CVE-2023-26119(9.8) on neko-htmlunit-2.66.0.jar dependency about esapi-java HOT 7 CLOSED

Have done some work on the AntiSamy update - the update itself is not that tricky but there was a regression on neko 3.0.0 that introduces some problems. Will make a fresh snapshot build of Neko 3.1.0 and a PR for the needed updates. If the team is happy with this i will make a release.

from esapi-java.

3.1.0 release is available.

from esapi-java.

The dependency tree listed is for the artifact created from the ESAPI/esapi-java-legacy baseline, which is a different repository.

https://github.com/ESAPI/esapi-java-legacy/

Per the tree you've listed, please note that nekohtml is a dependency of antisamy, not of the ESAPI project.

|  +- org.owasp.antisamy:antisamy:jar:1.7.2:compile
|  |  +- net.sourceforge.htmlunit:neko-htmlunit:jar:2.66.0:compile

The Antisamy team is very responsive to CVE's in the project, but if you'd like to ensure they are aware please follow up with them in the Antisamy github project.

https://github.com/nahsra/antisamy

Worth noting that this dependency is already updated in the development baseline to v 2.70.0
https://github.com/nahsra/antisamy/blob/main/pom.xml

ESAPI is currently using the latest released version of antisamy. Until a new version of Antisamy is available there is no additional action that can be taken by the ESAPI team.

from esapi-java.

Have done some work on the AntiSamy update - the update itself is not that tricky but there was a regression on neko 3.0.0 that introduces some problems. Will make a fresh snapshot build of Neko 3.1.0 and a PR for the needed updates. If the team is happy with this i will make a release.

AntiSamy PR 322 for those of you are are wondering and not watching the AntiSamy repo.

from esapi-java.

This is already on the AntiSamy folks' GitHub issues and I've been working with their team for the past day and a half or so. We can't do anything until they upgrade and since this is a major revision (2.70.0 --> 3.0.0) there are LOTS of interface changes so it may take a while. If you are not using any of the HTTPUtilities.getSafeValidInput methods, it shouldn't affect you as I think that is the only place we use AntiSamy.

from esapi-java.

Also, be careful when creating issues. This should have been on ESAPI/esapi-java-legacy not ESAPI/esapi.

from esapi-java.

Patched in ESAPI/esapi-java-legacy for a pom update to use AntiSamy 1.7.3 which addresses this. Fixed in commit id ESAPI/esapi-java-legacy@e69430e of PR ESAPI/esapi-java-legacy#784.

Thanks to @rbri and @davewichers for attending to this so promptly.

from esapi-java.