Fix #363: CVE-2025-66021

[melloware]

Fix #363: CVE-2025-66021

• 6 unit tests that failed before the fix now pass
• All existing unit tests pass (had to make some Windows fixes)
• New code checks any element with allowTextIn to make sure it allows only tags allowed
• Trims the tag so < script> is the same as <script>

[melloware]

cc @ironfisto

[damianszczepanik]

@mikesamuel can you approve workflow and review this PR?

[melloware]

Rebased!

[kittylyst]

I've reviewed this as best I can without having full context on the project, and I concur that getting this out there sooner rather than later is better.

I'm +1 to merge and release.

[damianszczepanik]

Repository owner has to agree to start building this PR

[kittylyst]

Approve the builds to run - let's see what happens

[melloware]

Looks like it all passed and built!

[krzysztof-osiecki]

sorry for being annoing with @ but is there any info about the progress of this?

looks like we are waiting for @jmanico and @erikcostlow review but as i understand from here #363 that they no longer maintain this project and now its on @aalmiray to release this?

[aalmiray]

I'm the one that has upgraded the build for posting releases, yes. But I do not posses the domain knowledge required to asses if code patches are suitable for fixes, specially for a CVE. Which is why I'm waiting for someone else to clear that out.

[krzysztof-osiecki]

That's perfectly reasonable and that someone else would be one of the guys I mentioned in my previous comment?

[melloware]

I have taken this PR as far as it can go. Unit tests proving the issue, then iterating and fixing the code until the broken unit tests pass. Introduced new unit tests when scenario;s like < script> were presented and fixed.

[kittylyst]

Thanks to everyone who has contributed to this PR.

As the new maintainers are still levelling up, and are operating at best efforts, then I think we're as sure as we can be.

I propose we give it 24 hours and if no-one complains, then @aalmiray should do a release. Any objections to that plan?

[aalmiray]

NYE's gift? 😅

The first release under the new scheme is good to go, although I think further updates may be needed as the project's version does not follow semver, a manual step is needed for now.

This being said, JReleaser supports other versioning options. These updates can be applied later.

[melloware]

+1 on this idea!

[jmanico]

looks like we are waiting for @jmanico and @erikcostlow review but as i understand from here #363 that they no longer maintain this project and now its on @aalmiray to release this?

Yes that is fair. I think this is a good plan if the rest of the team supports it.

[jmanico]

At the very least I merged the PR into main. I'll leave it to others to decide on when to release.