Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: upgrade Antisamy to 1.7.5 to resolve CVE-2024-23635 #833

Merged
merged 1 commit into from
Feb 29, 2024

Conversation

mpreziuso
Copy link
Contributor

This is to resolve CVE-2024-23635 relating to Antisamy 1.7.4.
It's related and similar to #830, however it resolves dependency conflicts and updates 2 test cases as the output we get from Antisamy looks a bit different. I think this is to be expected: as mentioned in the release notes for Antisamy 1.7.5 the output may have changed again:

Note: The upgrade in the HTML parser may alter outputs compared to 1.7.4 and before. This may impact regression tests that involve AntiSamy if they are too strict when comparing a resulting output with the expected one.

Also related to: nahsra/antisamy#389 and nahsra/antisamy#388.

Copy link
Contributor

@kwwall kwwall left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks for doing this.

@kwwall
Copy link
Contributor

kwwall commented Feb 29, 2024

@mpreziuso - Because there are no actual code changes here that will go into the ESAPI jar (the few code changes were simply adjustments to JUnit tests caused by the update to AntiSamy 1.7.5), I am not going to ask you to go back and do this PR over and sign your commits, but for a while now, we have been requiring signed commits. I would suggest reading through https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification and then creating and uploading your public signing key. Had this been code changes that would have ended up in the ESAPI jar though, I would have rejected this PR until this was corrected.

@kwwall
Copy link
Contributor

kwwall commented Feb 29, 2024

An important note: CVE-2024-23635 does NOT impact ESAPI unless you have added AntiSamy's 'preserveComments' directive to ESAPI's AntiSamy policy file, "antisamy-esapi.xml", which I would consider similar to intentionally sabotaging yourself. For further details, please see my post "Before you panic - New AntiSamy release available" made to the esapi-project-users Google group.

@kwwall kwwall merged commit a3a59dc into ESAPI:develop Feb 29, 2024
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants