Skip to content

Build hygiene: normalize text, package module sources, pin serialVersionUID, drop unused test deps #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
VolodymyrLinuxovich wants to merge 4 commits into from
Closed

Build hygiene: normalize text, package module sources, pin serialVersionUID, drop unused test deps #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
725b80a
Normalize line endings and XML encodings; remove legacy files (#123)
VolodymyrLinuxovich Sep 26, 2026
88ffa45
Include Java 9 module descriptors in the sources JARs (#123)
VolodymyrLinuxovich Sep 26, 2026
2d709d4
Declare UnsupportedContextException's historical serialVersionUID (#123)
VolodymyrLinuxovich Sep 26, 2026
22757e1
Remove unused Servlet API test dependencies from the adapters (#123)
VolodymyrLinuxovich Sep 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .editorconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
# https://editorconfig.org
root = true

[*]
charset = utf-8
end_of_line = lf

[*.{java,py}]
indent_style = space
indent_size = 4

[*.{yml,yaml}]
indent_style = space
indent_size = 2
15 changes: 15 additions & 0 deletions .gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Normalize text to LF in the repository and working tree.
* text=auto eol=lf

# Windows command scripts (for example a future Maven wrapper) need CRLF.
*.cmd text eol=crlf
*.bat text eol=crlf

# Binary files: never convert or diff as text.
*.jar binary
*.class binary
*.jpg binary
*.jpeg binary
*.png binary
*.gif binary
*.ico binary
10 changes: 2 additions & 8 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
*/target/**
/target/**
# Maven build output in every module
target/
# Intellij project files
*.iml
*.ipr
Expand All @@ -15,12 +15,6 @@ maven-eclipse.xml
nb-configuration.xml
*/nbproject/*

/jsp/target/
/esapi/target/
/target/
/jakarta/target/
/jakarta-test/target/

# Python CI/compatibility tooling
__pycache__/
*.pyc
9 changes: 0 additions & 9 deletions META-INF/MANIFEST.MF
View file
Open in desktop

This file was deleted.

13 changes: 13 additions & 0 deletions compatibility/consumers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,18 @@ def metadata(kind, jar, core):
print('Metadata passed:', jar.name)


def check_sources_jar(kind, jar):
"""The published sources JAR must carry the Java 9 module descriptor source."""
source_jar = ROOT / kind / 'target' / (jar.name[:-len('.jar')] + '-sources.jar')
with zipfile.ZipFile(source_jar) as archive:
names = archive.namelist()
assert 'module-info.java' in names, (source_jar, 'missing module-info.java')
assert not any(name.endswith('.class') for name in names), source_jar
package = ARTIFACTS[kind][3].replace('.', '/') + '/'
assert any(name.startswith(package) and name.endswith('.java') for name in names), source_jar
print('Sources passed:', source_jar.name)


