-
Notifications
You must be signed in to change notification settings - Fork 364
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
200 additions
and
0 deletions.
There are no files selected for viewing
200 changes: 200 additions & 0 deletions
200
documentation/esapi4java-core-2.5.1.0-release-notes.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,200 @@ | ||
| Release notes for ESAPI 2.5.1.0 | ||
| Release date: 2022-11-27 | ||
| Project leaders: | ||
| -Kevin W. Wall <kevin.w.wall@gmail.com> | ||
| -Matt Seil <matt.seil@owasp.org> | ||
|
|
||
| Previous release: ESAPI 2.5.0.0, 2022-07-20 | ||
|
|
||
|
|
||
| Executive Summary: Important Things to Note for this Release | ||
| ------------------------------------------------------------ | ||
| This is a patch release with the primary intent of updating some dependencies, some which addressed known vulnerabilities in these dependencies, but which we do not believe were exploitable via ESAPI. The major updates are: | ||
| * Updates to latest versions of direct dependencies, including: | ||
| - An update to AntiSamy: 1.7.0 --> 1.7.2 | ||
| - An update to SLFJ4 API: 1.7.36 --> 2.0.4 (Note: 2.0.5 is available and likely would would result in "convergence" issues with the version AntiSamy 1.7.2 pulls in) | ||
| * A new codec (org.owasp.esapi.codecs.JSONCodec) is provided that provides JSON output encoding as per section 7 of RFC 8259. It is made available via Encoder.encodeForJSON(). (Note unlike other encoders, there is no corresponding decoder (i.e., decodeForJSON()) made available. Since that would normally be done by your JavaScript code, it wasn't deemed essential. | ||
|
|
||
| For those of you using a Software Configuration Analysis (SCA) services such as Snyk, BlackDuck, Veracode SourceClear, OWASP Dependency Check, etc., you will notice that the 4 Log4J 1.x related CVEs are no longer flagged. This is because we have finally removed the Log4J 1.2.17 dependency in ESAPI 2.5.0.0. | ||
|
|
||
| Any remaining flagged vulnerabilities (e.g., CVE-2020-7791 for transitive dependency batik-i18n-1.14) are believed to be false postives. | ||
|
|
||
| You are encouraged to review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md and email us or contact us in our GitHub Discussions page if you have questions. | ||
|
|
||
|
|
||
| ================================================================================================================= | ||
|
|
||
| Basic ESAPI facts | ||
| ----------------- | ||
|
|
||
| ESAPI 2.5.0.0 release: | ||
| 206 Java source files | ||
| 4274 JUnit tests in 131 Java source files (0 tests skipped) | ||
|
|
||
| ESAPI 2.5.1.0 release: | ||
| 207 Java source files | ||
| 4292 JUnit tests in 131 Java source files (0 tests skipped) | ||
|
|
||
| 15 GitHub Issues closed in this release, including those we've decided not to fix (marked 'wontfix' and 'falsepositive'). | ||
| (Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D2022-07-20) | ||
|
|
||
| Issue # GitHub Issue Title | ||
| ---------------------------------------------------------------------------------------------- | ||
| 757 again .. [falsepositive] | ||
| 755 Upgrade batik-css-1.14 because of vulnerability | ||
| 754 JSON encoder | ||
| 749 Error in initializing org.owasp.esapi.logging.java.JavaLogFactory. [Converted to discussion #750.] | ||
| 747 Encoder class (org.owasp.esapi.reference.DefaultEncoder) CTOR threw exception [Converted to discussion #751] | ||
| 743 Indirect dependency to vulnerable Xerces, CVE-2017-10355 [falsepositive, wontfix] | ||
| 740 Update SLF4J log bridge to allow NULL EventTypes | ||
| 735 Improve ConfigurationException message thrown from EsapiPropertyLoaderFactory.createPropertyLoader() | ||
| 734 Change skin for mvn site report to use fluido Build-Maven | ||
| 733 Executing 'mvn site' does not produce tag documentation | ||
| 727 ESAPI - Not working with Eclipse [falsepositive, wontfix] | ||
| 710 JavaLogFactory configuration should not override custom java LogManager configuration | ||
| 610 Add Deprecation Logging content for Log4JLogFactory Usage | ||
| 527 Configuration flag for disabling Logger User and App Information [falsepositive] | ||
| 433 Class Cast Exception when trying to run JUnit Tests [question, wontfix] | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| Changes Requiring Special Attention | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| Important JDK Support Announcement | ||
| * ESAPI 2.3.0.0 was the last Java release to support Java 7. ESAPI 2.4.0 requires using Java 8 or later. See the ESAPI 2.4.0.0 release notes (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.4.0.0-release-notes.txt) for details as to the reason. | ||
| - This means if your project requires Java 7, you must use ESAPI 2.3.0.0 or earlier. | ||
|
|
||
| Important ESAPI Logging Changes | ||
|
|
||
| * Since ESAPI 2.5.0.0, support for logging directly via Log4J 1 has been removed. (This was two years after it haveing first been deprecated.) Thus, you only choice of ESAPI logging are | ||
| - java.util.logging (JUL), which as been the default since ESAPI 2.2.1.0. | ||
| * Set ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory in your ESAPI.properties file. | ||
| - SLF4J (which your choice of supported SLF4J logging implemmentation) | ||
| * Set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in your ESAPI.properties file. | ||
| * Logger configuration notes - If you are migrating from prior to ESAPI 2.2.1.1, you will need to update your ESAPI.properties file as logging-related configuration as per the ESAPI 2.2.1.1 release notes, which may be found at: | ||
| https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.2.1.1-release-notes.txt#L39-L78 | ||
|
|
||
| If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the root cause if you still have your ESAPI.Logger property set to use Log4J because the org.owasp.esapi.logger.log4j.Log4JFactory class has been completely removed from the ESAPI jar. If you are dead set on continuing to use Log4J 1, you ought to be able to do so via SLF4J. The set up for Log4J 1 (which has not be tested), should be similar to configure ESAPI to use SLF4J with Log4J 2 as described here: | ||
| https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J#slf4j-using-log4j-2x | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| Remaining Known Issues / Problems | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
| None known, other than the remaining open issues on GitHub. | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| Other changes in this release, some of which not tracked via GitHub issues | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| * Minor updates to README.md file with respect to version information. | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| Developer Activity Report (Changes between release 2.5.0.0 and 2.5.1.0, i.e., between 2022-07-20 and 2022-11-27) | ||
| Generated manually (this time) -- all errors are the fault of kwwall and his inability to do simple arithmetic. | ||
|
|
||
| @@@@ | ||
| @@@@ This section needs to be manually updated. | ||
| @@@@ | ||
| Developer Total Total Number # Merged | ||
| (GitHub ID) commits of Files Changed PRs | ||
| ======================================================== | ||
| jeremiahjstacey 10 10 3 | ||
| noloader 4 316 4 | ||
| Jeff-Walker 2 3 1 | ||
| HenriquePinto333 2 1 1 | ||
| davewichers 2 3 1 | ||
| xeno6696 31 6 1 | ||
| kwwall 1 1 0 | ||
| ======================================================== | ||
| Total Merged PRs: 11 | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| CHANGELOG: Create your own. May I suggest: | ||
|
|
||
| git log --stat --since=2022-07-20 --reverse --pretty=medium | ||
|
|
||
| which will show all the commits since just after the previous (2.5.0.0) release. | ||
|
|
||
| Alternately, you can download the most recent ESAPI source and run | ||
|
|
||
| mvn site | ||
|
|
||
| which will create a CHANGELOG file named 'target/site/changelog.html' | ||
|
|
||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| Direct and Transitive Runtime and Test Dependencies: | ||
|
|
||
| $ mvn -B dependency:tree | ||
