Skip to content

Commit

Permalink
html.validator: Remove dependency on log4j
Browse files Browse the repository at this point in the history
This commit modifies the patched version of the html.validator not to
rely on log4j anymore.

There is no security gain estimated. This commit exists only to silence
"security" teams, that have some strange interpretation of security.
They assume, that you can deduce from the presence of a dependency/
library, whether or not there is a security problem. There is no
evidence, that any of the CVEs against log4j 1 apply here.
  • Loading branch information
matthiasblaesing committed Apr 1, 2023
1 parent cbacd2b commit 0a7374e
Show file tree
Hide file tree
Showing 8 changed files with 761 additions and 242 deletions.
3 changes: 1 addition & 2 deletions ide/html.validation/external/binaries-list
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,7 @@
# under the License.
CC78B59E2539C78AF923C12939D8D1CDE44B5CC1 com.hp.hpl.jena:iri:0.8
483A61B688B13C62BB201A683D98A6688B5373B6 jing-0unknown.jar
F0A0D2E29ED910808C33135A3A5A51BBA6358F7B log4j:log4j:1.2.15
2EF7FD1E7A714E04EF0881FB451CC4E85AD3D23F validator-20200626-patched.jar
4BC279C404401D55DF1811A08A43ACF8BC06FB92 validator-20200626-patched2.jar
FACC6D84B0B0A650B1D44FED941E9ADD9F326862 isorelax-20041111.jar
FF0A7D89CE99F8D9EACDDC9D5D0B154462CA9935 com.shapesecurity:salvation:2.7.2
FCF9C70F53B9C0E7BC723F43558488BF58390B33 nu.validator:galimatias:0.1.3
Expand Down
209 changes: 0 additions & 209 deletions ide/html.validation/external/log4j-1.2.15-license.txt

This file was deleted.

Original file line number Diff line number Diff line change
@@ -1,22 +1,41 @@
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
#
# https://github.com/validator/validator
# parent 787a7a7e972719edf7a79009d768f5111e1d93bc
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.

# Base commit: 787a7a7e972719edf7a79009d768f5111e1d93bc

---
build/build.py | 1 +
.../checker/schematronequiv/Assertions.java | 152 +-----
src/nu/validator/datatype/IriRef.java | 93 ----
src/nu/validator/datatype/Language.java | 2 +-
src/nu/validator/datatype/MediaQuery.java | 55 --
src/nu/validator/io/DataUri.java | 28 +-
.../LocalCacheEntityResolver.java | 9 +-
src/nu/validator/localentities/presets | 10 +
.../BufferingRootNamespaceSniffer.java | 171 +++++++
.../messages/RootNamespaceSniffer.java | 124 +++++
.../messages/ValidationTransaction.java | 471 ++++++++++++++++++
src/nu/validator/xml/BaseUriTracker.java | 70 ++-
.../validator/xml/DataUriEntityResolver.java | 18 +-
13 files changed, 864 insertions(+), 340 deletions(-)
create mode 100644 src/nu/validator/localentities/presets
create mode 100644 src/nu/validator/messages/BufferingRootNamespaceSniffer.java
create mode 100644 src/nu/validator/messages/RootNamespaceSniffer.java
create mode 100644 src/nu/validator/messages/ValidationTransaction.java

diff --git a/build/build.py b/build/build.py
index 72145331..76d57d1e 100755
Expand Down Expand Up @@ -1521,3 +1540,6 @@ index ac905052..d9febbb5 100644
DataUri du = new DataUri(systemId);
TypedInputSource is = contentTypeParser.buildTypedInputSource(systemId, publicId,
du.getContentType());
--
2.37.2

Loading

0 comments on commit 0a7374e

Please sign in to comment.