Skip to content

Complete source attachments and normalize repository files #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmanico merged 1 commit into from
Sep 26, 2026
Merged

Complete source attachments and normalize repository files #184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .editorconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
root = true

[*]
charset = utf-8
end_of_line = lf
insert_final_newline = true
indent_style = space
indent_size = 4
trim_trailing_whitespace = true

[*.{yaml,yml}]
indent_size = 2

[*.md]
trim_trailing_whitespace = false

[*.{bat,cmd}]
end_of_line = crlf
11 changes: 11 additions & 0 deletions .gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Normalize repository text while preserving binary artifacts and fixtures.
* text=auto eol=lf
*.bat text eol=crlf
*.cmd text eol=crlf
*.gif binary
*.ico binary
*.jar binary
*.jpg binary
*.pdf binary
*.png binary
*.zip binary
9 changes: 1 addition & 8 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
*/target/**
/target/**
target/
# Intellij project files
*.iml
*.ipr
Expand All @@ -15,12 +14,6 @@ maven-eclipse.xml
nb-configuration.xml
*/nbproject/*

/jsp/target/
/esapi/target/
/target/
/jakarta/target/
/jakarta-test/target/

# Python CI/compatibility tooling
__pycache__/
*.pyc
9 changes: 0 additions & 9 deletions META-INF/MANIFEST.MF
View file
Open in desktop

This file was deleted.

6 changes: 6 additions & 0 deletions compatibility/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,3 +126,9 @@ reports, preparation output, and each runtime's output even when a step fails.
The Docker-free [Jasper engine fixture](jsp-engine/README.md) also runs in normal
`verify`: it compiles and serves both packaged TLD surfaces on maintained javax
and Jakarta engines, with exact-byte and translation-rejection assertions.

Preparation also verifies each source attachment against the main sources and
requires its Java 9 descriptor at `META-INF/versions/9/module-info.java`, plus a
Javadoc index in every documentation attachment. Descriptor sources are added
only after compilation/resource copying; Java 8 compiler inputs and the binary
multi-release layout remain unchanged.
17 changes: 17 additions & 0 deletions compatibility/consumers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,20 @@ def metadata(kind, jar, core):
print('Metadata passed:', jar.name)


def source_metadata(kind, source_jar):
"""A complete source attachment includes the separate Java 9 descriptor."""
with zipfile.ZipFile(source_jar) as archive:
names = archive.namelist()
assert len(names) == len(set(names)), ('duplicate source entry', source_jar)
for source in (ROOT / kind / 'src/main/java').rglob('*.java'):
name = source.relative_to(ROOT / kind / 'src/main/java').as_posix()
assert archive.read(name) == source.read_bytes(), ('source mismatch', name)
assert archive.read('META-INF/versions/9/module-info.java') == (
ROOT / kind / 'src/main/java9/module-info.java').read_bytes(), kind
assert 'module-info.java' not in names, ('descriptor in Java 8 source root', kind)
print('Source attachment passed:', source_jar.name)


def prepare(args):
out = args.directory.resolve()
if out.exists() and any(out.iterdir()):
Expand All @@ -166,6 +180,9 @@ def prepare(args):
target.parent.mkdir(exist_ok=True)
shutil.copy2(candidates[0], target)
jars[kind] = target
source_metadata(kind, candidates[0].with_name(candidates[0].stem + '-sources.jar'))
with zipfile.ZipFile(candidates[0].with_name(candidates[0].stem + '-javadoc.jar')) as docs:
assert 'index.html' in docs.namelist(), ('missing Javadoc index', kind)
for kind, jar in jars.items(): metadata(kind, jar, jars['core'])
run('javac', '--release', '9', '-d', out / 'metadata', SOURCE / 'ModuleMetadata.java')
run('java', '-cp', out / 'metadata', 'consumer.ModuleMetadata', *jars.values())
Expand Down
16 changes: 16 additions & 0 deletions compatibility/tests/test_guards.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,22 @@ def test_changed_symbolic_name(self):
self.rejected('jakarta', lambda entries: self.header(
entries, 'Bundle-SymbolicName', lambda value: 'org.owasp.encoder.jakarta'))

def test_source_attachments(self):
for kind, jar in self.jars.items():
with self.subTest(artifact=kind):
consumers.source_metadata(kind, jar.with_name(jar.stem + '-sources.jar'))

def test_missing_source_descriptor(self):
original = self.jars['core'].with_name(self.jars['core'].stem + '-sources.jar')
with tempfile.TemporaryDirectory(prefix='encoder-source-guard-') as directory:
target = Path(directory) / original.name
with zipfile.ZipFile(original) as source, zipfile.ZipFile(target, 'w') as broken:
for name in source.namelist():
if name != 'META-INF/versions/9/module-info.java':
broken.writestr(name, source.read(name))
with self.assertRaises(KeyError):
consumers.source_metadata('core', target)


