[
https://issues.apache.org/jira/browse/JSPWIKI-1352?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated JSPWIKI-1352:
------------------------------------
Labels: pull-request-available (was: )
> Update JDOM to 2.0.6.1: the HTML reader does not accept the external entity
> features it sets
> --------------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1352
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1352
> Project: JSPWiki
> Issue Type: Improvement
> Reporter: Arturo Bernal
> Priority: Major
> Labels: pull-request-available
>
> Dependabot proposes JDOM 2.0.6.1 in
> https://github.com/apache/jspwiki/pull/430. On top of the current master it
> breaks the HTML to wiki translator of the WYSIWYG editor: JDOM 2.0.6.1 sets
> the SAX features http://xml.org/sax/features/external-general-entities and
> http://xml.org/sax/features/external-parameter-entities on its reader, and if
> the reader does not know them it throws a JDOMException ("feature ... not
> recognized for SAX driver HtmlStringToWikiTranslator$AttributeUriFilter").
> The reader is the HTML parser of htmlunit-neko (see JSPWIKI-1206), wrapped in
> a filter. The parser never resolves external entities and does not know those
> features. With JDOM 2.0.6.1 the tests of jspwiki-wysiwyg (19 of 19),
> jspwiki-markdown (17 of 53) and a third module (10 of 10) fail, and the war
> cannot be built, because WikiSyntaxConverter uses the translator to convert
> the wiki pages.
> The filter should accept the setting of those two features, as there is
> nothing to switch on or off in a parser that does not handle external
> entities.
> Checked locally with the change and JDOM 2.0.6.1: all the unit tests pass
> with the same counts as master (1028 in jspwiki-main), the war builds, and on
> a running war (Tomcat 10.1) I registered a user, logged in, saved a page with
> markup and used the HTML to wiki translator, with the same results as master.
> Not tested: browsers other than Chromium, and the integration tests.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
