Hi, it looks like the JavaScript part of [VALIDATOR] is really out dated. We have a pull request at github that suggests deprecating it all together [1]. Merging this PR will log a warning to the console when the JavaScript is loaded, pointing users to an alternative.
Are there any objections against merging this? We should not ship broken/unsecure code, so I'd like to apply this patch and ship 1.4.1 ASAP. Benedikt [1] https://github.com/apache/commons-validator/pull/1 -- http://people.apache.org/~britter/ http://www.systemoutprintln.de/ http://twitter.com/BenediktRitter http://github.com/britter