Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

readd an implementation of Whitelist for backwards compatibility #2019

Closed
wants to merge 2 commits into from

Conversation

bangert
Copy link

@bangert bangert commented Oct 25, 2023

First off, thanks for jsoup - i've used it in multiple settings and it is a pleasure to use.

In this case however, we are not the direct user of jsoup. We use some software, where we do not control the dependency chain and that still depends on jsoup <1.15.x. For security reason we would like to update to the latest version - as is also the recommendation in the security policy[1] . However the recent ABI breaking change renaming the Whitelist class to Safelist prevents us from doing so.

This PR readds a Whitelist class, that uses a Safelist internally. It works for us and it may be useful to others.
Thanks

[1] https://github.com/jhy/jsoup/blob/master/SECURITY.md

@jhy
Copy link
Owner

jhy commented Oct 28, 2023

Hi there - thanks for your feedback on jsoup, I'm glad to hear its been useful for you!

And thanks for the code sample. It's similar to the compatibility shim (#1464) we provided between 1.14.1 (2021-Jul-10) where the Whitelist was deprecated in favor of Safelist, and 1.15.1 (2022-May-15) when it was ultimately removed.

@jhy jhy closed this Oct 28, 2023
@bangert
Copy link
Author

bangert commented Oct 30, 2023

ah - i didnt know that. less than a year is pretty ambitious, but i understand that it is difficult to get downstreams to upgrade if they dont have too - which this PR is a testament of, since they sometimes dont even upgrade even though they have to...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants