[
https://issues.apache.org/jira/browse/JSPWIKI-1352?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138728#comment-18138728
]
Arturo Bernal commented on JSPWIKI-1352:
----------------------------------------
Pull request: https://github.com/apache/jspwiki/pull/584
It updates JDOM to 2.0.6.1 and makes the filter around the HTML parser accept
the setting of the two external entity features, so it replaces the pull
request of Dependabot, https://github.com/apache/jspwiki/pull/430. LICENSE and
the ChangeLog are updated.
> Update JDOM to 2.0.6.1: the HTML reader does not accept the external entity
> features it sets
> --------------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1352
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1352
> Project: JSPWiki
> Issue Type: Improvement
> Reporter: Arturo Bernal
> Priority: Major
> Labels: pull-request-available
>
> Dependabot proposes JDOM 2.0.6.1 in
> https://github.com/apache/jspwiki/pull/430. On top of the current master it
> breaks the HTML to wiki translator of the WYSIWYG editor: JDOM 2.0.6.1 sets
> the SAX features http://xml.org/sax/features/external-general-entities and
> http://xml.org/sax/features/external-parameter-entities on its reader, and if
> the reader does not know them it throws a JDOMException ("feature ... not
> recognized for SAX driver HtmlStringToWikiTranslator$AttributeUriFilter").
> The reader is the HTML parser of htmlunit-neko (see JSPWIKI-1206), wrapped in
> a filter. The parser never resolves external entities and does not know those
> features. With JDOM 2.0.6.1 the tests of jspwiki-wysiwyg (19 of 19),
> jspwiki-markdown (17 of 53) and a third module (10 of 10) fail, and the war
> cannot be built, because WikiSyntaxConverter uses the translator to convert
> the wiki pages.
> The filter should accept the setting of those two features, as there is
> nothing to switch on or off in a parser that does not handle external
> entities.
> Checked locally with the change and JDOM 2.0.6.1: all the unit tests pass
> with the same counts as master (1028 in jspwiki-main), the war builds, and on
> a running war (Tomcat 10.1) I registered a user, logged in, saved a page with
> markup and used the HTML to wiki translator, with the same results as master.
> Not tested: browsers other than Chromium, and the integration tests.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
