Skip to content

OWASP Java Encoder 1.5.1

Latest
Latest

Choose a tag to compare

View all tags
@jmanico jmanico released this 15 Oct 17:00
· 3 commits to main since this release
v1.5.1
1ab0cfb

OWASP Java Encoder 1.5.1 is a documentation and build-maintenance patch. Encoding behavior, public APIs, runtime dependencies, and Java 8 support are unchanged from 1.5.0.

What changed

  • Clarify JavaScript encoding modes, output growth, and where encoded values can safely be inserted.
  • Explain why script-letter escapes remain necessary in the general and block modes; Source mode already leaves the URL in #243 unchanged.
  • Distinguish JSON whole-string HTML embedding from JavaScript fragment protection, with clearer surrounding-template requirements.
  • Strengthen parser regression tests and include the build/test maintenance recorded in CHANGELOG.md.

The documentation changes are in #244. The release preparation is in #245. This patch preserves the security fixes from 1.5.0 and introduces no new encoder security fix. Users upgrading from versions older than 1.5.0 should read the 1.5.0 migration notes and security advisory.

Maven Central

Version 1.5.1 is published under org.owasp.encoder:

Keep core and adapter versions aligned. The retired ESAPI adapter and optional Jakarta test WAR are not included. The Javadoc JARs are attached. Hosted core, JSP, and Jakarta documentation is live and was checked against the released Javadoc content.

Verification

Exact tested source: 1ab0cfbececf9969452fe03cbf5b5504b03a8b1b; signed tag: v1.5.1.

All 26 downloaded Central payload/signature files match the retained originals byte for byte. All 13 payload signatures verify with the project key, full fingerprint 1C5F632B86809F2F5DB25092BEA0075F94074A9B. The attached bundle SHA-256 is fcb226abfee84db155f27d40fe78173a96524d74dfc14a577eb1106ef57337f8.

The signed build passed 2,290 tests; the separate browser/WAR build passed 2,297, with zero failures/errors/skips. All 13 unsigned payloads match two independent clean builds using Temurin 17.0.20.1+1 and Maven 3.10.0. Required CI passed, including packaged consumers on Java 8/11/17/21/25, Java 8 tests, and CodeQL.

Verify signatures and signed checksum manifests using the attached KEYS, SHA256SUMS, and SHA512SUMS and these instructions. Pending notices in the immutable source tag describe its preparation stage; this release confirms publication without changing those sources or signatures.

Assets 34
Loading