OWASP Java Encoder 1.6.0

OWASP Java Encoder 1.6.0 reduces unnecessary JavaScript letter escaping while retaining recognized HTML-token protection across trusted fragments. It resolves #243 through #247. This is a minor release because emitted bytes and streaming behavior change.

Changes and migration

• forJavaScript and forJavaScriptBlock keep interior script-name letters readable. A final C, I, P, R, S, or T in either case still receives an escape. Punctuation and whitespace escapes remain.
• http://google.com now produces http:\/\/google.com; script becomes scrip\x74; i remains \x69. The rule is conservative: cat becomes ca\x74.
• HTML does not remove whitespace inside tag names. Escaping < in a complete value addresses the HTML tag delimiter concern, but a fragment may have its < supplied by trusted text. The terminal escape preserves that supported protection.
• General/block EncodedWriter callers must flush before writing directly to the wrapped writer. Explicit flushes safely emit pending letters/surrogates and can add escapes while preserving the JavaScript UTF-16 value. Low-level callers must retain unread input after UNDERFLOW and supply more input or mark end-of-input.
• Review snapshots, signatures and cache keys that depend on encoded bytes. Source and attribute-only methods are unchanged.

Public APIs, Java 8 support, runtime dependencies and module/bundle identities are unchanged. No new encoder security fix is introduced. The 1.5.0 protections remain; users of older versions should follow the security advisory. See the migration record.

Maven Central

Version 1.6.0 is published under org.owasp.encoder:

• encoder
• encoder-jsp
• encoder-jakarta-jsp
• encoder-parent

Keep core and adapter versions aligned. Do not combine javax and Jakarta adapters. The retired ESAPI adapter and optional test WAR are not included. Javadoc JARs are attached; hosted javadoc.io indexing can lag publication.

Verification

Exact tested source: d9b0fd62497fb9276429a9ea972f4449ab320f2d; signed tag: v1.6.0.

All 26 downloaded Central payload/signature files matched the retained originals byte for byte. All 13 payload signatures and both checksum-manifest signatures verify with project fingerprint 1C5F632B86809F2F5DB25092BEA0075F94074A9B. Attached bundle SHA-256: 8d860714634ae3b53f19bb3ea326f639b74df96c0e82bc956d53f237b5804c16.

The clean unsigned and signed builds, Docker/browser/WAR gate, packaged Java 17 consumers and repository checks passed. All thirteen unsigned payloads match two independent clean builds using Temurin 17.0.20.1+1 and Maven 3.10.0. Required CI passed, including Java 8/11/17/21/25 consumers, Java 8 tests and Java/Actions/Python CodeQL. Model-assisted review followed MODELS.md; no Daybreak review was completed before release. The documented maintainer review bypass was authorized; required CI/security checks were not bypassed.

Correction — 2026-10-18: The original review record described Daybreak access as unavailable, but the explicit picker-route probe had not been attempted. A subsequent probe succeeded, as recorded in PR #251. This establishes later access, not a pre-release review. The release tag and signed artifacts retain their original bytes.

Verify the attached signatures and signed checksum manifests with KEYS, SHA256SUMS, SHA512SUMS and VERIFYING.md. The immutable source retains preparation-stage notices; this release confirms publication without changing those sources or signatures.