| ... | ||
| [INFO] --- maven-dependency-plugin:3.3.0:tree (default-cli) @ esapi --- | ||
| [INFO] org.owasp.esapi:esapi:jar:2.5.1.0-SNAPSHOT | ||
| [INFO] +- javax.servlet:javax.servlet-api:jar:3.1.0:provided | ||
| [INFO] +- javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3:provided | ||
| [INFO] +- xom:xom:jar:1.3.8:compile | ||
| [INFO] +- commons-beanutils:commons-beanutils:jar:1.9.4:compile | ||
| [INFO] | +- commons-logging:commons-logging:jar:1.2:compile | ||
| [INFO] | \- commons-collections:commons-collections:jar:3.2.2:compile | ||
| [INFO] +- commons-configuration:commons-configuration:jar:1.10:compile | ||
| [INFO] +- commons-lang:commons-lang:jar:2.6:compile | ||
| [INFO] +- commons-fileupload:commons-fileupload:jar:1.4:compile | ||
| [INFO] +- org.apache.commons:commons-collections4:jar:4.4:compile | ||
| [INFO] +- org.apache-extras.beanshell:bsh:jar:2.0b6:compile | ||
| [INFO] +- org.owasp.antisamy:antisamy:jar:1.7.2:compile | ||
| [INFO] | +- net.sourceforge.htmlunit:neko-htmlunit:jar:2.66.0:compile | ||
| [INFO] | +- org.apache.httpcomponents.client5:httpclient5:jar:5.2:compile | ||
| [INFO] | | \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.2:compile | ||
| [INFO] | +- org.apache.httpcomponents.core5:httpcore5:jar:5.2:compile | ||
| [INFO] | +- org.apache.xmlgraphics:batik-css:jar:1.16:compile | ||
| [INFO] | | +- org.apache.xmlgraphics:batik-shared-resources:jar:1.16:compile | ||
| [INFO] | | +- org.apache.xmlgraphics:batik-util:jar:1.16:compile | ||
| [INFO] | | | +- org.apache.xmlgraphics:batik-constants:jar:1.16:compile | ||
| [INFO] | | | \- org.apache.xmlgraphics:batik-i18n:jar:1.16:compile | ||
| [INFO] | | \- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.7:compile | ||
| [INFO] | +- xerces:xercesImpl:jar:2.12.2:compile | ||
| [INFO] | \- xml-apis:xml-apis-ext:jar:1.3.04:compile | ||
| [INFO] +- org.slf4j:slf4j-api:jar:2.0.4:compile | ||
| [INFO] +- xml-apis:xml-apis:jar:1.4.01:compile | ||
| [INFO] +- commons-io:commons-io:jar:2.11.0:compile | ||
| [INFO] +- com.github.spotbugs:spotbugs-annotations:jar:4.7.3:compile | ||
| [INFO] | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile | ||
| [INFO] +- commons-codec:commons-codec:jar:1.15:test | ||
| [INFO] +- junit:junit:jar:4.13.2:test | ||
| [INFO] +- org.bouncycastle:bcprov-jdk15on:jar:1.70:test | ||
| [INFO] +- org.hamcrest:hamcrest-core:jar:2.2:test | ||
| [INFO] | \- org.hamcrest:hamcrest:jar:2.2:test | ||
| [INFO] +- org.powermock:powermock-api-mockito2:jar:2.0.9:test | ||
| [INFO] | \- org.powermock:powermock-api-support:jar:2.0.9:test | ||
| [INFO] +- org.mockito:mockito-core:jar:3.12.4:test | ||
| [INFO] | +- net.bytebuddy:byte-buddy:jar:1.11.13:test | ||
| [INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test | ||
| [INFO] | \- org.objenesis:objenesis:jar:3.2:test | ||
| [INFO] +- org.powermock:powermock-core:jar:2.0.9:test | ||
| [INFO] | \- org.javassist:javassist:jar:3.27.0-GA:test | ||
| [INFO] +- org.powermock:powermock-module-junit4:jar:2.0.9:test | ||
| [INFO] | \- org.powermock:powermock-module-junit4-common:jar:2.0.9:test | ||
| [INFO] +- org.powermock:powermock-reflect:jar:2.0.9:test | ||
| [INFO] \- org.openjdk.jmh:jmh-core:jar:1.36:test | ||
| [INFO] +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:test | ||
| [INFO] \- org.apache.commons:commons-math3:jar:3.2:test | ||
| [INFO] ------------------------------------------------------------------------ | ||
| [INFO] BUILD SUCCESS | ||
| [INFO] ------------------------------------------------------------------------ | ||
|
|
||
| ----------------------------------------------------------------------------- | ||
|
|
||
| Acknowledgments: | ||
| Another hat tip to Dave Wichers and the AntiSamy crew for promptly releasing AntiSamy 1.7.2. And thanks to Matt Seil, Jeremiah Stacey, and all the ESAPI users who make this worthwhile. This is for you. | ||
|
|
||
| A special thanks to the ESAPI community from the ESAPI project co-leaders: | ||
| Kevin W. Wall (kwwall) <== The irresponsible party for these release notes! | ||
| Matt Seil (xeno6696) |