001144e93c0: ; {runtime_call UncommonTrapBlob} 0x00000001144e93c0: ffff 90e8 0x00000001144e93c4: ; ImmutableOopMap {[0]=Oop [8]=Oop } ;*ifnonnull {reexecute=1 rethrow=0 return_oop=0} ; - (reexecute) java.util.Objects::requireNonNull@1 (line 208) ; - java.util.ImmutableCollections::listFromTrustedArray@42 (line 213) ; - java.util.List::of@16 (line 847) ; - org.owasp.shim.ForJava9AndLater::listOf@3 (line 21) 0x00000001144e93c4: 3842 91ff | 488b f0eb | 0348 8bf0 | 4883 c430 0x00000001144e93d4: ; {runtime_call _rethrow_Java} 0x00000001144e93d4: 5de9 26b0 0x00000001144e93d8: ; {internal_word} 0x00000001144e93d8: 9bff 49ba | 6093 4e14 | 0100 0000 | 4d89 9760 0x00000001144e93e8: ; {runtime_call SafepointBlob} 0x00000001144e93e8: 0300 00e9 | 1053 91ff | f4f4 f4f4 | f4f4 f4f4 | f4f4 f4f4 | f4f4 f4f4 [Exception Handler] 0x00000001144e9400: ; {no_reloc} 0x00000001144e9400: e97b f59a | ffe8 0000 | 0000 4883 0x00000001144e940c: ; {runtime_call DeoptimizationBlob} 0x00000001144e940c: 2c24 05e9 | 8c45 91ff | f4f4 f4f4 [/MachCode] ``` iiuc, when there is one implementation of an interface loaded, the interface methods can devirtualize and the below shows that ForJava9AndLater::listOf with 3 arguments inlines to a null check and delegates the rest to `listFromTrustedArray`. ``` 0x00000001144e93c4: ; ImmutableOopMap {[0]=Oop [8]=Oop } ;*ifnonnull {reexecute=1 rethrow=0 return_oop=0} ; - (reexecute) java.util.Objects::requireNonNull@1 (line 208) ; - java.util.ImmutableCollections::listFromTrustedArray@42 (line 213) ; - java.util.List::of@16 (line 847) ; - org.owasp.shim.ForJava9AndLater::listOf@3 (line 21) ``` Signed-off-by: Mike Samuel --- aggregate/pom.xml | 7 +- empiricism/pom.xml | 2 +- html-types/pom.xml | 2 +- java10-shim/pom.xml | 41 ++ .../java/org/owasp/shim/ForJava9AndLater.java | 67 +++ java8-shim/pom.xml | 38 ++ .../main/java/org/owasp/shim/ForJava8.java | 256 +++++++++++ .../main/java/org/owasp/shim/Java8Shim.java | 106 +++++ owasp-java-html-sanitizer/pom.xml | 154 +++++++ .../java/org/owasp/html/AttributePolicy.java | 0 .../main/java/org/owasp/html/CssGrammar.java | 0 .../main/java/org/owasp/html/CssSchema.java | 219 +++++----- .../main/java/org/owasp/html/CssTokens.java | 54 +-- .../html/ElementAndAttributePolicies.java | 10 +- ...ndAttributePolicyBasedSanitizerPolicy.java | 8 +- .../java/org/owasp/html/ElementPolicy.java | 0 .../main/java/org/owasp/html/Encoding.java | 0 .../FilterUrlByProtocolAttributePolicy.java | 0 .../main/java/org/owasp/html/Handler.java | 2 +- .../org/owasp/html/HtmlChangeListener.java | 0 .../org/owasp/html/HtmlChangeReporter.java | 0 .../org/owasp/html/HtmlElementTables.java | 9 +- .../owasp/html/HtmlElementTablesCanned.java | 0 .../java/org/owasp/html/HtmlEntities.java | 0 .../main/java/org/owasp/html/HtmlLexer.java | 8 +- .../org/owasp/html/HtmlPolicyBuilder.java | 32 +- .../java/org/owasp/html/HtmlSanitizer.java | 0 .../owasp/html/HtmlStreamEventProcessor.java | 0 .../owasp/html/HtmlStreamEventReceiver.java | 0 .../html/HtmlStreamEventReceiverWrapper.java | 0 .../org/owasp/html/HtmlStreamRenderer.java | 4 +- .../java/org/owasp/html/HtmlTagSkipType.java | 0 .../org/owasp/html/HtmlTextEscapingMode.java | 57 +-- .../main/java/org/owasp/html/HtmlToken.java | 0 .../java/org/owasp/html/HtmlTokenType.java | 0 .../main/java/org/owasp/html/IntVector.java | 0 .../main/java/org/owasp/html/Joinable.java | 0 .../org/owasp/html/JoinedAttributePolicy.java | 0 .../java/org/owasp/html/PolicyFactory.java | 0 .../main/java/org/owasp/html/Sanitizers.java | 0 .../org/owasp/html/SrcsetAttributePolicy.java | 0 .../html/StandardUrlAttributePolicy.java | 0 .../main/java/org/owasp/html/Strings.java | 0 .../java/org/owasp/html/StylingPolicy.java | 0 .../src}/main/java/org/owasp/html/TCB.java | 0 .../TagBalancingHtmlStreamEventReceiver.java | 18 +- .../main/java/org/owasp/html/TokenStream.java | 0 .../src}/main/java/org/owasp/html/Trie.java | 0 .../html/examples/EbayPolicyExample.java | 0 .../html/examples/SlashdotPolicyExample.java | 0 .../owasp/html/examples/UrlTextExample.java | 0 .../java/org/owasp/html/package-info.java | 0 .../test/java/org/owasp/html/AllExamples.java | 0 .../org/owasp/html/AntiSamyBenchmark.java | 0 .../java/org/owasp/html/AntiSamyTest.java | 0 .../test/java/org/owasp/html/Benchmark.java | 2 +- .../java/org/owasp/html/CssFuzzerTest.java | 0 .../java/org/owasp/html/CssGrammarTest.java | 0 .../java/org/owasp/html/CssSchemaTest.java | 0 .../java/org/owasp/html/CssTokensTest.java | 0 .../org/owasp/html/ElementPolicyTest.java | 5 +- .../java/org/owasp/html/EncodingTest.java | 0 .../java/org/owasp/html/ExamplesTest.java | 0 .../java/org/owasp/html/FuzzyTestCase.java | 0 .../owasp/html/HtmlChangeReporterTest.java | 4 +- .../org/owasp/html/HtmlElementTablesTest.java | 0 .../java/org/owasp/html/HtmlLexerTest.java | 0 .../html/HtmlPolicyBuilderFuzzerTest.java | 0 .../org/owasp/html/HtmlPolicyBuilderTest.java | 284 ++++++------ .../owasp/html/HtmlSanitizerFuzzerTest.java | 0 .../org/owasp/html/HtmlSanitizerTest.java | 0 .../owasp/html/HtmlStreamRendererTest.java | 66 +-- .../java/org/owasp/html/IntVectorTest.java | 0 .../org/owasp/html/PolicyFactoryTest.java | 6 +- .../java/org/owasp/html/SanitizersTest.java | 2 +- .../test/java/org/owasp/html/StringsTest.java | 0 .../org/owasp/html/StylingPolicyTest.java | 0 .../TagBalancingHtmlStreamRendererTest.java | 179 ++++---- .../org/owasp/html/UrlTextExampleTest.java | 0 .../org/owasp/html/VerboseTestRunner.java | 0 .../test/resources/benchmark-data/Yahoo!.html | 0 .../org/owasp/html/htmllexergolden1.txt | 0 .../org/owasp/html/htmllexerinput1.html | 0 .../osgi-integration-verification.xml | 0 parent/pom.xml | 301 ------------- pom.xml | 403 +++++++++++++----- 86 files changed, 1457 insertions(+), 889 deletions(-) create mode 100644 java10-shim/pom.xml create mode 100644 java10-shim/src/main/java/org/owasp/shim/ForJava9AndLater.java create mode 100644 java8-shim/pom.xml create mode 100644 java8-shim/src/main/java/org/owasp/shim/ForJava8.java create mode 100644 java8-shim/src/main/java/org/owasp/shim/Java8Shim.java create mode 100644 owasp-java-html-sanitizer/pom.xml rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/AttributePolicy.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/CssGrammar.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/CssSchema.java (86%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/CssTokens.java (97%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/ElementAndAttributePolicies.java (95%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java (97%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/ElementPolicy.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/Encoding.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/FilterUrlByProtocolAttributePolicy.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/Handler.java (96%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlChangeListener.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlChangeReporter.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlElementTables.java (99%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlElementTablesCanned.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlEntities.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlLexer.java (99%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlPolicyBuilder.java (98%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlSanitizer.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlStreamEventProcessor.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlStreamEventReceiver.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlStreamEventReceiverWrapper.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlStreamRenderer.java (99%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlTagSkipType.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlTextEscapingMode.java (81%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlToken.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/HtmlTokenType.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/IntVector.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/Joinable.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/JoinedAttributePolicy.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/PolicyFactory.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/Sanitizers.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/SrcsetAttributePolicy.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/StandardUrlAttributePolicy.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/Strings.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/StylingPolicy.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/TCB.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java (97%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/TokenStream.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/Trie.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/examples/EbayPolicyExample.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/examples/SlashdotPolicyExample.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/examples/UrlTextExample.java (100%) rename {src => owasp-java-html-sanitizer/src}/main/java/org/owasp/html/package-info.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/AllExamples.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/AntiSamyBenchmark.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/AntiSamyTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/Benchmark.java (99%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/CssFuzzerTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/CssGrammarTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/CssSchemaTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/CssTokensTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/ElementPolicyTest.java (94%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/EncodingTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/ExamplesTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/FuzzyTestCase.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlChangeReporterTest.java (98%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlElementTablesTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlLexerTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlPolicyBuilderFuzzerTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlPolicyBuilderTest.java (86%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlSanitizerFuzzerTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlSanitizerTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/HtmlStreamRendererTest.java (90%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/IntVectorTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/PolicyFactoryTest.java (99%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/SanitizersTest.java (99%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/StringsTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/StylingPolicyTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java (77%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/UrlTextExampleTest.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/java/org/owasp/html/VerboseTestRunner.java (100%) rename {src => owasp-java-html-sanitizer/src}/test/resources/benchmark-data/Yahoo!.html (100%) rename {src => owasp-java-html-sanitizer/src}/test/resources/org/owasp/html/htmllexergolden1.txt (100%) rename {src => owasp-java-html-sanitizer/src}/test/resources/org/owasp/html/htmllexerinput1.html (100%) rename {src => owasp-java-html-sanitizer/src}/test/resources/osgi-integration-verification.xml (100%) delete mode 100644 parent/pom.xml diff --git a/aggregate/pom.xml b/aggregate/pom.xml index 1fc1a84e..6da5ee89 100644 --- a/aggregate/pom.xml +++ b/aggregate/pom.xml @@ -5,7 +5,7 @@ pom 20220608.2-SNAPSHOT - ../parent + .. com.googlecode.owasp-java-html-sanitizer parent 20220608.2-SNAPSHOT @@ -13,7 +13,8 @@ .. - ../html-types - ../parent + ../java8-shim + ../java10-shim + ../owasp-java-html-sanitizer diff --git a/empiricism/pom.xml b/empiricism/pom.xml index 2a5d1c8f..0679df4b 100644 --- a/empiricism/pom.xml +++ b/empiricism/pom.xml @@ -5,7 +5,7 @@ 20220608.2-SNAPSHOT jar - ../parent + .. com.googlecode.owasp-java-html-sanitizer parent 20220608.2-SNAPSHOT diff --git a/html-types/pom.xml b/html-types/pom.xml index 97f9eb19..c3fdcc79 100644 --- a/html-types/pom.xml +++ b/html-types/pom.xml @@ -5,7 +5,7 @@ 20220608.2-SNAPSHOT bundle - ../parent + .. com.googlecode.owasp-java-html-sanitizer parent 20220608.2-SNAPSHOT diff --git a/java10-shim/pom.xml b/java10-shim/pom.xml new file mode 100644 index 00000000..21b96c35 --- /dev/null +++ b/java10-shim/pom.xml @@ -0,0 +1,41 @@ + + 4.0.0 + java10-shim + jar + + .. + com.googlecode.owasp-java-html-sanitizer + parent + 20220608.2-SNAPSHOT + + + Java 10 Shim + + Provides an implementation of java8-shim that interoperates with + Java >= 10 idioms for immutable collections. + + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 10 + + + + + + + + com.googlecode.owasp-java-html-sanitizer + java8-shim + + + junit + junit + test + + + diff --git a/java10-shim/src/main/java/org/owasp/shim/ForJava9AndLater.java b/java10-shim/src/main/java/org/owasp/shim/ForJava9AndLater.java new file mode 100644 index 00000000..78de9746 --- /dev/null +++ b/java10-shim/src/main/java/org/owasp/shim/ForJava9AndLater.java @@ -0,0 +1,67 @@ +package org.owasp.shim; + +import java.util.*; + +@SuppressWarnings("Since15") // We're compiling two versions to handle @since problems. +final class ForJava9AndLater extends Java8Shim { + + @Override public List listOf() { + return List.of(); + } + + @Override public List listOf(T a) { + return List.of(a); + } + + @Override public List listOf(T a, T b) { + return List.of(a, b); + } + + @Override public List listOf(T a, T b, T c) { + return List.of(a, b, c); + } + + @Override public List listOf(T... els) { + return List.of(els); + } + + @Override public List listCopyOf(Collection c) { + return List.copyOf(c); + } + + @Override public Map mapCopyOf(Map m) { + return Map.copyOf(m); + } + + @Override public Map.Entry mapEntry(K key, V value) { + return Map.entry(key, value); + } + + @Override public Map mapOfEntries(Map.Entry... entries) { + return Map.ofEntries(entries); + } + + @Override public Set setOf() { + return Set.of(); + } + + @Override public Set setOf(T a) { + return Set.of(a); + } + + @Override public Set setOf(T a, T b) { + return Set.of(a, b); + } + + @Override public Set setOf(T a, T b, T c) { + return Set.of(a, b, c); + } + + @Override public Set setOf(T... els) { + return Set.of(els); + } + + @Override public Set setCopyOf(Collection c) { + return Set.copyOf(c); + } +} diff --git a/java8-shim/pom.xml b/java8-shim/pom.xml new file mode 100644 index 00000000..c414253b --- /dev/null +++ b/java8-shim/pom.xml @@ -0,0 +1,38 @@ + + 4.0.0 + java8-shim + jar + + .. + com.googlecode.owasp-java-html-sanitizer + parent + 20220608.2-SNAPSHOT + + + Java 8 Shim + + Backports @since Java 9 collection factories like List.of onto + Java8 in a way that uses the real ones where available, falls back + to a conforming implementation on Java8 and JIT compiles well. + + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 8 + + + + + + + + junit + junit + test + + + diff --git a/java8-shim/src/main/java/org/owasp/shim/ForJava8.java b/java8-shim/src/main/java/org/owasp/shim/ForJava8.java new file mode 100644 index 00000000..34805a77 --- /dev/null +++ b/java8-shim/src/main/java/org/owasp/shim/ForJava8.java @@ -0,0 +1,256 @@ +package org.owasp.shim; + +import java.util.*; + +class ForJava8 extends Java8Shim { + @Override public List listOf() { + return ImmutableListShim.empty(); + } + + @Override public List listOf(T a) { + return new ImmutableListShim<>(Collections.singletonList(a)); + } + + @Override public List listOf(T a, T b) { + ArrayList ls = new ArrayList<>(2); + ls.add(a); + ls.add(b); + return new ImmutableListShim<>(ls); + } + + @Override public List listOf(T a, T b, T c) { + ArrayList ls = new ArrayList<>(3); + ls.add(a); + ls.add(b); + ls.add(c); + return new ImmutableListShim<>(ls); + } + + @Override public List listOf(T... els) { + return new ImmutableListShim<>(Arrays.asList(els)); + } + + @SuppressWarnings("unchecked") // Immutable collections aren't invariant + @Override public List listCopyOf(Collection c) { + if (c instanceof ImmutableListShim) { + return (ImmutableListShim) c; + } + return new ImmutableListShim<>(new ArrayList<>(c)); + } + + @SuppressWarnings("unchecked") // Immutable collections aren't invariant + @Override public Map mapCopyOf(Map m) { + if (m instanceof ImmutableMapShim) { + return (ImmutableMapShim) m; + } + return new ImmutableMapShim<>(new LinkedHashMap<>(m)); + } + + @Override public Map.Entry mapEntry(K key, V value) { + return new ImmutableEntryShim<>(key, value); + } + + @Override public Map mapOfEntries(Map.Entry... entries) { + Map m = new LinkedHashMap<>(entries.length); + for (Map.Entry e : entries) { + m.put(e.getKey(), e.getValue()); + } + return new ImmutableMapShim<>(m); + } + + @Override public Set setOf() { + return new ImmutableSetShim<>(Collections.emptySet()); + } + + @Override public Set setOf(T a) { + return new ImmutableSetShim<>(Collections.singleton(a)); + } + + @Override public Set setOf(T a, T b) { + LinkedHashSet ls = new LinkedHashSet<>(2); + ls.add(a); + ls.add(b); + return new ImmutableSetShim<>(ls); + } + + @Override public Set setOf(T a, T b, T c) { + LinkedHashSet ls = new LinkedHashSet<>(3); + ls.add(a); + ls.add(b); + ls.add(c); + return new ImmutableSetShim<>(ls); + } + + @Override public Set setOf(T... els) { + return new ImmutableSetShim<>(new LinkedHashSet<>(Arrays.asList(els))); + } + + @SuppressWarnings("unchecked") // Immutable collections aren't invariant + @Override public Set setCopyOf(Collection c) { + if (c instanceof ImmutableSetShim) { + + return (ImmutableSetShim) c; + } + return new ImmutableSetShim<>(new LinkedHashSet<>(c)); + } + + private static final class ImmutableListShim extends AbstractList { + private final List underlying; + + ImmutableListShim(List underlying) { + this.underlying = underlying; + } + + @Override + public T get(int index) { + return underlying.get(index); + } + + @Override + public int size() { + return underlying.size(); + } + + private static final ImmutableListShim empty = new ImmutableListShim<>(Collections.emptyList()); + + @SuppressWarnings("unchecked") // contains no elements of any specific T + static ImmutableListShim empty() { + return (ImmutableListShim) empty; + } + } + + private static final class ImmutableMapShim extends AbstractMap { + private final Map underlying; + + ImmutableMapShim(Map underlying) { + this.underlying = underlying; + } + + @Override + public V get(Object k) { + return underlying.get(k); + } + + @Override + public boolean containsKey(Object k) { + return underlying.containsKey(k); + } + + @Override + public Set> entrySet() { + return new ImmutableEntrySetShim<>(underlying.entrySet()); + } + } + + private static final class ImmutableEntrySetShim extends AbstractSet> { + private final Set> underlying; + ImmutableEntrySetShim(Set> underlying) { + this.underlying = underlying; + } + + + @Override + public Iterator> iterator() { + class IteratorImpl implements Iterator> { + private final Iterator> underlying; + private ImmutableEntryShim pending; + + IteratorImpl(Iterator> underlying) { + this.underlying = underlying; + } + + @Override + public boolean hasNext() { + if (pending == null && underlying.hasNext()) { + Map.Entry e = underlying.next(); + pending = new ImmutableEntryShim<>(e.getKey(), e.getValue()); + } + return pending != null; + } + + @Override + public Map.Entry next() { + ImmutableEntryShim next = pending; + pending = null; + if (next == null) { throw new NoSuchElementException(); } + return next; + } + + @Override + public void remove() { + throw new UnsupportedOperationException(); + } + } + return new IteratorImpl(underlying.iterator()); + } + + @Override + public int size() { + return underlying.size(); + } + } + + private static final class ImmutableEntryShim implements Map.Entry { + private final K key; + private final V value; + ImmutableEntryShim(K key, V value) { + this.key = key; + this.value = value; + } + + @Override + public K getKey() { return key; } + + @Override + public V getValue() { return value; } + + @Override + public V setValue(V value) { + throw new UnsupportedOperationException(); + } + } + + private static final class ImmutableSetShim extends AbstractSet { + private final Set underlying; + + ImmutableSetShim(Set underlying) { + this.underlying = underlying; + } + + @Override + public Iterator iterator() { + class IteratorImpl implements Iterator { + private final Iterator underlying; + IteratorImpl(Iterator underlying) { + this.underlying = underlying; + } + + @Override + public boolean hasNext() { + return underlying.hasNext(); + } + + @Override + public T next() { + return underlying.next(); + } + + @Override + public void remove() { + throw new UnsupportedOperationException(); + } + } + return new IteratorImpl(underlying.iterator()); + } + + @Override + public int size() { + return underlying.size(); + } + + @Override + public boolean contains(Object o) { + return underlying.contains(o); + } + } +} diff --git a/java8-shim/src/main/java/org/owasp/shim/Java8Shim.java b/java8-shim/src/main/java/org/owasp/shim/Java8Shim.java new file mode 100644 index 00000000..abc5c1c5 --- /dev/null +++ b/java8-shim/src/main/java/org/owasp/shim/Java8Shim.java @@ -0,0 +1,106 @@ +package org.owasp.shim; + +import java.util.*; + +/** + * Static adapters for Java 9 APIs that we need to support on Java 8. + */ +@SuppressWarnings("JavadocReference") +public abstract class Java8Shim { + /** Statically import this and do `j8.listOf(...)`. */ + public static Java8Shim j8() { return instance; } + + Java8Shim() {} // Not public so there can only be one instance loaded below. + + private static final Java8Shim instance; + static { + Object _instance; + try { + try { + // This is compiled with -release 1.9 in a separate project. + _instance = Class.forName("org.owasp.shim.ForJava9AndLater").newInstance(); + } catch (Error e) { + // This is co-located with this project and is a fall-back. + _instance = Class.forName("org.owasp.shim.ForJava8").newInstance(); + } + } catch (ClassNotFoundException | InstantiationException | IllegalAccessException e) { + throw new Error(e); + } + instance = (Java8Shim) _instance; + } + + /** + * {@link java.util.List.of} + */ + public abstract List listOf(); + + /** + * {@link java.util.List.of} + */ + public abstract List listOf(T a); + + /** + * {@link java.util.List.of} + */ + public abstract List listOf(T a, T b); + + /** + * {@link java.util.List.of} + */ + public abstract List listOf(T a, T b, T c); + + /** + * {@link java.util.List.of} + */ + public abstract List listOf(T... els); + + /** + * {@link java.util.List.copyOf} + */ + public abstract List listCopyOf(Collection c); + + /** + * {@link java.util.Map.copyOf} + */ + public abstract Map mapCopyOf(Map m); + + /** + * {@link java.util.Map.entry} + */ + public abstract Map.Entry mapEntry(K key, V value); + + /** + * {@link java.util.Map.ofEntries} + */ + public abstract Map mapOfEntries(Map.Entry... entries); + + /** + * {@link java.util.Set.of} + */ + public abstract Set setOf(); + + /** + * {@link java.util.Set.of} + */ + public abstract Set setOf(T a); + + /** + * {@link java.util.Set.of} + */ + public abstract Set setOf(T a, T b); + + /** + * {@link java.util.Set.of} + */ + public abstract Set setOf(T a, T b, T c); + + /** + * {@link java.util.Set.of} + */ + public abstract Set setOf(T... els); + + /** + * {@link java.util.Set.copyOf} + */ + public abstract Set setCopyOf(Collection c); +} diff --git a/owasp-java-html-sanitizer/pom.xml b/owasp-java-html-sanitizer/pom.xml new file mode 100644 index 00000000..9b9dd8b2 --- /dev/null +++ b/owasp-java-html-sanitizer/pom.xml @@ -0,0 +1,154 @@ + + 4.0.0 + owasp-java-html-sanitizer + bundle + + .. + com.googlecode.owasp-java-html-sanitizer + parent + 20220608.2-SNAPSHOT + + + OWASP Java HTML Sanitizer + + Takes third-party HTML and produces HTML that is safe to embed in + your web application. + Fast and easy to configure. + + + + + + + org.jacoco + jacoco-maven-plugin + + + + jacoco-initialize + + prepare-agent + + + + jacoco-site + package + + report + + + + report + prepare-package + + report + + + + + + org.eluder.coveralls + coveralls-maven-plugin + + TENYw0IKRulLOXgkyzjGqNi0hQyhBiSiU + + + + org.apache.felix + maven-bundle-plugin + + + org.owasp.html + + + + + org.apache.maven.plugins + maven-verifier-plugin + + src/test/resources/osgi-integration-verification.xml + + + + main + verify + + verify + + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 10 + 10 + + + + + + + + com.googlecode.owasp-java-html-sanitizer + java8-shim + + + com.googlecode.owasp-java-html-sanitizer + java10-shim + + + commons-codec + commons-codec + test + + + com.google.code.findbugs + jsr305 + provided + + + com.google.code.findbugs + annotations + provided + + + junit + junit + test + + + nu.validator.htmlparser + htmlparser + 1.4 + test + + + + + + + + + com.github.spotbugs + spotbugs-maven-plugin + 3.1.12.2 + + + Max + + Low + + + + + diff --git a/src/main/java/org/owasp/html/AttributePolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/AttributePolicy.java similarity index 100% rename from src/main/java/org/owasp/html/AttributePolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/AttributePolicy.java diff --git a/src/main/java/org/owasp/html/CssGrammar.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssGrammar.java similarity index 100% rename from src/main/java/org/owasp/html/CssGrammar.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssGrammar.java diff --git a/src/main/java/org/owasp/html/CssSchema.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssSchema.java similarity index 86% rename from src/main/java/org/owasp/html/CssSchema.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssSchema.java index afd5203f..d25404c1 100644 --- a/src/main/java/org/owasp/html/CssSchema.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssSchema.java @@ -37,6 +37,7 @@ import java.util.Set; import java.util.SortedSet; import java.util.TreeSet; +import static org.owasp.shim.Java8Shim.j8; import javax.annotation.Nullable; @@ -54,11 +55,11 @@ public static final class Property { /** A bitfield of BIT_* constants describing groups of allowed tokens. */ final int bits; /** Specific allowed values. */ - final Set literals; + final Set literals; /** * Maps lower-case function tokens to the schema key for their parameters. */ - final Map fnKeys; + final Map fnKeys; /** * @param bits A bitfield of BIT_* constants describing groups of allowed tokens. @@ -69,8 +70,8 @@ public Property( int bits, Set literals, Map fnKeys) { this.bits = bits; - this.literals = Set.copyOf(literals); - this.fnKeys = Map.copyOf(fnKeys); + this.literals = j8().setCopyOf(literals); + this.fnKeys = j8().mapCopyOf(fnKeys); } @Override @@ -262,9 +263,9 @@ Property forKey(String propertyName) { static { Map zeroFns = Collections.emptyMap(); Map builder = new HashMap<>(); - Set mozBorderRadiusLiterals0 = Set.of("/"); - Set mozOpacityLiterals0 = Set.of("inherit"); - Set mozOutlineLiterals0 = Set.of( + Set mozBorderRadiusLiterals0 = j8().setOf("/"); + Set mozOpacityLiterals0 = j8().setOf("inherit"); + Set mozOutlineLiterals0 = j8().setOf( "aliceblue", "antiquewhite", "aqua", "aquamarine", "azure", "beige", "bisque", "black", "blanchedalmond", "blue", "blueviolet", "brown", "burlywood", "cadetblue", "chartreuse", "chocolate", "coral", @@ -292,121 +293,119 @@ Property forKey(String propertyName) { "silver", "skyblue", "slateblue", "slategray", "snow", "springgreen", "steelblue", "tan", "teal", "thistle", "tomato", "turquoise", "violet", "wheat", "white", "whitesmoke", "yellow", "yellowgreen"); - Set mozOutlineLiterals1 = Set.of( + Set mozOutlineLiterals1 = j8().setOf( "dashed", "dotted", "double", "groove", "outset", "ridge", "solid"); - Set mozOutlineLiterals2 = Set.of("thick", "thin"); - Set mozOutlineLiterals3 = Set.of( + Set mozOutlineLiterals2 = j8().setOf("thick", "thin"); + Set mozOutlineLiterals3 = j8().setOf( "hidden", "inherit", "inset", "invert", "medium", "none"); - Map mozOutlineFunctions = - Map.of( - "rgb(", "rgb()", "rgba(", "rgba()", - "hsl(", "hsl()", "hsla(", "hsla()"); + Map mozOutlineFunctions = j8().mapOfEntries( + j8().mapEntry("rgb(", "rgb()"), j8().mapEntry("rgba(", "rgba()"), + j8().mapEntry("hsl(", "hsl()"), j8().mapEntry("hsla(", "hsla()")); Set mozOutlineColorLiterals0 = - Set.of("inherit", "invert"); + j8().setOf("inherit", "invert"); Set mozOutlineStyleLiterals0 = - Set.of("hidden", "inherit", "inset", "none"); + j8().setOf("hidden", "inherit", "inset", "none"); Set mozOutlineWidthLiterals0 = - Set.of("inherit", "medium"); + j8().setOf("inherit", "medium"); Set oTextOverflowLiterals0 = - Set.of("clip", "ellipsis"); - Set azimuthLiterals0 = Set.of( + j8().setOf("clip", "ellipsis"); + Set azimuthLiterals0 = j8().setOf( "behind", "center-left", "center-right", "far-left", "far-right", "left-side", "leftwards", "right-side", "rightwards"); - Set azimuthLiterals1 = Set.of("left", "right"); + Set azimuthLiterals1 = j8().setOf("left", "right"); Set azimuthLiterals2 = - Set.of("center", "inherit"); - Set backgroundLiterals0 = Set.of( + j8().setOf("center", "inherit"); + Set backgroundLiterals0 = j8().setOf( "border-box", "contain", "content-box", "cover", "padding-box"); Set backgroundLiterals1 = - Set.of("no-repeat", "repeat-x", "repeat-y", "round", "space"); - Set backgroundLiterals2 = Set.of("bottom", "top"); - Set backgroundLiterals3 = Set.of( + j8().setOf("no-repeat", "repeat-x", "repeat-y", "round", "space"); + Set backgroundLiterals2 = j8().setOf("bottom", "top"); + Set backgroundLiterals3 = j8().setOf( ",", "/", "auto", "center", "fixed", "inherit", "local", "none", "repeat", "scroll", "transparent"); - Map backgroundFunctions = - Map.of( - "image(", "image()", - "linear-gradient(", "linear-gradient()", - "radial-gradient(", "radial-gradient()", - "repeating-linear-gradient(", "repeating-linear-gradient()", - "repeating-radial-gradient(", "repeating-radial-gradient()", - "rgb(", "rgb()", "rgba(", "rgba()", - "hsl(", "hsl()", "hsla(", "hsla()"); + Map backgroundFunctions = j8().mapOfEntries( + j8().mapEntry("image(", "image()"), + j8().mapEntry("linear-gradient(", "linear-gradient()"), + j8().mapEntry("radial-gradient(", "radial-gradient()"), + j8().mapEntry("repeating-linear-gradient(", "repeating-linear-gradient()"), + j8().mapEntry("repeating-radial-gradient(", "repeating-radial-gradient()"), + j8().mapEntry("rgb(", "rgb()"), j8().mapEntry("rgba(", "rgba()"), + j8().mapEntry("hsl(", "hsl()"), j8().mapEntry("hsla(", "hsla()")); Set backgroundAttachmentLiterals0 = - Set.of(",", "fixed", "local", "scroll"); + j8().setOf(",", "fixed", "local", "scroll"); Set backgroundColorLiterals0 = - Set.of("inherit", "transparent"); + j8().setOf("inherit", "transparent"); Set backgroundImageLiterals0 = - Set.of(",", "none"); + j8().setOf(",", "none"); Map backgroundImageFunctions = - Map.of( - "image(", "image()", - "linear-gradient(", "linear-gradient()", - "radial-gradient(", "radial-gradient()", - "repeating-linear-gradient(", "repeating-linear-gradient()", - "repeating-radial-gradient(", "repeating-radial-gradient()"); - Set backgroundPositionLiterals0 = Set.of( + j8().mapOfEntries( + j8().mapEntry("image(", "image()"), + j8().mapEntry("linear-gradient(", "linear-gradient()"), + j8().mapEntry("radial-gradient(", "radial-gradient()"), + j8().mapEntry("repeating-linear-gradient(", "repeating-linear-gradient()"), + j8().mapEntry("repeating-radial-gradient(", "repeating-radial-gradient()")); + Set backgroundPositionLiterals0 = j8().setOf( ",", "center"); - Set backgroundRepeatLiterals0 = Set.of( + Set backgroundRepeatLiterals0 = j8().setOf( ",", "repeat"); - Set borderLiterals0 = Set.of( + Set borderLiterals0 = j8().setOf( "hidden", "inherit", "inset", "medium", "none", "transparent"); - Set borderCollapseLiterals0 = Set.of( + Set borderCollapseLiterals0 = j8().setOf( "collapse", "inherit", "separate"); - Set bottomLiterals0 = Set.of("auto", "inherit"); - Set boxShadowLiterals0 = Set.of( + Set bottomLiterals0 = j8().setOf("auto", "inherit"); + Set boxShadowLiterals0 = j8().setOf( ",", "inset", "none"); - Set clearLiterals0 = Set.of( + Set clearLiterals0 = j8().setOf( "both", "inherit", "none"); Map clipFunctions = - Map.of("rect(", "rect()"); - Set contentLiterals0 = Set.of("none", "normal"); - Set cueLiterals0 = Set.of("inherit", "none"); - Set cursorLiterals0 = Set.of( + j8().mapOfEntries(j8().mapEntry("rect(", "rect()")); + Set contentLiterals0 = j8().setOf("none", "normal"); + Set cueLiterals0 = j8().setOf("inherit", "none"); + Set cursorLiterals0 = j8().setOf( "all-scroll", "col-resize", "crosshair", "default", "e-resize", "hand", "help", "move", "n-resize", "ne-resize", "no-drop", "not-allowed", "nw-resize", "pointer", "progress", "row-resize", "s-resize", "se-resize", "sw-resize", "text", "vertical-text", "w-resize", "wait"); - Set cursorLiterals1 = Set.of( + Set cursorLiterals1 = j8().setOf( ",", "auto", "inherit"); - Set directionLiterals0 = Set.of("ltr", "rtl"); - Set displayLiterals0 = Set.of( + Set directionLiterals0 = j8().setOf("ltr", "rtl"); + Set displayLiterals0 = j8().setOf( "-moz-inline-box", "-moz-inline-stack", "block", "inline", "inline-block", "inline-table", "list-item", "run-in", "table", "table-caption", "table-cell", "table-column", "table-column-group", "table-footer-group", "table-header-group", "table-row", "table-row-group"); - Set elevationLiterals0 = Set.of( + Set elevationLiterals0 = j8().setOf( "above", "below", "higher", "level", "lower"); - Set emptyCellsLiterals0 = Set.of("hide", "show"); + Set emptyCellsLiterals0 = j8().setOf("hide", "show"); //Map filterFunctions = - // Map.of("alpha(", "alpha()"); - Set fontLiterals0 = Set.of( + // j8().mapOfEntries(mapEntry("alpha(", "alpha()")); + Set fontLiterals0 = j8().setOf( "100", "200", "300", "400", "500", "600", "700", "800", "900", "bold", "bolder", "lighter"); - Set fontLiterals1 = Set.of( + Set fontLiterals1 = j8().setOf( "large", "larger", "small", "smaller", "x-large", "x-small", "xx-large", "xx-small", "xxx-large", "medium"); - Set fontLiterals2 = Set.of( + Set fontLiterals2 = j8().setOf( "caption", "icon", "menu", "message-box", "small-caption", "status-bar"); - Set fontLiterals3 = Set.of( + Set fontLiterals3 = j8().setOf( "cursive", "fantasy", "monospace", "sans-serif", "serif"); - Set fontLiterals4 = Set.of("italic", "oblique"); - Set fontLiterals5 = Set.of( + Set fontLiterals4 = j8().setOf("italic", "oblique"); + Set fontLiterals5 = j8().setOf( ",", "/", "inherit", "medium", "normal", "small-caps"); - Set fontFamilyLiterals0 = Set.of(",", "inherit"); - Set fontStretchLiterals0 = Set.of( + Set fontFamilyLiterals0 = j8().setOf(",", "inherit"); + Set fontStretchLiterals0 = j8().setOf( "condensed", "expanded", "extra-condensed", "extra-expanded", "narrower", "semi-condensed", "semi-expanded", "ultra-condensed", "ultra-expanded", "wider"); - Set fontStretchLiterals1 = Set.of("normal"); - Set fontStyleLiterals0 = Set.of( + Set fontStretchLiterals1 = j8().setOf("normal"); + Set fontStyleLiterals0 = j8().setOf( "inherit", "normal"); - Set fontVariantLiterals0 = Set.of( + Set fontVariantLiterals0 = j8().setOf( "inherit", "normal", "small-caps"); - Set listStyleLiterals0 = Set.of( + Set listStyleLiterals0 = j8().setOf( "armenian", "cjk-decimal", "decimal", "decimal-leading-zero", "disc", "disclosure-closed", "disclosure-open", "ethiopic-numeric", "georgian", "hebrew", "hiragana", "hiragana-iroha", "japanese-formal", @@ -416,80 +415,80 @@ Property forKey(String propertyName) { "lower-roman", "simp-chinese-formal", "simp-chinese-informal", "square", "trad-chinese-formal", "trad-chinese-informal", "upper-alpha", "upper-latin", "upper-roman"); - Set listStyleLiterals1 = Set.of( + Set listStyleLiterals1 = j8().setOf( "inside", "outside"); - Set listStyleLiterals2 = Set.of( + Set listStyleLiterals2 = j8().setOf( "circle", "inherit", "none"); - Set maxHeightLiterals0 = Set.of( + Set maxHeightLiterals0 = j8().setOf( "auto", "inherit", "none"); - Set overflowLiterals0 = Set.of( + Set overflowLiterals0 = j8().setOf( "auto", "hidden", "inherit", "scroll", "visible"); - Set overflowWrapLiterals0 = Set.of( + Set overflowWrapLiterals0 = j8().setOf( "normal", "break-word", "anywhere", "inherit"); - Set overflowXLiterals0 = Set.of( + Set overflowXLiterals0 = j8().setOf( "no-content", "no-display"); - Set overflowXLiterals1 = Set.of( + Set overflowXLiterals1 = j8().setOf( "auto", "hidden", "scroll", "visible"); - Set pageBreakAfterLiterals0 = Set.of( + Set pageBreakAfterLiterals0 = j8().setOf( "always", "auto", "avoid", "inherit"); - Set pageBreakInsideLiterals0 = Set.of( + Set pageBreakInsideLiterals0 = j8().setOf( "auto", "avoid", "inherit"); - Set pitchLiterals0 = Set.of( + Set pitchLiterals0 = j8().setOf( "high", "low", "x-high", "x-low"); - Set playDuringLiterals0 = Set.of( + Set playDuringLiterals0 = j8().setOf( "auto", "inherit", "mix", "none", "repeat"); - Set positionLiterals0 = Set.of( + Set positionLiterals0 = j8().setOf( "absolute", "relative", "static"); - Set speakLiterals0 = Set.of( + Set speakLiterals0 = j8().setOf( "inherit", "none", "normal", "spell-out"); - Set speakHeaderLiterals0 = Set.of( + Set speakHeaderLiterals0 = j8().setOf( "always", "inherit", "once"); - Set speakNumeralLiterals0 = Set.of( + Set speakNumeralLiterals0 = j8().setOf( "continuous", "digits"); - Set speakPunctuationLiterals0 = Set.of( + Set speakPunctuationLiterals0 = j8().setOf( "code", "inherit", "none"); - Set speechRateLiterals0 = Set.of( + Set speechRateLiterals0 = j8().setOf( "fast", "faster", "slow", "slower", "x-fast", "x-slow"); - Set tableLayoutLiterals0 = Set.of( + Set tableLayoutLiterals0 = j8().setOf( "auto", "fixed", "inherit"); - Set textAlignLiterals0 = Set.of( + Set textAlignLiterals0 = j8().setOf( "center", "inherit", "justify"); - Set textDecorationLiterals0 = Set.of( + Set textDecorationLiterals0 = j8().setOf( "blink", "line-through", "overline", "underline"); - Set textTransformLiterals0 = Set.of( + Set textTransformLiterals0 = j8().setOf( "capitalize", "lowercase", "uppercase"); - Set textWrapLiterals0 = Set.of( + Set textWrapLiterals0 = j8().setOf( "suppress", "unrestricted"); - Set unicodeBidiLiterals0 = Set.of( + Set unicodeBidiLiterals0 = j8().setOf( "bidi-override", "embed"); - Set verticalAlignLiterals0 = Set.of( + Set verticalAlignLiterals0 = j8().setOf( "baseline", "middle", "sub", "super", "text-bottom", "text-top"); - Set visibilityLiterals0 = Set.of( + Set visibilityLiterals0 = j8().setOf( "collapse", "hidden", "inherit", "visible"); - Set voiceFamilyLiterals0 = Set.of( + Set voiceFamilyLiterals0 = j8().setOf( "child", "female", "male"); - Set volumeLiterals0 = Set.of( + Set volumeLiterals0 = j8().setOf( "loud", "silent", "soft", "x-loud", "x-soft"); - Set whiteSpaceLiterals0 = Set.of( + Set whiteSpaceLiterals0 = j8().setOf( "-moz-pre-wrap", "-o-pre-wrap", "-pre-wrap", "nowrap", "pre", "pre-line", "pre-wrap"); - Set wordWrapLiterals0 = Set.of( + Set wordWrapLiterals0 = j8().setOf( "break-word", "normal"); - Set rgb$FunLiterals0 = Set.of(","); - Set linearGradient$FunLiterals0 = Set.of( + Set rgb$FunLiterals0 = j8().setOf(","); + Set linearGradient$FunLiterals0 = j8().setOf( ",", "to"); - Set radialGradient$FunLiterals0 = Set.of( + Set radialGradient$FunLiterals0 = j8().setOf( "at", "closest-corner", "closest-side", "ellipse", "farthest-corner", "farthest-side"); - Set radialGradient$FunLiterals1 = Set.of( + Set radialGradient$FunLiterals1 = j8().setOf( ",", "center", "circle"); - Set rect$FunLiterals0 = Set.of(",", "auto"); - //Set alpha$FunLiterals0 = Set.of("=", "opacity"); + Set rect$FunLiterals0 = j8().setOf(",", "auto"); + //Set alpha$FunLiterals0 = j8().setOf("=", "opacity"); Property mozBorderRadius = new Property(5, mozBorderRadiusLiterals0, zeroFns); builder.put("-moz-border-radius", mozBorderRadius); Property mozBorderRadiusBottomleft = - new Property(5, Set.of(), zeroFns); + new Property(5, j8().setOf(), zeroFns); builder.put("-moz-border-radius-bottomleft", mozBorderRadiusBottomleft); Property mozOpacity = new Property(1, mozOpacityLiterals0, zeroFns); builder.put("-moz-opacity", mozOpacity); @@ -608,7 +607,7 @@ Property forKey(String propertyName) { 0, union(emptyCellsLiterals0, mozOpacityLiterals0), zeroFns); builder.put("empty-cells", emptyCells); //builder.put("filter", - // new Property(0, ImmutableSet.of(), filterFunctions)); + // new Property(0, j8().setOf(), filterFunctions)); @SuppressWarnings("unchecked") Property cssFloat = new Property( 0, union(azimuthLiterals1, cueLiterals0), zeroFns); @@ -861,7 +860,7 @@ private static Set union(Set... subsets) { return Collections.unmodifiableSet(all); } - static final Set DEFAULT_WHITELIST = Set.of( + static final Set DEFAULT_WHITELIST = j8().setOf( "-moz-border-radius", "-moz-border-radius-bottomleft", "-moz-border-radius-bottomright", diff --git a/src/main/java/org/owasp/html/CssTokens.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssTokens.java similarity index 97% rename from src/main/java/org/owasp/html/CssTokens.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssTokens.java index 4c2ec3ad..ec6d1726 100644 --- a/src/main/java/org/owasp/html/CssTokens.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssTokens.java @@ -31,8 +31,8 @@ import java.util.ArrayList; import java.util.Iterator; import java.util.List; -import java.util.Map; import java.util.NoSuchElementException; +import static org.owasp.shim.Java8Shim.j8; import javax.annotation.Nullable; @@ -1464,32 +1464,32 @@ private static int[] truncateOrShare(int[] arr, int limit) { * http://dev.w3.org/csswg/css-values/#other-units */ private static final Trie UNIT_TRIE = new Trie<>( - Map.ofEntries( - Map.entry("em", LENGTH_UNIT_TYPE), - Map.entry("ex", LENGTH_UNIT_TYPE), - Map.entry("ch", LENGTH_UNIT_TYPE), // Width of zero character - Map.entry("rem", LENGTH_UNIT_TYPE), // Root element font-size - Map.entry("vh", LENGTH_UNIT_TYPE), - Map.entry("vw", LENGTH_UNIT_TYPE), - Map.entry("vmin", LENGTH_UNIT_TYPE), - Map.entry("vmax", LENGTH_UNIT_TYPE), - Map.entry("px", LENGTH_UNIT_TYPE), - Map.entry("mm", LENGTH_UNIT_TYPE), - Map.entry("cm", LENGTH_UNIT_TYPE), - Map.entry("in", LENGTH_UNIT_TYPE), - Map.entry("pt", LENGTH_UNIT_TYPE), - Map.entry("pc", LENGTH_UNIT_TYPE), - Map.entry("deg", ANGLE_UNIT_TYPE), - Map.entry("rad", ANGLE_UNIT_TYPE), - Map.entry("grad", ANGLE_UNIT_TYPE), - Map.entry("turn", ANGLE_UNIT_TYPE), - Map.entry("s", TIME_UNIT_TYPE), - Map.entry("ms", TIME_UNIT_TYPE), - Map.entry("hz", FREQUENCY_UNIT_TYPE), - Map.entry("khz", FREQUENCY_UNIT_TYPE), - Map.entry("dpi", RESOLUTION_UNIT_TYPE), - Map.entry("dpcm", RESOLUTION_UNIT_TYPE), - Map.entry("dppx", RESOLUTION_UNIT_TYPE)) + j8().mapOfEntries( + j8().mapEntry("em", LENGTH_UNIT_TYPE), + j8().mapEntry("ex", LENGTH_UNIT_TYPE), + j8().mapEntry("ch", LENGTH_UNIT_TYPE), // Width of zero character + j8().mapEntry("rem", LENGTH_UNIT_TYPE), // Root element font-size + j8().mapEntry("vh", LENGTH_UNIT_TYPE), + j8().mapEntry("vw", LENGTH_UNIT_TYPE), + j8().mapEntry("vmin", LENGTH_UNIT_TYPE), + j8().mapEntry("vmax", LENGTH_UNIT_TYPE), + j8().mapEntry("px", LENGTH_UNIT_TYPE), + j8().mapEntry("mm", LENGTH_UNIT_TYPE), + j8().mapEntry("cm", LENGTH_UNIT_TYPE), + j8().mapEntry("in", LENGTH_UNIT_TYPE), + j8().mapEntry("pt", LENGTH_UNIT_TYPE), + j8().mapEntry("pc", LENGTH_UNIT_TYPE), + j8().mapEntry("deg", ANGLE_UNIT_TYPE), + j8().mapEntry("rad", ANGLE_UNIT_TYPE), + j8().mapEntry("grad", ANGLE_UNIT_TYPE), + j8().mapEntry("turn", ANGLE_UNIT_TYPE), + j8().mapEntry("s", TIME_UNIT_TYPE), + j8().mapEntry("ms", TIME_UNIT_TYPE), + j8().mapEntry("hz", FREQUENCY_UNIT_TYPE), + j8().mapEntry("khz", FREQUENCY_UNIT_TYPE), + j8().mapEntry("dpi", RESOLUTION_UNIT_TYPE), + j8().mapEntry("dpcm", RESOLUTION_UNIT_TYPE), + j8().mapEntry("dppx", RESOLUTION_UNIT_TYPE)) ); static boolean isWellKnownUnit(CharSequence s, int start, int end) { diff --git a/src/main/java/org/owasp/html/ElementAndAttributePolicies.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicies.java similarity index 95% rename from src/main/java/org/owasp/html/ElementAndAttributePolicies.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicies.java index da4a0f2d..2fde9c86 100644 --- a/src/main/java/org/owasp/html/ElementAndAttributePolicies.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicies.java @@ -34,6 +34,8 @@ import java.util.Map; import javax.annotation.concurrent.Immutable; +import static org.owasp.shim.Java8Shim.j8; + /** * Encapsulates all the information needed by the * {@link ElementAndAttributePolicyBasedSanitizerPolicy} to sanitize one kind @@ -54,7 +56,7 @@ final class ElementAndAttributePolicies { HtmlTagSkipType htmlTagSkipType) { this.elementName = elementName; this.elPolicy = elPolicy; - this.attrPolicies = Map.copyOf(attrPolicies); + this.attrPolicies = j8().mapCopyOf(attrPolicies); this.htmlTagSkipType = htmlTagSkipType; } @@ -99,8 +101,7 @@ ElementAndAttributePolicies andGlobals( attrPolicy, globalAttrPolicy); if (!joined.equals(attrPolicy)) { if (anded == null) { - anded = new LinkedHashMap<>(); - anded.putAll(this.attrPolicies); + anded = new LinkedHashMap<>(this.attrPolicies); } anded.put(attrName, joined); } @@ -110,8 +111,7 @@ ElementAndAttributePolicies andGlobals( String attrName = e.getKey(); if (!this.attrPolicies.containsKey(attrName)) { if (anded == null) { - anded = new LinkedHashMap<>(); - anded.putAll(this.attrPolicies); + anded = new LinkedHashMap<>(this.attrPolicies); } anded.put(attrName, e.getValue()); } diff --git a/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java similarity index 97% rename from src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java index 4f78e2c8..0af4f51f 100644 --- a/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java @@ -37,6 +37,8 @@ import javax.annotation.Nullable; import javax.annotation.concurrent.NotThreadSafe; +import static org.owasp.shim.Java8Shim.j8; + /** * A sanitizer policy that applies element and attribute policies to tags. */ @@ -63,12 +65,12 @@ class ElementAndAttributePolicyBasedSanitizerPolicy Map elAndAttrPolicies, Set allowedTextContainers) { this.out = out; - this.elAndAttrPolicies = Map.copyOf(elAndAttrPolicies); - this.allowedTextContainers = Set.copyOf(allowedTextContainers); + this.elAndAttrPolicies = j8().mapCopyOf(elAndAttrPolicies); + this.allowedTextContainers = j8().setCopyOf(allowedTextContainers); } static final Set SKIPPABLE_ELEMENT_CONTENT - = Set.of( + = j8().setOf( "script", "style", "noscript", "nostyle", "noembed", "noframes", "iframe", "object", "frame", "frameset", "title"); diff --git a/src/main/java/org/owasp/html/ElementPolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementPolicy.java similarity index 100% rename from src/main/java/org/owasp/html/ElementPolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementPolicy.java diff --git a/src/main/java/org/owasp/html/Encoding.