Skip to content

v1.4.1 — Security release

Latest
Latest

Choose a tag to compare

View all tags
@jmanico jmanico released this 26 Sep 01:53
· 99 commits to main since this release
v1.4.1
ab76d58

OWASP Java Encoder 1.4.1

Maven Central publication is pending. Version 1.4.1 is available as signed
artifacts from the GitHub security release.
Until Central publication completes, download and verify those artifacts and
install them in your local or organizational Maven repository; version 1.4.1 will not resolve from Central alone. Maven Central 1.4.0 remains affected.

Security fixes

Upgrade all OWASP Java Encoder dependencies to 1.4.1. Versions through 1.4.0
are affected by the following issues:

  • GHSA-57jg-769q-93vh: EncodedWriter could lose encoding context when pending
    lookahead overflowed its output buffer, allowing CDATA or XML comment delimiters
    to escape and dropping or duplicating characters. The fix preserves unconsumed
    input across buffer flushes.
  • GHSA-q6jj-5396-8mq2: EncodedWriter could loop indefinitely when a write did
    not supply enough input to resolve pending lookahead. The fix retains pending
    input for the next write or close instead of spinning.
  • GHSA-p9ff-j89j-9xhx: long runs of U+2028 or U+2029 could cause the String
    overloads of Encode.forCssString and Encode.forCssUrl to throw AssertionError.
    The fix corrects the maximum encoded output size. The JSP/Jakarta CSS EL
    functions and the ESAPI CSS adapter also benefit from this fix.

The first two issues require direct use of EncodedWriter; the Encode facade,
JSP/Jakarta tags, and ESAPI adapter do not call it internally. The CSS size issue
affects String-returning APIs; Writer overloads and CSS tags are unaffected.

Compatibility and other changes

  • Java 8 remains the minimum runtime. Build and test with JDK 17.
  • Public method signatures, Maven coordinates, explicit JPMS module names, and
    historical Automatic-Module-Name values are retained.
  • The JSP, Jakarta, and ESAPI module descriptors now expose their public API
    dependencies transitively (#98).
  • The ESAPI adapter now uses a fixed ESAPI 2.7.0.0 dependency; tested compatibility
    is documented in esapi/README.md (#99).
  • Build tooling, packaged OSGi compatibility tests, project metadata, and Jakarta
    test dependency alignment have been updated (#90, #106).

Maven artifacts

Use version 1.4.1 for every artifact you consume:

Group ID Artifact ID
org.owasp.encoder encoder
org.owasp.encoder encoder-jsp
org.owasp.encoder encoder-jakarta-jsp
org.owasp.encoder encoder-esapi

The parent POM is org.owasp.encoder:encoder-parent:1.4.1.
The jakarta-test application is not published.

Verification

This release uses a dedicated OWASP Java Encoder Release PGP key. Its public
key and full fingerprint are recorded in the release's KEYS file.

Identity: OWASP Java Encoder Release <jim.manico@owasp.org>

Fingerprint: 1C5F632B86809F2F5DB25092BEA0075F94074A9B. The release
assets include detached PGP signatures and SHA-256/SHA-512 checksums.

gpg --import KEYS
gpg --verify encoder-1.4.1.jar.asc encoder-1.4.1.jar
shasum -a 256 -c SHA256SUMS
shasum -a 512 -c SHA512SUMS

The release was built with Maven 3.9.12 and OpenJDK 17.0.20.1 using a fresh
Maven cache. All 1,160 unit and packaged compatibility tests passed. The Docker-based
Jakarta browser test subsequently passed in GitHub CI, along with all ten ESAPI
compatibility jobs. All 11 CI checks passed.

See RELEASING.md for the publication and key-rotation procedure.

Assets 43
Loading