if __name__ == '__main__':
unittest.main()
264 changes: 132 additions & 132 deletions core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,132 +1,132 @@
<?xml version="1.0" encoding="US-ASCII"?>
<!--
~ Copyright (c) 2015 OWASP.
~ All rights reserved.
~
~ Redistribution and use in source and binary forms, with or without
~ modification, are permitted provided that the following conditions
~ are met:
~
~ * Redistributions of source code must retain the above
~ copyright notice, this list of conditions and the following
~ disclaimer.
~
~ * Redistributions in binary form must reproduce the above
~ copyright notice, this list of conditions and the following
~ disclaimer in the documentation and/or other materials
~ provided with the distribution.
~
~ * Neither the name of the OWASP nor the names of its
~ contributors may be used to endorse or promote products
~ derived from this software without specific prior written
~ permission.
~
~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
~ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
~ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
~ FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
~ COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
~ INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
~ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
~ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
~ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
~ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
~ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
~ OF THE POSSIBILITY OF SUCH DAMAGE.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.owasp.encoder</groupId>
<artifactId>encoder-parent</artifactId>
<version>1.5.0-SNAPSHOT</version>
</parent>
<artifactId>encoder</artifactId>
<packaging>jar</packaging>
<name>Java Encoder</name>
<description>
The OWASP Encoders package is a collection of high-performance low-overhead
contextual encoders, that when utilized correctly, is an effective tool in
preventing Web Application security vulnerabilities such as Cross-Site
Scripting.
</description>
<properties>
<jigsaw.module.name>org.owasp.encoder</jigsaw.module.name>
<osgi.symbolic.name>org.owasp.encoder</osgi.symbolic.name>
</properties>
<dependencies>
<!-- Keep this test fixture on OSGi R6 to detect compatibility regressions. -->
<dependency>
<groupId>org.apache.felix</groupId>
<artifactId>org.apache.felix.framework</artifactId>
<version>5.6.12</version>
<scope>test</scope>
</dependency>
<!-- Independent JSON parser used to check Encode.forJson output. -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.22.3</version>
<scope>test</scope>
</dependency>
<!-- Parse the enclosing HTML independently of the JSON encoder. -->
<dependency>
<groupId>org.jsoup</groupId>
<artifactId>jsoup</artifactId>
<version>1.23.2</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<!-- Make the multi-release JAR available to downstream reactor modules before they compile their JPMS descriptors. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<executions>
<execution>
<id>reactor-jar</id>
<phase>process-classes</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
<!-- The main artifact is already created during process-classes. -->
<execution>
<id>default-jar</id>
<phase>none</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId>
<configuration>
<systemPropertyVariables>
<encoder.bundle>${project.build.directory}/${project.build.finalName}.jar</encoder.bundle>
</systemPropertyVariables>
</configuration>
<executions>
<execution>
<id>osgi-compatibility</id>
<goals>
<goal>integration-test</goal>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Copyright (c) 2015 OWASP.
~ All rights reserved.
~
~ Redistribution and use in source and binary forms, with or without
~ modification, are permitted provided that the following conditions
~ are met:
~
~ * Redistributions of source code must retain the above
~ copyright notice, this list of conditions and the following
~ disclaimer.
~
~ * Redistributions in binary form must reproduce the above
~ copyright notice, this list of conditions and the following
~ disclaimer in the documentation and/or other materials
~ provided with the distribution.
~
~ * Neither the name of the OWASP nor the names of its
~ contributors may be used to endorse or promote products
~ derived from this software without specific prior written
~ permission.
~
~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
~ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
~ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
~ FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
~ COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
~ INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
~ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
~ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
~ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
~ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
~ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
~ OF THE POSSIBILITY OF SUCH DAMAGE.
-->

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<parent>
<groupId>org.owasp.encoder</groupId>
<artifactId>encoder-parent</artifactId>
<version>1.5.0-SNAPSHOT</version>
</parent>

<artifactId>encoder</artifactId>
<packaging>jar</packaging>

<name>Java Encoder</name>
<description>
The OWASP Encoders package is a collection of high-performance low-overhead
contextual encoders, that when utilized correctly, is an effective tool in
preventing Web Application security vulnerabilities such as Cross-Site
Scripting.
</description>

<properties>
<jigsaw.module.name>org.owasp.encoder</jigsaw.module.name>
<osgi.symbolic.name>org.owasp.encoder</osgi.symbolic.name>
</properties>

<dependencies>
<!-- Keep this test fixture on OSGi R6 to detect compatibility regressions. -->
<dependency>
<groupId>org.apache.felix</groupId>
<artifactId>org.apache.felix.framework</artifactId>
<version>5.6.12</version>
<scope>test</scope>
</dependency>
<!-- Independent JSON parser used to check Encode.forJson output. -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.22.3</version>
<scope>test</scope>
</dependency>
<!-- Parse the enclosing HTML independently of the JSON encoder. -->
<dependency>
<groupId>org.jsoup</groupId>
<artifactId>jsoup</artifactId>
<version>1.23.2</version>
<scope>test</scope>
</dependency>
</dependencies>

<build>
<plugins>
<!-- Make the multi-release JAR available to downstream reactor modules before they compile their JPMS descriptors. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<executions>
<execution>
<id>reactor-jar</id>
<phase>process-classes</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
<!-- The main artifact is already created during process-classes. -->
<execution>
<id>default-jar</id>
<phase>none</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId>
<configuration>
<systemPropertyVariables>
<encoder.bundle>${project.build.directory}/${project.build.finalName}.jar</encoder.bundle>
</systemPropertyVariables>
</configuration>
<executions>
<execution>
<id>osgi-compatibility</id>
<goals>
<goal>integration-test</goal>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
2 changes: 1 addition & 1 deletion esapi/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<?xml version="1.0" encoding="US-ASCII"?>
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Copyright (c) 2015 OWASP.
~ All rights reserved.
Expand Down
Loading
Loading