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Encoding.java similarity index 100% rename from src/main/java/org/owasp/html/Encoding.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/Encoding.java diff --git a/src/main/java/org/owasp/html/FilterUrlByProtocolAttributePolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/FilterUrlByProtocolAttributePolicy.java similarity index 100% rename from src/main/java/org/owasp/html/FilterUrlByProtocolAttributePolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/FilterUrlByProtocolAttributePolicy.java diff --git a/src/main/java/org/owasp/html/Handler.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Handler.java similarity index 96% rename from src/main/java/org/owasp/html/Handler.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/Handler.java index 73339a96..8a65ad84 100644 --- a/src/main/java/org/owasp/html/Handler.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Handler.java @@ -43,7 +43,7 @@ public interface Handler { void handle(T x); /** A handler that does nothing given any input. */ - public static final Handler DO_NOTHING = new Handler<>() { + public static final Handler DO_NOTHING = new Handler() { public void handle(Object x) { // Really, do nothing. } diff --git a/src/main/java/org/owasp/html/HtmlChangeListener.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlChangeListener.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlChangeListener.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlChangeListener.java diff --git a/src/main/java/org/owasp/html/HtmlChangeReporter.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlChangeReporter.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlChangeReporter.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlChangeReporter.java diff --git a/src/main/java/org/owasp/html/HtmlElementTables.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java similarity index 99% rename from src/main/java/org/owasp/html/HtmlElementTables.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java index e230b870..f5b176df 100644 --- a/src/main/java/org/owasp/html/HtmlElementTables.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java @@ -6,6 +6,7 @@ import java.util.HashMap; import java.util.List; import java.util.Map; +import static org.owasp.shim.Java8Shim.j8; /** * Metadata about HTML elements. @@ -123,7 +124,7 @@ public HtmlElementTables( COLGROUP_TAG = indexForName("colgroup"); IFRAME_TAG = indexForName("iframe"); - List freeWrappers = List.of( + List freeWrappers = j8().listOf( new FreeWrapper( LI_TAG, // LI_TAG is allowed here since an LI can appear when an LI is on @@ -401,12 +402,12 @@ public static final class HtmlElementNames { /** */ public HtmlElementNames(List canonNames) { - this.canonNames = List.copyOf(canonNames); + this.canonNames = j8().listCopyOf(canonNames); } /** */ HtmlElementNames(String... canonNames) { - this.canonNames = List.of(canonNames); + this.canonNames = j8().listOf(canonNames); } /** @@ -721,7 +722,7 @@ public enum TextContentModelBit { } static final Comparator COMPARE_BY_ZEROTH = - new Comparator<>() { + new Comparator() { public int compare(int[] a, int[] b) { return Integer.compare(a[0], b[0]); } diff --git a/src/main/java/org/owasp/html/HtmlElementTablesCanned.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTablesCanned.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlElementTablesCanned.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTablesCanned.java diff --git a/src/main/java/org/owasp/html/HtmlEntities.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlEntities.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlEntities.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlEntities.java diff --git a/src/main/java/org/owasp/html/HtmlLexer.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlLexer.java similarity index 99% rename from src/main/java/org/owasp/html/HtmlLexer.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlLexer.java index cc6d2bbf..97783227 100644 --- a/src/main/java/org/owasp/html/HtmlLexer.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlLexer.java @@ -34,6 +34,8 @@ import javax.annotation.concurrent.NotThreadSafe; +import static org.owasp.shim.Java8Shim.j8; + /** * A flexible lexer for HTML. * This is hairy code, but it is outside the TCB for the HTML sanitizer. @@ -261,12 +263,12 @@ private static boolean isValuelessAttribute(String attribName) { } // From http://issues.apache.org/jira/browse/XALANC-519 - private static final Set VALUELESS_ATTRIB_NAMES = Set.of( + private static final Set VALUELESS_ATTRIB_NAMES = j8().setOf( "checked", "compact", "declare", "defer", "disabled", "ismap", "multiple", "nohref", "noresize", "noshade", "nowrap", "readonly", "selected"); - private static final Set mixedCaseForeignAttributeNames = Set.of( + private static final Set mixedCaseForeignAttributeNames = j8().setOf( "attributeName", "attributeType", "baseFrequency", @@ -347,7 +349,7 @@ private static boolean isValuelessAttribute(String attribName) { "zoomAndPan" ); - private static final Set mixedCaseForeignElementNames = Set.of( + private static final Set mixedCaseForeignElementNames = j8().setOf( "animateColor", "animateMotion", "animateTransform", diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java similarity index 98% rename from src/main/java/org/owasp/html/HtmlPolicyBuilder.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java index 54c0305f..d5a5df05 100644 --- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java @@ -46,6 +46,8 @@ import org.owasp.html.ElementPolicy.JoinableElementPolicy; +import static org.owasp.shim.Java8Shim.j8; + /** * Conveniences for configuring policies for the {@link HtmlSanitizer}. * @@ -163,7 +165,7 @@ public class HtmlPolicyBuilder { * output. */ public static final Set DEFAULT_SKIP_IF_EMPTY - = Set.of("a", "font", "img", "input", "span"); + = j8().setOf("a", "font", "img", "input", "span"); static final Map DEFAULT_SKIP_TAG_MAP_IF_EMPTY_ATTR; static { @@ -185,7 +187,7 @@ public class HtmlPolicyBuilder { * >About rel=noopener */ public static final List DEFAULT_RELS_ON_TARGETTED_LINKS - = List.of("noopener", "noreferrer"); + = j8().listOf("noopener", "noreferrer"); static final String DEFAULT_RELS_ON_TARGETTED_LINKS_STR = DEFAULT_RELS_ON_TARGETTED_LINKS.stream().collect(Collectors.joining(" ")); @@ -539,7 +541,7 @@ public HtmlPolicyBuilder allowStyling(CssSchema whitelist) { // still not allowing styles when allowStyling is followed by a call to // disallowAttributesGlobally("style"). this.allowAttributesGlobally( - AttributePolicy.IDENTITY_ATTRIBUTE_POLICY, List.of("style")); + AttributePolicy.IDENTITY_ATTRIBUTE_POLICY, j8().listOf("style")); return this; } @@ -698,7 +700,7 @@ public PolicyFactory toFactory() { return new PolicyFactory( compiled.compiledPolicies, Collections.unmodifiableSet(textContainerSetBuilder), - Map.copyOf(compiled.globalAttrPolicies), + j8().mapCopyOf(compiled.globalAttrPolicies), preprocessor, postprocessor); } @@ -740,7 +742,7 @@ private CompiledState compilePolicies() { Map globalAttrPolicies = new LinkedHashMap<>(this.globalAttrPolicies); @SuppressWarnings("hiding") - Set allowedProtocols = Set.copyOf(this.allowedProtocols); + Set allowedProtocols = j8().setCopyOf(this.allowedProtocols); // Implement requireRelsOnLinks & skip... { @@ -748,9 +750,9 @@ private CompiledState compilePolicies() { if (linkPolicy != null) { RelsOnLinksPolicy relsOnLinksPolicy = RelsOnLinksPolicy.create( this.extraRelsForLinks != null - ? this.extraRelsForLinks : Set.of(), + ? this.extraRelsForLinks : j8().setOf(), this.skipRelsForLinks != null - ? this.skipRelsForLinks : Set.of()); + ? this.skipRelsForLinks : j8().setOf()); elPolicies.put( "a", ElementPolicy.Util.join(linkPolicy, relsOnLinksPolicy)); @@ -810,7 +812,7 @@ private CompiledState compilePolicies() { Map elAttrPolicies = attrPolicies.get(elementName); if (elAttrPolicies == null) { - elAttrPolicies = Map.of(); + elAttrPolicies = j8().mapOfEntries(); } Map attrsBuilder @@ -874,7 +876,7 @@ public final class AttributeBuilder { private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY; AttributeBuilder(List attributeNames) { - this.attributeNames = List.copyOf(attributeNames); + this.attributeNames = j8().listCopyOf(attributeNames); } /** @@ -928,7 +930,7 @@ public AttributeBuilder matching( */ public AttributeBuilder matching( boolean ignoreCase, String... allowedValues) { - return matching(ignoreCase, Set.of(allowedValues)); + return matching(ignoreCase, j8().setOf(allowedValues)); } /** @@ -939,7 +941,7 @@ public AttributeBuilder matching( */ public AttributeBuilder matching( final boolean ignoreCase, Set allowedValues) { - final Set allowed = Set.copyOf(allowedValues); + final Set allowed = j8().setCopyOf(allowedValues); return matching(new AttributePolicy() { public @Nullable String apply( String elementName, String attributeName, String uncanonValue) { @@ -995,7 +997,7 @@ private static final class RelsOnLinksPolicy final List whenTargetPresent; static final RelsOnLinksPolicy EMPTY = new RelsOnLinksPolicy( - Set.of(), Set.of()); + j8().setOf(), j8().setOf()); static RelsOnLinksPolicy create( Set extra, @@ -1007,13 +1009,13 @@ static RelsOnLinksPolicy create( RelsOnLinksPolicy( Set extra, Set skip) { - this.extra = Set.copyOf(extra); - this.skip = Set.copyOf(skip); + this.extra = j8().setCopyOf(extra); + this.skip = j8().setCopyOf(skip); Set targetOnly = new HashSet<>(); targetOnly.addAll(DEFAULT_RELS_ON_TARGETTED_LINKS); targetOnly.removeAll(extra); targetOnly.removeAll(skip); - this.whenTargetPresent = List.copyOf(targetOnly); + this.whenTargetPresent = j8().listCopyOf(targetOnly); } private static int indexOfAttributeValue( diff --git a/src/main/java/org/owasp/html/HtmlSanitizer.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlSanitizer.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java diff --git a/src/main/java/org/owasp/html/HtmlStreamEventProcessor.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamEventProcessor.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlStreamEventProcessor.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamEventProcessor.java diff --git a/src/main/java/org/owasp/html/HtmlStreamEventReceiver.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamEventReceiver.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlStreamEventReceiver.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamEventReceiver.java diff --git a/src/main/java/org/owasp/html/HtmlStreamEventReceiverWrapper.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamEventReceiverWrapper.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlStreamEventReceiverWrapper.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamEventReceiverWrapper.java diff --git a/src/main/java/org/owasp/html/HtmlStreamRenderer.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamRenderer.java similarity index 99% rename from src/main/java/org/owasp/html/HtmlStreamRenderer.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamRenderer.java index c0c9d5bf..7e657ee1 100644 --- a/src/main/java/org/owasp/html/HtmlStreamRenderer.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlStreamRenderer.java @@ -38,6 +38,8 @@ import javax.annotation.WillCloseWhenClosed; import javax.annotation.concurrent.NotThreadSafe; +import static org.owasp.shim.Java8Shim.j8; + /** * Given a series of HTML tokens, writes valid, normalized HTML to the output. * The output will have well-defined tag boundaries, but there may be orphaned @@ -481,5 +483,5 @@ private static boolean isTagEnd(char ch) { return ch < 63 && 0 != (TAG_ENDS & (1L << ch)); } - private static final Set foreignContentRootElementNames = Set.of("svg", "math"); + private static final Set foreignContentRootElementNames = j8().setOf("svg", "math"); } diff --git a/src/main/java/org/owasp/html/HtmlTagSkipType.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlTagSkipType.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlTagSkipType.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlTagSkipType.java diff --git a/src/main/java/org/owasp/html/HtmlTextEscapingMode.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlTextEscapingMode.java similarity index 81% rename from src/main/java/org/owasp/html/HtmlTextEscapingMode.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlTextEscapingMode.java index 3ccb5c8d..1fae9241 100644 --- a/src/main/java/org/owasp/html/HtmlTextEscapingMode.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlTextEscapingMode.java @@ -29,6 +29,7 @@ package org.owasp.html; import java.util.Map; +import static org.owasp.shim.Java8Shim.j8; /** * From section 8.1.2.6 of http://www.whatwg.org/specs/web-apps/current-work/ @@ -83,14 +84,14 @@ public enum HtmlTextEscapingMode { ; private static final Map ESCAPING_MODES - = Map.ofEntries( - Map.entry("iframe", CDATA), + = j8().mapOfEntries( + j8().mapEntry("iframe", CDATA), // HTML5 does not treat listing as CDATA and treats XMP as deprecated, // but HTML2 does at // http://www.w3.org/MarkUp/1995-archive/NonStandard.html // Listing is not supported by browsers. - Map.entry("listing", CDATA_SOMETIMES), - Map.entry("xmp", CDATA), + j8().mapEntry("listing", CDATA_SOMETIMES), + j8().mapEntry("xmp", CDATA), // Technically, noembed, noscript and noframes are CDATA_SOMETIMES but // we can only be hurt by allowing tag content that looks like text so @@ -98,40 +99,40 @@ public enum HtmlTextEscapingMode { //.put("noembed", CDATA_SOMETIMES) //.put("noframes", CDATA_SOMETIMES) //.put("noscript", CDATA_SOMETIMES) - Map.entry("comment", CDATA_SOMETIMES), // IE only + j8().mapEntry("comment", CDATA_SOMETIMES), // IE only // Runs till end of file. - Map.entry("plaintext", PLAIN_TEXT), + j8().mapEntry("plaintext", PLAIN_TEXT), - Map.entry("script", CDATA), - Map.entry("style", CDATA), + j8().mapEntry("script", CDATA), + j8().mapEntry("style", CDATA), // Textarea and Title are RCDATA, not CDATA, so decode entity references. - Map.entry("textarea", RCDATA), - Map.entry("title", RCDATA), + j8().mapEntry("textarea", RCDATA), + j8().mapEntry("title", RCDATA), // Nodes that can't contain content. // http://www.w3.org/TR/html-markup/syntax.html#void-elements - Map.entry("area", VOID), - Map.entry("base", VOID), - Map.entry("br", VOID), - Map.entry("col", VOID), - Map.entry("command", VOID), - Map.entry("embed", VOID), - Map.entry("hr", VOID), - Map.entry("img", VOID), - Map.entry("input", VOID), - Map.entry("keygen", VOID), - Map.entry("link", VOID), - Map.entry("meta", VOID), - Map.entry("param", VOID), - Map.entry("source", VOID), - Map.entry("track", VOID), - Map.entry("wbr", VOID), + j8().mapEntry("area", VOID), + j8().mapEntry("base", VOID), + j8().mapEntry("br", VOID), + j8().mapEntry("col", VOID), + j8().mapEntry("command", VOID), + j8().mapEntry("embed", VOID), + j8().mapEntry("hr", VOID), + j8().mapEntry("img", VOID), + j8().mapEntry("input", VOID), + j8().mapEntry("keygen", VOID), + j8().mapEntry("link", VOID), + j8().mapEntry("meta", VOID), + j8().mapEntry("param", VOID), + j8().mapEntry("source", VOID), + j8().mapEntry("track", VOID), + j8().mapEntry("wbr", VOID), // EMPTY per http://www.w3.org/TR/REC-html32#basefont - Map.entry("basefont", VOID), - Map.entry("isindex", VOID)); + j8().mapEntry("basefont", VOID), + j8().mapEntry("isindex", VOID)); /** diff --git a/src/main/java/org/owasp/html/HtmlToken.