Preparation for ESAPI 2.5.3.0 release

ESAPI / esapi-java-legacy

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications.

https://owasp.org/www-project-enterprise-security-api/

Other

610 stars 368 forks source link

Preparation for ESAPI 2.5.3.0 release #809

Closed kwwall closed 10 months ago

kwwall commented 10 months ago

Update to AntiSamy 1.7.4
Javadoc fixes / updates / improvements
Revise ESAPI's deprecation policy
Change ESAPI's default key size for digital signatures from 1024-bits to 2048-bits.
Add 'noopenerAndNoreferrerAnchors' AntiSamy directive for anchor tags.
Deprecate both Validator.isValidSafeHTML interfaces; to be removed in 1 year after ESAPI 2.5.3.0 release.
Revise / reorganize JUnit tests using deprecated isValidSafeHTML methods.

xeno6696 commented 10 months ago

Sorry I thought I was just approving the first commit. Walking through the changes today.

xeno6696 commented 10 months ago

I approve, I will wait until EOB for @jeremiahjstacey to take a pass, but this seems mostly routine with just some new tests.

kwwall commented 10 months ago

Okay. I will wait until 7pm ET today until I merge this to give @jeremiahjstacey the opportunity to approve this PR. Of it he doesn't intend reviewing this PR, until he communicates that via a comment in this PR or an email to me.

jeremiahjstacey commented 10 months ago

All looks good to me. Sorry for the delay. I appreciate the smaller scoped tests and all the accompanying comments.

kwwall commented 10 months ago

@jeremiahjstacey wrote:

All looks good to me. Sorry for the delay. I appreciate the smaller scoped tests and all the accompanying comments.

No worries. It's all good. Just want to get this out the door while I'm on PTO / Holiday.