From 16312e6afc1e7f8097eb555a7e74e97880bc0ed4 Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Thu, 24 Sep 2026 16:02:49 -0700 Subject: [PATCH 1/2] Expand the security policy now that private reporting is enabled Private vulnerability reporting is now enabled for the repository, so the advisory form SECURITY.md points to works for any GitHub user. Rewrite SECURITY.md to cover: - supported versions for all four Maven coordinates, with a note that upgrading the core artifact is drop-in (no public API removed between 1.2.3 and 1.4.0) - the Security Advisories page, the GitHub-account requirement, and an email fallback to the project leaders - what to include in a report, what is in and out of scope, and best-effort response goals Link the policy from README.md, and add updating SECURITY.md to the release notes. Closes #107 Co-Authored-By: Claude Opus 5.5 (1M context) --- README.md | 6 ++++++ SECURITY.md | 59 +++++++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 59 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index a4d4c72..992328f 100644 --- a/README.md +++ b/README.md @@ -59,6 +59,11 @@ Please look at the javadoc for Encode to see the variety of contexts for which y Happy Encoding! +Security +-------- +Please report suspected vulnerabilities privately. See [SECURITY.md](SECURITY.md) for +the reporting channels, supported versions, and scope. + Building -------- @@ -141,6 +146,7 @@ mvn clean deploy -DperformRelease=true When changing the version, update the root `pom.xml`, the `` version in each module POM, and `encoder.version` in `jakarta-test/pom.xml`. CI fails if `jakarta-test` would test a different `encoder-jakarta-jsp` version than the one being built. +When publishing a release, also update the supported versions in `SECURITY.md`. News diff --git a/SECURITY.md b/SECURITY.md index e1b7f4a..bf43bfa 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,13 +2,60 @@ ## Supported Versions -Only the currently released version of the OWASP Java Encoder is supported. +Only the latest 1.x release receives security fixes. Fixes ship in a new release; +older release lines are not patched. -| Version | Supported | -| ------- | ------------------ | -| 1.4.0 | :white_check_mark: | -| < 1.4.0 | :x: | +| Maven coordinate | Supported | Not supported | +| --------------------------------------- | --------- | ------------- | +| `org.owasp.encoder:encoder` | 1.4.0 | < 1.4.0 | +| `org.owasp.encoder:encoder-jsp` | 1.4.0 | < 1.4.0 | +| `org.owasp.encoder:encoder-jakarta-jsp` | 1.4.0 | < 1.4.0 | +| `org.owasp.encoder:encoder-esapi` | 1.4.0 | < 1.4.0 | + +Upgrading the core `encoder` artifact to the latest 1.x release is a drop-in change: +no public API was removed between 1.2.3 and 1.4.0. ## Reporting a Vulnerability -If you suspect that there is a vulnerability, please report it privately using GitHub's [Security Advisories](https://github.com/OWASP/owasp-java-encoder/security/advisories/new). +Please report suspected vulnerabilities privately, not in public issues or pull requests. + +Use the **Report a vulnerability** button on the repository's +[Security Advisories](https://github.com/OWASP/owasp-java-encoder/security/advisories) +page. The form requires a GitHub account. If you cannot use it, email the project +leaders at jeremy.long@owasp.org and jim@owasp.org. + +A useful report includes: + +- the affected artifact and version +- the `Encode` method, tag, or EL function involved +- the input, the encoded output, and the output you expected +- where the output was used (for example, an HTML attribute or a JavaScript string) + and the browser or parser that interpreted it +- a minimal reproduction, if you have one + +## Scope + +In scope: + +- input that passes through a documented `Encode.forXxx` method (or the matching tag + or EL function), is used in the context that method documents, and is then + interpreted as code or markup by a current mainstream parser for that context +- a crash, or unbounded CPU or memory use, on any input +- output that contradicts the encoder's documented contract + +Out of scope: + +- using an encoder in a context it does not document (for example, `forHtml` output + placed in a JavaScript string) +- canonicalization, decoding, or input validation, which this library does not perform +- vulnerabilities in ESAPI, Spring, or servlet containers; report ESAPI issues through + the [ESAPI security policy](https://github.com/ESAPI/esapi-java-legacy/security) +- the unpublished `jakarta-test` application + +## Response + +These are goals for a volunteer-run project, not guarantees: + +- acknowledge a report within about a week +- coordinate disclosure with the reporter, publishing a fix and advisory within + 90 days where possible From 80851e3aaad1c1c26ce195371ad2273d79435ad7 Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Thu, 24 Sep 2026 16:06:20 -0700 Subject: [PATCH 2/2] Qualify the SECURITY.md upgrade note with the Java 8 baseline encoder 1.2.3 targets Java 5 (class file major 49) and 1.4.0 targets Java 8 (major 52). The public API is a superset, but the upgrade is not drop-in for applications still on Java 5 through 7. Co-Authored-By: Claude Opus 5.5 (1M context) --- SECURITY.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index bf43bfa..8486f86 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,8 +12,9 @@ older release lines are not patched. | `org.owasp.encoder:encoder-jakarta-jsp` | 1.4.0 | < 1.4.0 | | `org.owasp.encoder:encoder-esapi` | 1.4.0 | < 1.4.0 | -Upgrading the core `encoder` artifact to the latest 1.x release is a drop-in change: -no public API was removed between 1.2.3 and 1.4.0. +Upgrading the core `encoder` artifact to the latest 1.x release needs no code changes: +no public API was removed between 1.2.3 and 1.4.0. It does need Java 8 or later; +1.2.3 and earlier also ran on Java 5 through 7. ## Reporting a Vulnerability