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlToken.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlToken.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlToken.java diff --git a/src/main/java/org/owasp/html/HtmlTokenType.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlTokenType.java similarity index 100% rename from src/main/java/org/owasp/html/HtmlTokenType.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlTokenType.java diff --git a/src/main/java/org/owasp/html/IntVector.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/IntVector.java similarity index 100% rename from src/main/java/org/owasp/html/IntVector.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/IntVector.java diff --git a/src/main/java/org/owasp/html/Joinable.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Joinable.java similarity index 100% rename from src/main/java/org/owasp/html/Joinable.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/Joinable.java diff --git a/src/main/java/org/owasp/html/JoinedAttributePolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/JoinedAttributePolicy.java similarity index 100% rename from src/main/java/org/owasp/html/JoinedAttributePolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/JoinedAttributePolicy.java diff --git a/src/main/java/org/owasp/html/PolicyFactory.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/PolicyFactory.java similarity index 100% rename from src/main/java/org/owasp/html/PolicyFactory.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/PolicyFactory.java diff --git a/src/main/java/org/owasp/html/Sanitizers.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Sanitizers.java similarity index 100% rename from src/main/java/org/owasp/html/Sanitizers.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/Sanitizers.java diff --git a/src/main/java/org/owasp/html/SrcsetAttributePolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/SrcsetAttributePolicy.java similarity index 100% rename from src/main/java/org/owasp/html/SrcsetAttributePolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/SrcsetAttributePolicy.java diff --git a/src/main/java/org/owasp/html/StandardUrlAttributePolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/StandardUrlAttributePolicy.java similarity index 100% rename from src/main/java/org/owasp/html/StandardUrlAttributePolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/StandardUrlAttributePolicy.java diff --git a/src/main/java/org/owasp/html/Strings.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Strings.java similarity index 100% rename from src/main/java/org/owasp/html/Strings.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/Strings.java diff --git a/src/main/java/org/owasp/html/StylingPolicy.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/StylingPolicy.java similarity index 100% rename from src/main/java/org/owasp/html/StylingPolicy.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/StylingPolicy.java diff --git a/src/main/java/org/owasp/html/TCB.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TCB.java similarity index 100% rename from src/main/java/org/owasp/html/TCB.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/TCB.java diff --git a/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java similarity index 97% rename from src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java index a437baec..4fd86423 100644 --- a/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java @@ -29,6 +29,7 @@ package org.owasp.html; import java.util.ArrayList; +import java.util.Arrays; import java.util.BitSet; import java.util.List; @@ -110,9 +111,9 @@ public void openTag(String elementName, List attrs) { if (openElements.size() < nestingLimit) { underlying.openTag(METADATA.canonNameForIndex(elIndex), attrs); - } - if (!HtmlTextEscapingMode.isVoidElement(canonElementName)) { - openElements.add(elIndex); + if (!HtmlTextEscapingMode.isVoidElement(canonElementName)) { + openElements.add(elIndex); + } } } @@ -482,9 +483,7 @@ private static boolean hasSpecialTextMode(int elementIndex) { // "element in select scope" // "element in table scope" SCOPE_FOR_END_TAG = new byte[METADATA.nElementTypes()]; - for (int i = 0; i < SCOPE_FOR_END_TAG.length; ++i) { - SCOPE_FOR_END_TAG[i] = IN; - } + Arrays.fill(SCOPE_FOR_END_TAG, IN); SCOPE_FOR_END_TAG[METADATA.indexForName("caption")] = SCOPE_FOR_END_TAG[METADATA.indexForName("col")] = SCOPE_FOR_END_TAG[METADATA.indexForName("colgroup")] @@ -504,7 +503,12 @@ private static boolean hasSpecialTextMode(int elementIndex) { private void dumpState(String msg) { System.err.println(msg); System.err.println("\tstack"); - for (int i = 0, n = openElements.size(); i < n; ++i) { + int nOpen = openElements.size(); + int maxStackToDump = 5; + if (nOpen > maxStackToDump) { + System.err.println("\t\t" + (nOpen - maxStackToDump) + " elided"); + } + for (int i = Math.max(0, nOpen - maxStackToDump); i < nOpen; ++i) { int idx = openElements.get(i); System.err.println("\t\t" + METADATA.canonNameForIndex(idx)); } diff --git a/src/main/java/org/owasp/html/TokenStream.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TokenStream.java similarity index 100% rename from src/main/java/org/owasp/html/TokenStream.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/TokenStream.java diff --git a/src/main/java/org/owasp/html/Trie.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Trie.java similarity index 100% rename from src/main/java/org/owasp/html/Trie.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/Trie.java diff --git a/src/main/java/org/owasp/html/examples/EbayPolicyExample.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/examples/EbayPolicyExample.java similarity index 100% rename from src/main/java/org/owasp/html/examples/EbayPolicyExample.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/examples/EbayPolicyExample.java diff --git a/src/main/java/org/owasp/html/examples/SlashdotPolicyExample.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/examples/SlashdotPolicyExample.java similarity index 100% rename from src/main/java/org/owasp/html/examples/SlashdotPolicyExample.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/examples/SlashdotPolicyExample.java diff --git a/src/main/java/org/owasp/html/examples/UrlTextExample.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/examples/UrlTextExample.java similarity index 100% rename from src/main/java/org/owasp/html/examples/UrlTextExample.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/examples/UrlTextExample.java diff --git a/src/main/java/org/owasp/html/package-info.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/package-info.java similarity index 100% rename from src/main/java/org/owasp/html/package-info.java rename to owasp-java-html-sanitizer/src/main/java/org/owasp/html/package-info.java diff --git a/src/test/java/org/owasp/html/AllExamples.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/AllExamples.java similarity index 100% rename from src/test/java/org/owasp/html/AllExamples.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/AllExamples.java diff --git a/src/test/java/org/owasp/html/AntiSamyBenchmark.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/AntiSamyBenchmark.java similarity index 100% rename from src/test/java/org/owasp/html/AntiSamyBenchmark.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/AntiSamyBenchmark.java diff --git a/src/test/java/org/owasp/html/AntiSamyTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/AntiSamyTest.java similarity index 100% rename from src/test/java/org/owasp/html/AntiSamyTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/AntiSamyTest.java diff --git a/src/test/java/org/owasp/html/Benchmark.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/Benchmark.java similarity index 99% rename from src/test/java/org/owasp/html/Benchmark.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/Benchmark.java index ea172b7d..e4a917ad 100644 --- a/src/test/java/org/owasp/html/Benchmark.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/Benchmark.java @@ -147,7 +147,7 @@ private static String sanitize(String html) { StringBuilder sb = new StringBuilder(html.length()); final HtmlStreamRenderer renderer = HtmlStreamRenderer.create( - sb, new Handler<>() { + sb, new Handler() { public void handle(String x) { throw new AssertionError(x); diff --git a/src/test/java/org/owasp/html/CssFuzzerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssFuzzerTest.java similarity index 100% rename from src/test/java/org/owasp/html/CssFuzzerTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssFuzzerTest.java diff --git a/src/test/java/org/owasp/html/CssGrammarTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssGrammarTest.java similarity index 100% rename from src/test/java/org/owasp/html/CssGrammarTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssGrammarTest.java diff --git a/src/test/java/org/owasp/html/CssSchemaTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssSchemaTest.java similarity index 100% rename from src/test/java/org/owasp/html/CssSchemaTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssSchemaTest.java diff --git a/src/test/java/org/owasp/html/CssTokensTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssTokensTest.java similarity index 100% rename from src/test/java/org/owasp/html/CssTokensTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssTokensTest.java diff --git a/src/test/java/org/owasp/html/ElementPolicyTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/ElementPolicyTest.java similarity index 94% rename from src/test/java/org/owasp/html/ElementPolicyTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/ElementPolicyTest.java index 00a4aff5..e612d204 100644 --- a/src/test/java/org/owasp/html/ElementPolicyTest.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/ElementPolicyTest.java @@ -13,6 +13,7 @@ import static org.owasp.html.ElementPolicy.REJECT_ALL_ELEMENT_POLICY; import static org.owasp.html.ElementPolicy.IDENTITY_ELEMENT_POLICY; import static org.owasp.html.ElementPolicy.Util.join; +import static org.owasp.shim.Java8Shim.j8; @SuppressWarnings("javadoc") public final class ElementPolicyTest extends TestCase { @@ -47,11 +48,11 @@ private static void assertPassed(ElementPolicy p, String... expected) { assertEquals(p.toString(), Arrays.asList(expected), actual); } - private static List TEST_EL_NAMES = List.of( + private static List TEST_EL_NAMES = j8().listOf( "abacus", "abracadabra", "bar", "foo", "far", "cadr", "cdr"); @Test - public static final void testJoin() { + public final void testJoin() { ElementPolicy a = new HasCharElementPolicy('a'); ElementPolicy b = new HasCharElementPolicy('b'); ElementPolicy c = new HasCharElementPolicy('c'); diff --git a/src/test/java/org/owasp/html/EncodingTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/EncodingTest.java similarity index 100% rename from src/test/java/org/owasp/html/EncodingTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/EncodingTest.java diff --git a/src/test/java/org/owasp/html/ExamplesTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/ExamplesTest.java similarity index 100% rename from src/test/java/org/owasp/html/ExamplesTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/ExamplesTest.java diff --git a/src/test/java/org/owasp/html/FuzzyTestCase.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/FuzzyTestCase.java similarity index 100% rename from src/test/java/org/owasp/html/FuzzyTestCase.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/FuzzyTestCase.java diff --git a/src/test/java/org/owasp/html/HtmlChangeReporterTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlChangeReporterTest.java similarity index 98% rename from src/test/java/org/owasp/html/HtmlChangeReporterTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlChangeReporterTest.java index 20643932..3b8f4357 100644 --- a/src/test/java/org/owasp/html/HtmlChangeReporterTest.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlChangeReporterTest.java @@ -40,14 +40,14 @@ static class Context { } @Test - public static final void testChangeReporting() { + public final void testChangeReporting() { final Context testContext = new Context(); StringBuilder out = new StringBuilder(); final StringBuilder log = new StringBuilder(); HtmlStreamRenderer renderer = HtmlStreamRenderer.create( out, Handler.DO_NOTHING); - HtmlChangeListener listener = new HtmlChangeListener<>() { + HtmlChangeListener listener = new HtmlChangeListener() { public void discardedTag(Context context, String elementName) { assertSame(testContext, context); log.append('<').append(elementName).append("> "); diff --git a/src/test/java/org/owasp/html/HtmlElementTablesTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlElementTablesTest.java similarity index 100% rename from src/test/java/org/owasp/html/HtmlElementTablesTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlElementTablesTest.java diff --git a/src/test/java/org/owasp/html/HtmlLexerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlLexerTest.java similarity index 100% rename from src/test/java/org/owasp/html/HtmlLexerTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlLexerTest.java diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderFuzzerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderFuzzerTest.java similarity index 100% rename from src/test/java/org/owasp/html/HtmlPolicyBuilderFuzzerTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderFuzzerTest.java diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java similarity index 86% rename from src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java index 6655e5c8..3ac35180 100644 --- a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java @@ -28,23 +28,21 @@ package org.owasp.html; -import java.util.Arrays; -import java.util.Collections; import java.util.List; import java.util.Locale; -import java.util.Map; -import java.util.Set; import java.util.regex.Pattern; -import java.util.stream.Collectors; import org.junit.Test; import junit.framework.TestCase; -@SuppressWarnings("javadoc") +import static org.owasp.shim.Java8Shim.j8; + +@SuppressWarnings({"javadoc", "HttpUrlsUsage", "RedundantSuppression", "UnnecessaryUnicodeEscape"}) public class HtmlPolicyBuilderTest extends TestCase { - static final String EXAMPLE = Arrays.stream(new String[] { + static final String EXAMPLE = String.join( + "\n", "

