Bump antisamy from 1.4.4 to 1.6.4

[dependabot]

Bumps antisamy from 1.4.4 to 1.6.4.

Release notes

Sourced from antisamy's releases.

v1.6.4

This release addresses issue #87, which also fixes CVE-2021-35043.

Release version 1.6.3

This release addresses issue #80 by allowing jar: URLs for loading policy files stored inside of JARs. It also adds support for !important CSS tags as described in issue #81. SBOM files are also now produced and included with the release.

Release version 1.6.2

This release fixes bug #75 reported by the OWASP ESAPI team, and adds some new JavaDoc to the Policy.java class describing the major changes to AntiSamy in the 1.6+ release.

Release version 1.6.1

The 1.6.0 release erroneously listed slf4j as the logging API, but then directly used log4j. This release eliminates the use of log4j entirely, using slf4j. The 1.6.1 release includes the slf4j-simple logging library, but AntiSamy users can exclude this library and use whatever slf4j logging library they prefer. Please read the README for more details.

Release version 1.6.0

This release includes a few minor bug fixes and all available upgrades to the libraries and plugins used by the project, including a few upgrades that eliminate known CVEs in those libraries.

The one major change in this release is that AntiSamy XSD schema validation is now enabled by default starting with AntiSamy 1.6.0.

While working on some improvements to AntiSamy's XML Schema Definition (XSD) for AntiSamy policy files, we noticed that AntiSamy was NOT actually enforcing the XSD. So, we've CHANGED the default behavior starting with AntiSamy 1.6.0 to enforce the schema, and not continue if the AntiSamy policy is invalid. However ... we recognize that it might not be possible for developers to fix their AntiSamy policies right away if they are non-compliant, and yet still want to upgrade AntiSamy to pick up any security improvements, feature enhancements, and bug fixes. As such, we've provided two ways to (temporarily!) disable schema validation.

Please read the section "### NOTE: Schema validation behavior change starting with AntiSamy 1.6.0" in the README for details on how to (temporarily) disable schema validation for AntiSamy if your project needs to do so.

Release version 1.5.13

This release addresses AntiSamy issue #62, which caused a NullPointerException in AntiSamyDOMScanner.java for certain input.

Release version 1.5.12

This release upgrades the Xerces dependency to 2.12.1 to eliminate the known vulnerability in Xerces 2.12.0 (CVE-2020-14338). While this CVE does not affect AntiSamy given how AntiSamy uses Xerces, we produced this point release to eliminate the known vulnerability in this dependency anyway to eliminate this CVE showing up on dependency tree scanners.

Release version 1.5.11

This release upgrades dependency httpclient to 4.5.13 to address CVE-2020-13956 in this library.

We note that there is also a known vulnerability (CVE-2020-14338) in xercesImpl:2.12.0 but Apache has not released an update to this library yet to eliminate it. We analyzed this CVE and determined that it does NOT affect AntiSamy. However, if you still want to eliminate this CVE, then you can exclude the version used by AntiSamy and use the version patched by JBoss described here: https://mvnrepository.com/artifact/xerces/xercesImpl/2.12.0.SP03. This will require you to do add the JBoss Maven repo to your pom. Alternately, you can upgrade to the patched version released by Apache when that becomes available.

This release also fixes this low risk (phishing) security issue described here: #48 (Default URL regex allows URL starting with // to jump out of origin domain)

The release also includes some minor code cleanup and various dependency/plugin upgrades that were available.

Release version 1.5.10

This release upgrades dependency batik-css from 1.12 to 1.13 to address CVE-2019-17566 in batik-css.

And also includes adoption of an old pull request: nahsra/antisamy#18 (Fix the paragraph and name attribute regular expressions in antisamy.xml)

Release version 1.5.9

Minor fix to address issue #39. Upgrade all dependencies to lates available versions.

Release version 1.5.8

No release notes provided.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #36.