def prepare(args):
out = args.directory.resolve()
if out.exists() and any(out.iterdir()):
Expand All @@ -167,6 +179,7 @@ def prepare(args):
shutil.copy2(candidates[0], target)
jars[kind] = target
for kind, jar in jars.items(): metadata(kind, jar, jars['core'])
for kind, jar in jars.items(): check_sources_jar(kind, jar)
run('javac', '--release', '9', '-d', out / 'metadata', SOURCE / 'ModuleMetadata.java')
run('java', '-cp', out / 'metadata', 'consumer.ModuleMetadata', *jars.values())
# javac's module discovery does not honor the runtime multi-release property.
Expand Down
264 changes: 132 additions & 132 deletions core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,132 +1,132 @@
<?xml version="1.0" encoding="US-ASCII"?>
<!--
~ Copyright (c) 2015 OWASP.
~ All rights reserved.
~
~ Redistribution and use in source and binary forms, with or without
~ modification, are permitted provided that the following conditions
~ are met:
~
~ * Redistributions of source code must retain the above
~ copyright notice, this list of conditions and the following
~ disclaimer.
~
~ * Redistributions in binary form must reproduce the above
~ copyright notice, this list of conditions and the following
~ disclaimer in the documentation and/or other materials
~ provided with the distribution.
~
~ * Neither the name of the OWASP nor the names of its
~ contributors may be used to endorse or promote products
~ derived from this software without specific prior written
~ permission.
~
~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
~ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
~ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
~ FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
~ COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
~ INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
~ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
~ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
~ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
~ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
~ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
~ OF THE POSSIBILITY OF SUCH DAMAGE.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.owasp.encoder</groupId>
<artifactId>encoder-parent</artifactId>
<version>1.5.0-SNAPSHOT</version>
</parent>
<artifactId>encoder</artifactId>
<packaging>jar</packaging>
<name>Java Encoder</name>
<description>
The OWASP Encoders package is a collection of high-performance low-overhead
contextual encoders, that when utilized correctly, is an effective tool in
preventing Web Application security vulnerabilities such as Cross-Site
Scripting.
</description>
<properties>
<jigsaw.module.name>org.owasp.encoder</jigsaw.module.name>
<osgi.symbolic.name>org.owasp.encoder</osgi.symbolic.name>
</properties>
<dependencies>
<!-- Keep this test fixture on OSGi R6 to detect compatibility regressions. -->
<dependency>
<groupId>org.apache.felix</groupId>
<artifactId>org.apache.felix.framework</artifactId>
<version>5.6.12</version>
<scope>test</scope>
</dependency>
<!-- Independent JSON parser used to check Encode.forJson output. -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.22.3</version>
<scope>test</scope>
</dependency>
<!-- Parse the enclosing HTML independently of the JSON encoder. -->
<dependency>
<groupId>org.jsoup</groupId>
<artifactId>jsoup</artifactId>
<version>1.23.2</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<!-- Make the multi-release JAR available to downstream reactor modules before they compile their JPMS descriptors. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<executions>
<execution>
<id>reactor-jar</id>
<phase>process-classes</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
<!-- The main artifact is already created during process-classes. -->
<execution>
<id>default-jar</id>
<phase>none</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId>
<configuration>
<systemPropertyVariables>
<encoder.bundle>${project.build.directory}/${project.build.finalName}.jar</encoder.bundle>
</systemPropertyVariables>
</configuration>
<executions>
<execution>
<id>osgi-compatibility</id>
<goals>
<goal>integration-test</goal>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Copyright (c) 2015 OWASP.
~ All rights reserved.
~
~ Redistribution and use in source and binary forms, with or without
~ modification, are permitted provided that the following conditions
~ are met:
~
~ * Redistributions of source code must retain the above
~ copyright notice, this list of conditions and the following
~ disclaimer.
~
~ * Redistributions in binary form must reproduce the above
~ copyright notice, this list of conditions and the following
~ disclaimer in the documentation and/or other materials
~ provided with the distribution.
~
~ * Neither the name of the OWASP nor the names of its
~ contributors may be used to endorse or promote products
~ derived from this software without specific prior written
~ permission.
~
~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
~ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
~ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
~ FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
~ COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
~ INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
~ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
~ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
~ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
~ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
~ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
~ OF THE POSSIBILITY OF SUCH DAMAGE.
-->

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<parent>
<groupId>org.owasp.encoder</groupId>
<artifactId>encoder-parent</artifactId>
<version>1.5.0-SNAPSHOT</version>
</parent>

<artifactId>encoder</artifactId>
<packaging>jar</packaging>

<name>Java Encoder</name>
<description>
The OWASP Encoders package is a collection of high-performance low-overhead
contextual encoders, that when utilized correctly, is an effective tool in
preventing Web Application security vulnerabilities such as Cross-Site
Scripting.
</description>

<properties>
<jigsaw.module.name>org.owasp.encoder</jigsaw.module.name>
<osgi.symbolic.name>org.owasp.encoder</osgi.symbolic.name>
</properties>

<dependencies>
<!-- Keep this test fixture on OSGi R6 to detect compatibility regressions. -->
<dependency>
<groupId>org.apache.felix</groupId>
<artifactId>org.apache.felix.framework</artifactId>
<version>5.6.12</version>
<scope>test</scope>
</dependency>
<!-- Independent JSON parser used to check Encode.forJson output. -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.22.3</version>
<scope>test</scope>
</dependency>
<!-- Parse the enclosing HTML independently of the JSON encoder. -->
<dependency>
<groupId>org.jsoup</groupId>
<artifactId>jsoup</artifactId>
<version>1.23.2</version>
<scope>test</scope>
</dependency>
</dependencies>

<build>
<plugins>
<!-- Make the multi-release JAR available to downstream reactor modules before they compile their JPMS descriptors. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<executions>
<execution>
<id>reactor-jar</id>
<phase>process-classes</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
<!-- The main artifact is already created during process-classes. -->
<execution>
<id>default-jar</id>
<phase>none</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId>
<configuration>
<systemPropertyVariables>
<encoder.bundle>${project.build.directory}/${project.build.finalName}.jar</encoder.bundle>
</systemPropertyVariables>
</configuration>
<executions>
<execution>
<id>osgi-compatibility</id>
<goals>
<goal>integration-test</goal>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
6 changes: 6 additions & 0 deletions core/src/main/java/org/owasp/encoder/UnsupportedContextException.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,12 @@
* @author Jeff Ichnowski
*/
public class UnsupportedContextException extends RuntimeException {
/**
* The value the JVM computed for every released version (1.2 through
* 1.4.0), declared explicitly so serialized instances stay compatible.
*/
private static final long serialVersionUID = -1517019963198920181L;

/**
* Sole constructor.
*
Expand Down
2 changes: 1 addition & 1 deletion core/src/site/site.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<?xml version="1.0" encoding="ISO-8859-1"?>
<?xml version="1.0" encoding="UTF-8"?>
<!--
Copyright (c) 2015 Jeremy Long
All rights reserved.
Expand Down
Loading