Header

", "

Paragraph 1

", ("

Click me" @@ -56,12 +54,14 @@ public class HtmlPolicyBuilderTest extends TestCase { " /* direction: ltr */; font-weight: bold'>Stylish Para 1

", "

Stylish Para 2

", - ""}).collect(Collectors.joining("\n")); + ""); @Test - public static final void testTextFilter() { + public final void testTextFilter() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", + "Header", "Paragraph 1", "Click me out", @@ -69,14 +69,15 @@ public static final void testTextFilter() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder())); } @Test - public static final void testCannedFormattingTagFilter() { + public final void testCannedFormattingTagFilter() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", "Click me out", @@ -84,15 +85,16 @@ public static final void testCannedFormattingTagFilter() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowCommonInlineFormattingElements())); } @Test - public static final void testCannedFormattingTagFilterNoItalics() { + public final void testCannedFormattingTagFilterNoItalics() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", "Click me out", @@ -100,16 +102,17 @@ public static final void testCannedFormattingTagFilterNoItalics() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowCommonInlineFormattingElements() .disallowElements("I"))); } @Test - public static final void testSimpleTagFilter() { + public final void testSimpleTagFilter() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "

Header

", "Paragraph 1", "Click me out", @@ -117,15 +120,16 @@ public static final void testSimpleTagFilter() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("h1", "i"))); } @Test - public static final void testLinksAllowed() { + public final void testLinksAllowed() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", // We haven't allowed any protocols so only relative URLs are OK. @@ -134,16 +138,17 @@ public static final void testLinksAllowed() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href").onElements("a"))); } @Test - public static final void testExternalLinksAllowed() { + public final void testExternalLinksAllowed() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", "Click me" @@ -152,7 +157,7 @@ public static final void testExternalLinksAllowed() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("a") // Allows http. @@ -161,9 +166,10 @@ public static final void testExternalLinksAllowed() { } @Test - public static final void testLinksWithNofollow() { + public final void testLinksWithNofollow() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", "Click me out", @@ -171,7 +177,7 @@ public static final void testLinksWithNofollow() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("a") // Allows http. @@ -180,7 +186,7 @@ public static final void testLinksWithNofollow() { } @Test - public static final void testLinksWithNofollowAlreadyPresent() { + public final void testLinksWithNofollowAlreadyPresent() { assertEquals( "html link", apply( @@ -192,9 +198,10 @@ public static final void testLinksWithNofollowAlreadyPresent() { } @Test - public static final void testImagesAllowed() { + public final void testImagesAllowed() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", "Click me out", @@ -203,7 +210,7 @@ public static final void testImagesAllowed() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("img") .allowAttributes("src", "alt").onElements("img") @@ -211,9 +218,10 @@ public static final void testImagesAllowed() { } @Test - public static final void testStyleFiltering() { + public final void testStyleFiltering() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "

Header

", "

Paragraph 1

", "

Click me out

", @@ -223,7 +231,7 @@ public static final void testStyleFiltering() { + "Stylish Para 1

"), ("

" + "Stylish Para 2

"), - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowCommonInlineFormattingElements() .allowCommonBlockElements() @@ -234,7 +242,8 @@ public static final void testStyleFiltering() { @Test public void testSpecificStyleFilterung() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "

Header

", "

Paragraph 1

", "

Click me out

", @@ -242,19 +251,20 @@ public void testSpecificStyleFilterung() { "

Fancy with soupy tags.", "

Stylish Para 1

", "

Stylish Para 2

", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowCommonInlineFormattingElements() .allowCommonBlockElements() .allowStyling(CssSchema.withProperties( - List.of("color", "text-align", "font-size"))) + j8().listOf("color", "text-align", "font-size"))) .allowStandardUrlProtocols())); } @Test public void testCustomPropertyStyleFiltering() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "

Header

", "

Paragraph 1

", "

Click me out

", @@ -262,23 +272,25 @@ public void testCustomPropertyStyleFiltering() { "

Fancy with soupy tags.", "

Stylish Para 1

", "

Stylish Para 2

", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowCommonInlineFormattingElements() .allowCommonBlockElements() .allowStyling( CssSchema.withProperties( - Map.of("text-align", - new CssSchema.Property(0, - Set.of("center"), - Collections.emptyMap())))) + j8().mapOfEntries( + j8().mapEntry("text-align", + new CssSchema.Property(0, + j8().setOf("center"), + j8().mapOfEntries()))))) .allowStandardUrlProtocols())); } @Test public void testUnionStyleFiltering() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "

Header

", "

Paragraph 1

", "

Click me out

", @@ -286,21 +298,22 @@ public void testUnionStyleFiltering() { "

Fancy with soupy tags.", "

Stylish Para 1

", "

Stylish Para 2

", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowCommonInlineFormattingElements() .allowCommonBlockElements() .allowStyling(CssSchema.withProperties( - List.of("color", "text-align"))) + j8().listOf("color", "text-align"))) .allowStyling( // union allowed style properties - CssSchema.withProperties(List.of("font-size"))) + CssSchema.withProperties(j8().listOf("font-size"))) .allowStandardUrlProtocols())); } @Test public void testCustomPropertyStyleFilteringDisallowed() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "

Header

", "

Paragraph 1

", "

Click me out

", @@ -308,23 +321,25 @@ public void testCustomPropertyStyleFilteringDisallowed() { "

Fancy with soupy tags.", "

Stylish Para 1

", "

Stylish Para 2

", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowCommonInlineFormattingElements() .allowCommonBlockElements() .allowStyling( CssSchema.withProperties( - Map.of("text-align", - new CssSchema.Property(0, - Set.of("left", "right"), - Collections.emptyMap())))) + j8().mapOfEntries( + j8().mapEntry("text-align", + new CssSchema.Property(0, + j8().setOf("left", "right"), + j8().mapOfEntries()))))) .allowStandardUrlProtocols())); } @Test - public static final void testElementTransforming() { + public final void testElementTransforming() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "
Header
", "

Paragraph 1

", "

Click me out

", @@ -332,40 +347,35 @@ public static final void testElementTransforming() { "

Fancy with soupy tags.", "

Stylish Para 1

", "

Stylish Para 2

", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("h1", "p", "div") .allowElements( - new ElementPolicy() { - public String apply( - String elementName, List attrs) { - attrs.add("class"); - attrs.add("header-" + elementName); - return "div"; - } - }, "h1"))); + (elementName, attrs) -> { + attrs.add("class"); + attrs.add("header-" + elementName); + return "div"; + }, + "h1"))); } @Test - public static final void testBodyTransforming() { + public final void testBodyTransforming() { assertEquals( "
foo
", apply( new HtmlPolicyBuilder() .allowElements( - new ElementPolicy() { - public String apply(String elementName, List attrs) { - return "div"; - } - }, + (elementName, attrs) -> "div", "body") .allowElements("div"), "foo")); } @Test - public static final void testAllowUrlProtocols() { + public final void testAllowUrlProtocols() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", "Click me out", @@ -374,7 +384,7 @@ public static final void testAllowUrlProtocols() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("img") .allowAttributes("src", "alt").onElements("img") @@ -382,9 +392,10 @@ public static final void testAllowUrlProtocols() { } @Test - public static final void testDisallowUrlProtocols() { + public final void testDisallowUrlProtocols() { assertEquals( - Arrays.stream(new String[] { + String.join( + "\n", "Header", "Paragraph 1", "Click me out", @@ -392,7 +403,7 @@ public static final void testDisallowUrlProtocols() { "Fancy with soupy tags.", "Stylish Para 1", "Stylish Para 2", - ""}).collect(Collectors.joining("\n")), + ""), apply(new HtmlPolicyBuilder() .allowElements("img") .allowAttributes("src", "alt").onElements("img") @@ -401,7 +412,7 @@ public static final void testDisallowUrlProtocols() { } @Test - public static final void testPossibleFalloutFromIssue5() { + public final void testPossibleFalloutFromIssue5() { assertEquals( "Bad", apply( @@ -414,7 +425,7 @@ public static final void testPossibleFalloutFromIssue5() { } @Test - public static final void testTextInOption() { + public final void testTextInOption() { assertEquals( "", apply( @@ -425,7 +436,7 @@ public static final void testTextInOption() { } @Test - public static final void testEntities() { + public final void testEntities() { assertEquals( "(Foo)\u00a0(Bar)\u2666\u2666\u2666\u2666(Baz)" + "𔠴𔠴𔠴(Boo)", @@ -436,7 +447,7 @@ public static final void testEntities() { } @Test - public static final void testImageTag() { + public final void testImageTag() { assertEquals( "" + "" @@ -463,7 +474,7 @@ public String apply(String elementName, List attrs) { } @Test - public static final void testImgSrcsetSyntax() { + public final void testImgSrcsetSyntax() { assertEquals( "" + "\n" @@ -523,7 +534,7 @@ public static final void testImgSrcsetSyntax() { } @Test - public static final void testUrlChecksLayer() { + public final void testUrlChecksLayer() { assertEquals( "" + "\n" @@ -546,7 +557,7 @@ public static final void testUrlChecksLayer() { } @Test - public static final void testDuplicateAttributesDoNotReachElementPolicy() { + public final void testDuplicateAttributesDoNotReachElementPolicy() { final int[] idCount = new int[1]; assertEquals( // The id that is emitted is the first that passes the attribute @@ -584,7 +595,7 @@ public String apply( } @Test - public static final void testPreprocessors() { + public final void testPreprocessors() { String input = "

one

Two!

three

" + "

Four

5
seis
"; @@ -654,7 +665,7 @@ public String toString() { @Test - public static final void testPostprocessors() { + public final void testPostprocessors() { String input = "

one

TWO!

three

" + "

Four

5
seis
"; @@ -732,7 +743,7 @@ public String toString() { } @Test - public static final void testBackgroundImageWithUrl() { + public final void testBackgroundImageWithUrl() { PolicyFactory policy = new HtmlPolicyBuilder() .allowStandardUrlProtocols() .allowStyling() @@ -756,7 +767,7 @@ public static final void testBackgroundImageWithUrl() { } @Test - public static final void testBackgroundImageWithImageFunction() { + public final void testBackgroundImageWithImageFunction() { PolicyFactory policy = new HtmlPolicyBuilder() .allowStandardUrlProtocols() .allowStyling() @@ -780,7 +791,7 @@ public static final void testBackgroundImageWithImageFunction() { } @Test - public static final void testBackgroundWithUrls() { + public final void testBackgroundWithUrls() { HtmlPolicyBuilder builder = new HtmlPolicyBuilder() .allowStandardUrlProtocols() .allowStyling() @@ -803,7 +814,7 @@ public static final void testBackgroundWithUrls() { } @Test - public static final void testBackgroundsThatViolateGlobalUrlPolicy() { + public final void testBackgroundsThatViolateGlobalUrlPolicy() { PolicyFactory policy = new HtmlPolicyBuilder() .allowStandardUrlProtocols() .allowStyling() @@ -820,7 +831,7 @@ public static final void testBackgroundsThatViolateGlobalUrlPolicy() { } @Test - public static final void testSpanTagFilter() { + public final void testSpanTagFilter() { PolicyFactory policy = new HtmlPolicyBuilder() .allowElements("span") .allowWithoutAttributes("span") @@ -834,7 +845,7 @@ public static final void testSpanTagFilter() { } @Test - public static final void testLinkRels() { + public final void testLinkRels() { HtmlPolicyBuilder b = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href").onElements("a") @@ -883,7 +894,7 @@ public static final void testLinkRels() { } @Test - public static final void testLinkRelsWhenRelPresent() { + public final void testLinkRelsWhenRelPresent() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href").onElements("a") @@ -925,7 +936,7 @@ public final void testRelLinksWhenRelIsPartOfData() { } @Test - public static final void testRelLinksWithDuplicateRels() { + public final void testRelLinksWithDuplicateRels() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href").onElements("a") @@ -937,7 +948,7 @@ public static final void testRelLinksWithDuplicateRels() { } @Test - public static final void testRelLinksWithDuplicateRelsRequired() { + public final void testRelLinksWithDuplicateRelsRequired() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href").onElements("a") @@ -950,7 +961,7 @@ public static final void testRelLinksWithDuplicateRelsRequired() { } @Test - public static final void testFailFastOnSpaceSeparatedStrings() { + public final void testFailFastOnSpaceSeparatedStrings() { boolean failed; try { // Should be ("nofollow", "noreferrer") @@ -970,7 +981,7 @@ public static final void testFailFastOnSpaceSeparatedStrings() { } @Test - public static final void testEmptyDefaultLinkRelsSet() { + public final void testEmptyDefaultLinkRelsSet() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href", "target").onElements("a") @@ -984,7 +995,7 @@ public static final void testEmptyDefaultLinkRelsSet() { } @Test - public static final void testRequireAndSkipRels() { + public final void testRequireAndSkipRels() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href", "target").onElements("a") @@ -1007,7 +1018,7 @@ public static final void testRequireAndSkipRels() { } @Test - public static final void testSkipAndRequireRels() { + public final void testSkipAndRequireRels() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href", "target").onElements("a") @@ -1030,10 +1041,10 @@ public static final void testSkipAndRequireRels() { } @Test - public static final void testOverflowWrap() { + public final void testOverflowWrap() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("span") - .allowStyling(CssSchema.union(CssSchema.DEFAULT, CssSchema.withProperties(List.of("overflow-wrap")))) + .allowStyling(CssSchema.union(CssSchema.DEFAULT, CssSchema.withProperties(j8().listOf("overflow-wrap")))) .toFactory(); assertEquals( @@ -1050,7 +1061,7 @@ public static final void testOverflowWrap() { } @Test - public static final void testOverflowWrapNotAllowed() { + public final void testOverflowWrapNotAllowed() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("span") .allowStyling() @@ -1062,7 +1073,7 @@ public static final void testOverflowWrapNotAllowed() { } @Test - public static final void testExplicitRelsSkip() { + public final void testExplicitRelsSkip() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("a") .allowAttributes("href", "target", "rel").onElements("a") @@ -1088,7 +1099,7 @@ public static final void testExplicitRelsSkip() { } @Test - public static final void testScopingExitInNoContent() { + public final void testScopingExitInNoContent() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("table", "tr", "td", "noscript") .toFactory(); @@ -1100,7 +1111,7 @@ public static final void testScopingExitInNoContent() { } @Test - public static final void testIssue80() { + public final void testIssue80() { PolicyFactory pf = new HtmlPolicyBuilder() .allowElements("table", "tr", "td", "tbody") .toFactory(); @@ -1117,7 +1128,7 @@ public static final void testIssue80() { } @Test - public static final void testDirLi() { + public final void testDirLi() { assertEquals( "
  • something
    • ", apply( @@ -1186,25 +1197,23 @@ public void testCreativeCSSStyling() { } @Test - public static void testScriptTagWithCommentBlockContainingHtmlCommentEnd() { + public final void testScriptTagWithCommentBlockContainingHtmlCommentEnd() { PolicyFactory scriptSanitizer = new HtmlPolicyBuilder() // allow scripts of type application/json .allowElements( - new ElementPolicy() { - public String apply(String elementName, List attrs) { - int typeIndex = attrs.indexOf("type"); - if (typeIndex < 0 || attrs.size() < typeIndex + 1 - || !attrs.get(typeIndex + 1).equals("application/json")) { - return null; - } - return elementName; + (elementName, attrs) -> { + int typeIndex = attrs.indexOf("type"); + if (typeIndex < 0 || attrs.size() < typeIndex + 1 + || !attrs.get(typeIndex + 1).equals("application/json")) { + return null; } + return elementName; }, "script") // allow contents in this script tag .allowTextIn("script") // keep type attribute in application/json script tag - .allowAttributes("type").matching(true, Set.of("application/json")).onElements("script") + .allowAttributes("type").matching(true, j8().setOf("application/json")).onElements("script") .toFactory(); String mismatchedHtmlComments = "')"); renderer.closeTag("script"); renderer.closeDocument(); @@ -373,7 +375,7 @@ public final void testUnclosedEscapingTextSpan() throws Exception { public final void testAlmostCompleteEndTag() throws Exception { renderer.openDocument(); - renderer.openTag("script", List.of()); + renderer.openTag("script", j8().listOf()); renderer.text("//of()); + renderer.openTag("noscript", j8().listOf()); renderer.text(""); renderer.closeTag("noscript"); renderer.closeDocument(); @@ -395,10 +397,10 @@ public final void testBalancedCommentInNoscript() throws Exception { public final void testUnbalancedCommentInNoscript() throws Exception { renderer.openDocument(); - renderer.openTag("noscript", List.of()); + renderer.openTag("noscript", j8().listOf()); renderer.text(""); renderer.closeTag("noscript"); renderer.closeDocument(); @@ -422,7 +424,7 @@ public final void testSupplementaryCodepoints() throws Exception { public final void testPreSubstitutes1() throws Exception { renderer.openDocument(); - renderer.openTag("Xmp", List.of()); + renderer.openTag("Xmp", j8().listOf()); renderer.text("
    Hello, World
    "); renderer.closeTag("Xmp"); renderer.closeDocument(); @@ -433,7 +435,7 @@ public final void testPreSubstitutes1() throws Exception { public final void testPreSubstitutes2() throws Exception { renderer.openDocument(); - renderer.openTag("xmp", List.of()); + renderer.openTag("xmp", j8().listOf()); renderer.text("
    Hello, World
    "); renderer.closeTag("xmp"); renderer.closeDocument(); @@ -444,7 +446,7 @@ public final void testPreSubstitutes2() throws Exception { public final void testPreSubstitutes3() throws Exception { renderer.openDocument(); - renderer.openTag("LISTING", List.of()); + renderer.openTag("LISTING", j8().listOf()); renderer.text("
    Hello, World
    "); renderer.closeTag("LISTING"); renderer.closeDocument(); @@ -455,7 +457,7 @@ public final void testPreSubstitutes3() throws Exception { public final void testPreSubstitutes4() throws Exception { renderer.openDocument(); - renderer.openTag("plaintext", List.of()); + renderer.openTag("plaintext", j8().listOf()); renderer.text("
    Hello, World
    "); renderer.closeDocument(); diff --git a/src/test/java/org/owasp/html/IntVectorTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/IntVectorTest.java similarity index 100% rename from src/test/java/org/owasp/html/IntVectorTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/IntVectorTest.java diff --git a/src/test/java/org/owasp/html/PolicyFactoryTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/PolicyFactoryTest.java similarity index 99% rename from src/test/java/org/owasp/html/PolicyFactoryTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/PolicyFactoryTest.java index b2871812..a497668f 100644 --- a/src/test/java/org/owasp/html/PolicyFactoryTest.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/PolicyFactoryTest.java @@ -123,7 +123,7 @@ public static void testAnd() { final StringBuilder out = new StringBuilder(); // A noisy listener that logs. - HtmlChangeListener listener = new HtmlChangeListener<>() { + HtmlChangeListener listener = new HtmlChangeListener() { public void discardedTag(Object ctx, String elementName) { assertEquals(context, ctx); @@ -141,7 +141,7 @@ public void discardedAttributes( }; - Handler ioHandler = new Handler<>() { + Handler ioHandler = new Handler() { public void handle(IOException x) { log.append("Handled IOException " + x.getMessage() + "\n"); @@ -150,7 +150,7 @@ public void handle(IOException x) { }; // Should not be called. - Handler badHtmlHandler = new Handler<>() { + Handler badHtmlHandler = new Handler() { public void handle(String x) { throw new AssertionError(x); diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/SanitizersTest.java similarity index 99% rename from src/test/java/org/owasp/html/SanitizersTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/SanitizersTest.java index bce8f537..5ad6f501 100644 --- a/src/test/java/org/owasp/html/SanitizersTest.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/SanitizersTest.java @@ -584,7 +584,7 @@ private static class Permutations implements Iterable> { } public Iterator> iterator() { - return new Iterator<>() { + return new Iterator>() { private int i; private final int limit; private final BitSet mask; diff --git a/src/test/java/org/owasp/html/StringsTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/StringsTest.java similarity index 100% rename from src/test/java/org/owasp/html/StringsTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/StringsTest.java diff --git a/src/test/java/org/owasp/html/StylingPolicyTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/StylingPolicyTest.java similarity index 100% rename from src/test/java/org/owasp/html/StylingPolicyTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/StylingPolicyTest.java diff --git a/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java similarity index 77% rename from src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java index 7a48d6ce..53c05bc1 100644 --- a/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java @@ -39,6 +39,7 @@ import junit.framework.TestCase; +import static org.owasp.shim.Java8Shim.j8; @SuppressWarnings("javadoc") public class TagBalancingHtmlStreamRendererTest extends TestCase { @@ -46,7 +47,7 @@ public class TagBalancingHtmlStreamRendererTest extends TestCase { StringBuilder htmlOutputBuffer; TagBalancingHtmlStreamEventReceiver balancer; - @Before @Override protected void setUp() throws Exception { + @Before @Override public void setUp() throws Exception { super.setUp(); htmlOutputBuffer = new StringBuilder(); balancer = new TagBalancingHtmlStreamEventReceiver( @@ -60,17 +61,17 @@ public void handle(String x) { @Test public final void testTagBalancing() { balancer.openDocument(); - balancer.openTag("html", List.of()); - balancer.openTag("head", List.of()); - balancer.openTag("title", List.of()); + balancer.openTag("html", j8().listOf()); + balancer.openTag("head", j8().listOf()); + balancer.openTag("title", j8().listOf()); balancer.text("Hello, <>!"); // TITLE closed with case-sensitively different name. balancer.closeTag("TITLE"); balancer.closeTag("head"); - balancer.openTag("body", List.of()); - balancer.openTag("p", List.of("id", "p'0")); + balancer.openTag("body", j8().listOf()); + balancer.openTag("p", j8().listOf("id", "p'0")); balancer.text("Hello,"); - balancer.openTag("Br", List.of()); + balancer.openTag("Br", j8().listOf()); balancer.text("<>!"); // HTML, P, and BODY unclosed, but BR not. balancer.closeDocument(); @@ -85,9 +86,9 @@ public final void testTagBalancing() { @Test public final void testTagSoupIronedOut() { balancer.openDocument(); - balancer.openTag("i", List.of()); + balancer.openTag("i", j8().listOf()); balancer.text("x"); - balancer.openTag("b", List.of()); + balancer.openTag("b", j8().listOf()); balancer.text("y"); balancer.closeTag("i"); balancer.text("z"); @@ -101,12 +102,12 @@ public final void testTagSoupIronedOut() { @Test public final void testListInListDirectly() { balancer.openDocument(); - balancer.openTag("ul", List.of()); - balancer.openTag("li", List.of()); + balancer.openTag("ul", j8().listOf()); + balancer.openTag("li", j8().listOf()); balancer.text("foo"); balancer.closeTag("li"); - balancer.openTag("ul", List.of()); - balancer.openTag("li", List.of()); + balancer.openTag("ul", j8().listOf()); + balancer.openTag("li", j8().listOf()); balancer.text("bar"); balancer.closeTag("li"); balancer.closeTag("ul"); @@ -121,28 +122,28 @@ public final void testListInListDirectly() { @Test public final void testTextContent() { balancer.openDocument(); - balancer.openTag("title", List.of()); + balancer.openTag("title", j8().listOf()); balancer.text("Hello, World!"); balancer.closeTag("title"); balancer.text("Hello, "); - balancer.openTag("b", List.of()); + balancer.openTag("b", j8().listOf()); balancer.text("World!"); balancer.closeTag("b"); - balancer.openTag("p", List.of()); + balancer.openTag("p", j8().listOf()); balancer.text("Hello, "); - balancer.openTag("textarea", List.of()); + balancer.openTag("textarea", j8().listOf()); balancer.text("World!"); balancer.closeTag("textarea"); balancer.closeTag("p"); - balancer.openTag("h1", List.of()); + balancer.openTag("h1", j8().listOf()); balancer.text("Hello"); - balancer.openTag("style", List.of("type", "text/css")); + balancer.openTag("style", j8().listOf("type", "text/css")); balancer.text("\n.World {\n color: blue\n}\n"); balancer.closeTag("style"); balancer.closeTag("h1"); - balancer.openTag("ul", List.of()); + balancer.openTag("ul", j8().listOf()); balancer.text("\n "); - balancer.openTag("li", List.of()); + balancer.openTag("li", j8().listOf()); balancer.text("Hello,"); balancer.closeTag("li"); balancer.text("\n "); @@ -170,20 +171,20 @@ public final void testTextContent() { @Test public final void testMismatchedHeaders() { balancer.openDocument(); - balancer.openTag("H1", List.of()); + balancer.openTag("H1", j8().listOf()); balancer.text("header"); balancer.closeTag("h1"); balancer.text("body"); - balancer.openTag("H2", List.of()); + balancer.openTag("H2", j8().listOf()); balancer.text("sub-header"); balancer.closeTag("h3"); balancer.text("sub-body"); - balancer.openTag("h3", List.of()); + balancer.openTag("h3", j8().listOf()); balancer.text("sub-sub-"); balancer.closeTag("hr"); // hr is not a header tag so does not close an h3. balancer.text("header"); //

    is not allowed in h3. - balancer.openTag("h3", List.of()); + balancer.openTag("h3", j8().listOf()); balancer.closeTag("h3"); balancer.text("sub-sub-body"); balancer.closeTag("H4"); @@ -201,10 +202,10 @@ public final void testMismatchedHeaders() { @Test public final void testListNesting() { balancer.openDocument(); - balancer.openTag("ul", List.of()); - balancer.openTag("li", List.of()); - balancer.openTag("ul", List.of()); - balancer.openTag("li", List.of()); + balancer.openTag("ul", j8().listOf()); + balancer.openTag("li", j8().listOf()); + balancer.openTag("ul", j8().listOf()); + balancer.openTag("li", j8().listOf()); balancer.text("foo"); balancer.closeTag("li"); // Does not closes the second
      since only and
    can close a @@ -212,8 +213,8 @@ public final void testListNesting() { // tree building algo. balancer.closeTag("li"); // This would append inside a list, not an item. We insert an
  • . - balancer.openTag("ul", List.of()); - balancer.openTag("li", List.of()); + balancer.openTag("ul", j8().listOf()); + balancer.openTag("li", j8().listOf()); balancer.text("bar"); balancer.closeDocument(); @@ -225,18 +226,18 @@ public final void testListNesting() { @Test public final void testTableNesting() { balancer.openDocument(); - balancer.openTag("table", List.of()); - balancer.openTag("tbody", List.of()); - balancer.openTag("tr", List.of()); - balancer.openTag("td", List.of()); + balancer.openTag("table", j8().listOf()); + balancer.openTag("tbody", j8().listOf()); + balancer.openTag("tr", j8().listOf()); + balancer.openTag("td", j8().listOf()); balancer.text("foo"); balancer.closeTag("td"); // Chrome does not insert a td to contain this mis-nested table. // Instead, it ends one table and starts another. - balancer.openTag("table", List.of()); - balancer.openTag("tbody", List.of()); - balancer.openTag("tr", List.of()); - balancer.openTag("th", List.of()); + balancer.openTag("table", j8().listOf()); + balancer.openTag("tbody", j8().listOf()); + balancer.openTag("tr", j8().listOf()); + balancer.openTag("th", j8().listOf()); balancer.text("bar"); balancer.closeTag("table"); balancer.closeTag("table"); @@ -257,7 +258,7 @@ public final void testNestingLimits() { balancer.setNestingLimit(10); balancer.openDocument(); - List attrs = List.of(); + List attrs = j8().listOf(); for (int i = 20000; --i >= 0;) { balancer.openTag("div", attrs); } @@ -273,29 +274,29 @@ public final void testNestingLimits() { public final void testTablesGuarded() { // Derived from issue 12. balancer.openDocument(); - balancer.openTag("html", List.of()); - balancer.openTag("head", List.of()); - balancer.openTag("meta", List.of()); + balancer.openTag("html", j8().listOf()); + balancer.openTag("head", j8().listOf()); + balancer.openTag("meta", j8().listOf()); balancer.closeTag("head"); - balancer.openTag("body", List.of()); - balancer.openTag("p", List.of()); + balancer.openTag("body", j8().listOf()); + balancer.openTag("p", j8().listOf()); balancer.text("Hi"); balancer.closeTag("p"); - balancer.openTag("p", List.of()); + balancer.openTag("p", j8().listOf()); balancer.text("How are you"); balancer.closeTag("p"); balancer.text("\n"); - balancer.openTag("ul", List.of()); - balancer.openTag("li", List.of()); - balancer.openTag("table", List.of()); - balancer.openTag("tbody", List.of()); - balancer.openTag("tr", List.of()); + balancer.openTag("ul", j8().listOf()); + balancer.openTag("li", j8().listOf()); + balancer.openTag("table", j8().listOf()); + balancer.openTag("tbody", j8().listOf()); + balancer.openTag("tr", j8().listOf()); for (int i = 2; --i >= 0;) { - balancer.openTag("td", List.of()); - balancer.openTag("b", List.of()); - balancer.openTag("font", List.of()); - balancer.openTag("font", List.of()); - balancer.openTag("p", List.of()); + balancer.openTag("td", j8().listOf()); + balancer.openTag("b", j8().listOf()); + balancer.openTag("font", j8().listOf()); + balancer.openTag("font", j8().listOf()); + balancer.openTag("p", j8().listOf()); balancer.text("Cell"); balancer.closeTag("p"); balancer.closeTag("font"); @@ -309,7 +310,7 @@ public final void testTablesGuarded() { balancer.closeTag("table"); balancer.closeTag("ul"); balancer.text("\n"); - balancer.openTag("p", List.of()); + balancer.openTag("p", j8().listOf()); balancer.text("x"); balancer.closeTag("p"); balancer.closeTag("body"); @@ -330,7 +331,7 @@ public final void testTablesGuarded() { } @Test - public static final void testIsInterElementWhitespace() { + public final void testIsInterElementWhitespace() { assertFalse(isInterElementWhitespace("foo")); assertTrue(isInterElementWhitespace("")); assertTrue(isInterElementWhitespace(" ")); @@ -348,11 +349,11 @@ public static final void testIsInterElementWhitespace() { @Test public final void testAnchorTransparentToBlock() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.openTag("a", hrefOnly); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.text("..."); balancer.closeTag("div"); balancer.closeTag("a"); @@ -367,11 +368,11 @@ public final void testAnchorTransparentToBlock() { @Test public final void testAnchorTransparentToSpans() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); - balancer.openTag("span", List.of()); + balancer.openTag("span", j8().listOf()); balancer.openTag("a", hrefOnly); - balancer.openTag("span", List.of()); + balancer.openTag("span", j8().listOf()); balancer.text("..."); balancer.closeTag("span"); balancer.closeTag("a"); @@ -386,11 +387,11 @@ public final void testAnchorTransparentToSpans() { @Test public final void testAnchorWithInlineInBlock() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.openTag("a", hrefOnly); - balancer.openTag("span", List.of()); + balancer.openTag("span", j8().listOf()); balancer.text("..."); balancer.closeTag("span"); balancer.closeTag("a"); @@ -404,9 +405,9 @@ public final void testAnchorWithInlineInBlock() { @Test public final void testDirectlyNestedAnchor() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); - balancer.openTag("span", List.of()); + balancer.openTag("span", j8().listOf()); balancer.openTag("a", hrefOnly); balancer.openTag("a", hrefOnly); balancer.text("..."); @@ -423,11 +424,11 @@ public final void testDirectlyNestedAnchor() { @Test public final void testAnchorClosedWhenBlockInInline() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); - balancer.openTag("span", List.of()); + balancer.openTag("span", j8().listOf()); balancer.openTag("a", hrefOnly); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.text("..."); balancer.closeTag("div"); balancer.closeTag("a"); @@ -446,11 +447,11 @@ public final void testAnchorClosedWhenBlockInInline() { @Test @Ignore public final void failingtestAnchorInAnchorIndirectly() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.openTag("a", hrefOnly); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.openTag("a", hrefOnly); balancer.text("..."); balancer.closeTag("a"); @@ -466,12 +467,12 @@ public final void failingtestAnchorInAnchorIndirectly() { @Test public final void testInteractiveInAnchorIndirectly() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.openTag("a", hrefOnly); - balancer.openTag("div", List.of()); - balancer.openTag("video", List.of()); + balancer.openTag("div", j8().listOf()); + balancer.openTag("video", j8().listOf()); balancer.closeTag("video"); balancer.closeTag("div"); balancer.closeTag("a"); @@ -484,10 +485,10 @@ public final void testInteractiveInAnchorIndirectly() { @Test public final void testAnchorWithBlockAtTopLevel() { - List hrefOnly = List.of("href", ""); + List hrefOnly = j8().listOf("href", ""); balancer.openDocument(); balancer.openTag("a", hrefOnly); - balancer.openTag("div", List.of()); + balancer.openTag("div", j8().listOf()); balancer.text("..."); balancer.closeTag("div"); balancer.closeTag("a"); @@ -500,11 +501,11 @@ public final void testAnchorWithBlockAtTopLevel() { @Test public final void testResumedElementsAllowedWhereResumed() { balancer.openDocument(); - balancer.openTag("a", List.of()); - balancer.openTag("b", List.of()); + balancer.openTag("a", j8().listOf()); + balancer.openTag("b", j8().listOf()); balancer.text("foo"); - balancer.openTag("i", List.of()); - balancer.openTag("a", List.of()); + balancer.openTag("i", j8().listOf()); + balancer.openTag("a", j8().listOf()); balancer.text("bar"); balancer.closeTag("a"); balancer.closeTag("i"); @@ -520,11 +521,11 @@ public final void testResumedElementsAllowedWhereResumed() { public final void testMenuItemNesting() { // issue 96 balancer.openDocument(); - balancer.openTag("div", List.of()); - balancer.openTag("menu", List.of()); - balancer.openTag("menuitem", List.of()); + balancer.openTag("div", j8().listOf()); + balancer.openTag("menu", j8().listOf()); + balancer.openTag("menuitem", j8().listOf()); balancer.closeTag("menuitem"); - balancer.openTag("menuitem", List.of()); + balancer.openTag("menuitem", j8().listOf()); balancer.closeTag("menuitem"); balancer.closeTag("menu"); balancer.closeTag("div"); diff --git a/src/test/java/org/owasp/html/UrlTextExampleTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/UrlTextExampleTest.java similarity index 100% rename from src/test/java/org/owasp/html/UrlTextExampleTest.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/UrlTextExampleTest.java diff --git a/src/test/java/org/owasp/html/VerboseTestRunner.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/VerboseTestRunner.java similarity index 100% rename from src/test/java/org/owasp/html/VerboseTestRunner.java rename to owasp-java-html-sanitizer/src/test/java/org/owasp/html/VerboseTestRunner.java diff --git a/src/test/resources/benchmark-data/Yahoo!.html b/owasp-java-html-sanitizer/src/test/resources/benchmark-data/Yahoo!.html similarity index 100% rename from src/test/resources/benchmark-data/Yahoo!.html rename to owasp-java-html-sanitizer/src/test/resources/benchmark-data/Yahoo!.html diff --git a/src/test/resources/org/owasp/html/htmllexergolden1.txt b/owasp-java-html-sanitizer/src/test/resources/org/owasp/html/htmllexergolden1.txt similarity index 100% rename from src/test/resources/org/owasp/html/htmllexergolden1.txt rename to owasp-java-html-sanitizer/src/test/resources/org/owasp/html/htmllexergolden1.txt diff --git a/src/test/resources/org/owasp/html/htmllexerinput1.html b/owasp-java-html-sanitizer/src/test/resources/org/owasp/html/htmllexerinput1.html similarity index 100% rename from src/test/resources/org/owasp/html/htmllexerinput1.html rename to owasp-java-html-sanitizer/src/test/resources/org/owasp/html/htmllexerinput1.html diff --git a/src/test/resources/osgi-integration-verification.xml b/owasp-java-html-sanitizer/src/test/resources/osgi-integration-verification.xml similarity index 100% rename from src/test/resources/osgi-integration-verification.xml rename to owasp-java-html-sanitizer/src/test/resources/osgi-integration-verification.xml diff --git a/parent/pom.xml b/parent/pom.xml deleted file mode 100644 index 968711c2..00000000 --- a/parent/pom.xml +++ /dev/null @@ -1,301 +0,0 @@ - - 4.0.0 - com.googlecode.owasp-java-html-sanitizer - parent - 20220608.2-SNAPSHOT - - pom - - OWASP Java HTML Sanitizer Project Parent - -A fast and easy to configure HTML Sanitizer written in Java which -lets you include HTML authored by third-parties in your web -application while protecting against XSS. - - https://github.com/OWASP/java-html-sanitizer - - - Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt - repo - - - - - scm:git:git://github.com/OWASP/java-html-sanitizer.git - scm:git:git://github.com/OWASP/java-html-sanitizer.git - https://github.com/OWASP/java-html-sanitizer - - - - - ossrh - https://oss.sonatype.org/content/repositories/snapshots - - - ossrh - https://oss.sonatype.org/service/local/staging/deploy/maven2/ - - - - - GitHub - https://github.com/OWASP/java-html-sanitizer/issues - - - - OWASP - https://owasp.org - - - - - mikesamuel - Mike Samuel - mikesamuel@gmail.com - - - - - - User Support List - owasp-java-html-sanitizer-support+subscribe@googlegroups.com - owasp-java-html-sanitizer-support+unsubscribe@googlegroups.com - https://groups.google.com/forum/#!forum/owasp-java-html-sanitizer-support - - - - - - - com.github.spotbugs - spotbugs-maven-plugin - 3.1.12.2 - - - Max - - Low - - - - - - - UTF-8 - UTF-8 - 9 - 9 - 9 - - - - - - - - external.atlassian.jgitflow - jgitflow-maven-plugin - 1.0-m5.1 - - true - true - true - true - - - - org.sonatype.plugins - nexus-staging-maven-plugin - 1.6.3 - true - - ossrh - https://oss.sonatype.org/ - true - - 199eb0ec1ec380 - - - default-deploy - deploy - - deploy - - - - - - - - org.apache.maven.plugins - maven-source-plugin - 2.2.1 - - - attach-sources - - jar-no-fork - - - - - - - org.apache.maven.plugins - maven-javadoc-plugin - 3.2.0 - - - attach-javadocs - - jar - - - - - true - public - UTF-8 - OWASP HTML Sanitizer - *.example - - -Xdoclint:-missing -html5 - - - - foo - bar - - - 6 - - - - org.apache.maven.plugins - maven-compiler-plugin - 3.3 - - 9 - 9 - - - - org.apache.maven.plugins - maven-deploy-plugin - 2.8.2 - - - org.apache.maven.plugins - maven-project-info-reports-plugin - 2.9 - - - org.jacoco - jacoco-maven-plugin - 0.8.3 - - - org.eluder.coveralls - coveralls-maven-plugin - 4.3.0 - - - - - javax.xml.bind - jaxb-api - 2.2.3 - - - - - org.apache.felix - maven-bundle-plugin - true - 3.5.0 - - - org.apache.maven.plugins - maven-verifier-plugin - 1.1 - - - - - - - - - commons-codec - commons-codec - [1.15,) - - - com.google.code.findbugs - jsr305 - [2.0.1,) - provided - - - com.google.code.findbugs - annotations - [2.0.1,) - provided - - - com.google.protobuf - protobuf-java - 3.16.3 - provided - - - junit - junit - 4.13.1 - test - - - - - - - release-sign-artifact - - - performRelease - true - - - - - - org.apache.maven.plugins - maven-gpg-plugin - 1.5 - - - sign-artifacts - verify - - sign - - - - - - - - - diff --git a/pom.xml b/pom.xml index 78532102..94bce32c 100644 --- a/pom.xml +++ b/pom.xml @@ -1,123 +1,78 @@ 4.0.0 - owasp-java-html-sanitizer - bundle - - parent - com.googlecode.owasp-java-html-sanitizer - parent - 20220608.2-SNAPSHOT - + com.googlecode.owasp-java-html-sanitizer + parent + 20220608.2-SNAPSHOT - OWASP Java HTML Sanitizer + pom + + + java8-shim + java10-shim + owasp-java-html-sanitizer + + + OWASP Java HTML Sanitizer Project Parent - Takes third-party HTML and produces HTML that is safe to embed in - your web application. - Fast and easy to configure. +A fast and easy to configure HTML Sanitizer written in Java which +lets you include HTML authored by third-parties in your web +application while protecting against XSS. + https://github.com/OWASP/java-html-sanitizer + + + Apache License, Version 2.0 + http://www.apache.org/licenses/LICENSE-2.0.txt + repo + + - - - - - org.jacoco - jacoco-maven-plugin - - - - jacoco-initialize - - prepare-agent - - - - jacoco-site - package - - report - - - - report - prepare-package - - report - - - - - - org.eluder.coveralls - coveralls-maven-plugin - - TENYw0IKRulLOXgkyzjGqNi0hQyhBiSiU - - - - org.apache.felix - maven-bundle-plugin - - - org.owasp.html - - - - - org.apache.maven.plugins - maven-verifier-plugin - - src/test/resources/osgi-integration-verification.xml - - - - main - verify - - verify - - - - - - + + scm:git:git://github.com/OWASP/java-html-sanitizer.git + scm:git:git://github.com/OWASP/java-html-sanitizer.git + https://github.com/OWASP/java-html-sanitizer + - - - commons-codec - commons-codec - test - - - com.google.code.findbugs - jsr305 - provided - - - com.google.code.findbugs - annotations - provided - - - junit - junit - test - - - nu.validator.htmlparser - htmlparser - 1.4 - test - - + + + ossrh + https://oss.sonatype.org/content/repositories/snapshots + + + ossrh + https://oss.sonatype.org/service/local/staging/deploy/maven2/ + + + + + GitHub + https://github.com/OWASP/java-html-sanitizer/issues + + + + OWASP + https://owasp.org + + + + + mikesamuel + Mike Samuel + mikesamuel@gmail.com + + + + + + User Support List + owasp-java-html-sanitizer-support+subscribe@googlegroups.com + owasp-java-html-sanitizer-support+unsubscribe@googlegroups.com + https://groups.google.com/forum/#!forum/owasp-java-html-sanitizer-support + + - - com.github.spotbugs spotbugs-maven-plugin @@ -135,4 +90,232 @@ + + + UTF-8 + UTF-8 + 8 + 1.8 + 1.8 + + + + + + + external.atlassian.jgitflow + jgitflow-maven-plugin + 1.0-m5.1 + + true + true + true + true + + + + org.sonatype.plugins + nexus-staging-maven-plugin + 1.6.3 + true + + ossrh + https://oss.sonatype.org/ + true + + 199eb0ec1ec380 + + + default-deploy + deploy + + deploy + + + + + + + + org.apache.maven.plugins + maven-source-plugin + 2.2.1 + + + attach-sources + + jar-no-fork + + + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 3.2.0 + + + attach-javadocs + + jar + + + + + true + public + UTF-8 + OWASP HTML Sanitizer + *.example + + -Xdoclint:-missing -html5 + + + + foo + bar + + + ${source.version} + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.13.0 + + ${source.version} + ${target.version} + ${release.version} + + + + + org.apache.maven.plugins + maven-deploy-plugin + 2.8.2 + + + org.apache.maven.plugins + maven-project-info-reports-plugin + 2.9 + + + org.jacoco + jacoco-maven-plugin + 0.8.3 + + + org.eluder.coveralls + coveralls-maven-plugin + 4.3.0 + + + + + javax.xml.bind + jaxb-api + 2.2.3 + + + + + org.apache.felix + maven-bundle-plugin + true + 3.5.0 + + + org.apache.maven.plugins + maven-verifier-plugin + 1.1 + + + + + + + + + com.googlecode.owasp-java-html-sanitizer + java8-shim + ${project.version} + + + com.googlecode.owasp-java-html-sanitizer + java10-shim + ${project.version} + + + commons-codec + commons-codec + [1.15,) + + + com.google.code.findbugs + jsr305 + [2.0.1,) + provided + + + com.google.code.findbugs + annotations + [2.0.1,) + provided + + + com.google.protobuf + protobuf-java + 3.16.3 + provided + + + junit + junit + 4.13.1 + test + + + + + + + release-sign-artifact + + + performRelease + true + + + + + + org.apache.maven.plugins + maven-gpg-plugin + 1.5 + + + sign-artifacts + verify + + sign + + + + + + + +