From a55792df956ef5143ed68cb8bd400a587dcb92b8 Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Tue, 10 Nov 2026 10:59:10 -0800 Subject: [PATCH] Refresh action pin inventory and jsoup negative control Record the Setup Java 6.2.0 and CodeQL 4.39.3 pins from #261 in ACTION_PINS.md with notes on what changed, and update the Setup Java version named in CI_SECURITY.md. jsoup 1.24.1 (from #262) now matches browsers on mixed-case double-escape starts, so the script-data negative control covers SCRIPT and ScRiPt as well as lowercase, and the stale comment about 1.23.2 is gone. --- .github/ACTION_PINS.md | 18 +++++++++++++----- .github/CI_SECURITY.md | 2 +- .../ContextBoundaryCompositionTest.java | 16 +++++++++------- 3 files changed, 23 insertions(+), 13 deletions(-) diff --git a/.github/ACTION_PINS.md b/.github/ACTION_PINS.md index a090532..2b7c32f 100644 --- a/.github/ACTION_PINS.md +++ b/.github/ACTION_PINS.md @@ -2,17 +2,17 @@ Resolved release tags through each authoritative repository Git ref (including annotated-tag dereferencing) on 2026-10-18 UTC; Setup Java and CodeQL were -updated and rechecked on 2026-10-20 UTC, matching the current workflows. +updated and rechecked on 2026-11-10 UTC, matching the current workflows. These are source pins, not claims that runtime tool downloads are made immutable by pinning an action. | Repository/action | Release | Commit | | --- | --- | --- | | `actions/checkout` | [v7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1) | `3d3c42e5aac5ba805825da76410c181273ba90b1` | -| `actions/setup-java` | [v6.1.0](https://github.com/actions/setup-java/releases/tag/v6.1.0) | `b843ebf9b913146b38da2eaa7aeddf76074ae1ad` | +| `actions/setup-java` | [v6.2.0](https://github.com/actions/setup-java/releases/tag/v6.2.0) | `77dd5b2ce225ea11469928ac317850245a74ae78` | | `actions/upload-artifact` | [v7.0.2](https://github.com/actions/upload-artifact/releases/tag/v7.0.2) | `cf430e030ddbb5b0abf93d22962f4752f3646cd9` | | `actions/download-artifact` | [v8.0.2](https://github.com/actions/download-artifact/releases/tag/v8.0.2) | `9000827ccba6bdab643e8b6fd33ac0654aef8333` | -| `github/codeql-action` | [v4.39.0](https://github.com/github/codeql-action/releases/tag/v4.39.0) | `6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee` | +| `github/codeql-action` | [v4.39.3](https://github.com/github/codeql-action/releases/tag/v4.39.3) | `33d7b85da1a04171e211befe2c739303b9a4c066` | | `advanced-security/maven-dependency-submission-action` | [v6.0.1](https://github.com/advanced-security/maven-dependency-submission-action/releases/tag/v6.0.1) | `a64327a7329c9939cf675e458452febe1894a70c` | CodeQL uses the `init` and `analyze` subactions at the same commit. No other @@ -27,7 +27,7 @@ actions with hidden paths were reviewed, along with the release changes. CodeQL's release tag is annotated: the Git ref points to tag object -`48870fdd6b42ee6474ec4207209ff87609271a5e`, which must be dereferenced to the +`f3bbb05694c2f74569081c28664c0866d64dec21`, which must be dereferenced to the commit in the table. Do not copy an annotated tag object's SHA into a commit pin. Verify the object's type and follow tag targets until it is a commit (equivalently, inspect the peeled `refs/tags/^{}` Git ref). @@ -41,7 +41,10 @@ pin. Verify the object's type and follow tag targets until it is a commit GPG-agent cleanup, Maven settings generation and dependency updates. Its new credential-origin and plugin-repository inputs are unused here. The changed Central exclusion behavior requires repository inputs that these workflows - do not set. + do not set. v6.2.0 adds an `mvn-mirrors` input that only writes a + `` section to the generated settings when set; these workflows do + not set it. Its other changes are Liberica and Corretto version resolution, + which this project does not use, and bundled dependency updates (Undici 6.29.1). - Artifact actions use bundled clients and GitHub's artifact service. Both run on Node.js 24 and require a runner supporting that runtime (2.327.1+); this project uses current GitHub-hosted runners, including in Java 8 jobs. The action runtime @@ -63,6 +66,11 @@ pin. Verify the object's type and follow tag targets until it is a commit the action's newer default bundle. Init and analyze both use the workspace-root checkout, satisfying the new checkout-path validation. Default Setup's proxy changes do not enable Default Setup or a private registry in this repository. + v4.39.2 moves the default bundle to CodeQL 2.27.4, warns on bundles 2.22.3 and + earlier (not used here), warns about traced analysis on macOS/Xcode 27 (these + jobs run on Ubuntu) and removes the undocumented TRAP-cache cleanup variable, + which these workflows never set. v4.39.3 fixes diff-informed alert filtering + for paths with spaces or non-ASCII characters. - Maven submission v6.0.1 runs the checkout's Maven command with the pinned `com.github.ferstl:depgraph-maven-plugin:4.0.3`, then submits with GitHub's bundled dependency toolkit. It has no composite action references. Its source logs diff --git a/.github/CI_SECURITY.md b/.github/CI_SECURITY.md index 17a5060..81aac7e 100644 --- a/.github/CI_SECURITY.md +++ b/.github/CI_SECURITY.md @@ -27,7 +27,7 @@ original packaged bytes. No privileged job restores PR artifacts or caches. All Maven invocations use a fresh runner-temporary repository. Shared Maven caching is deliberately disabled, including Java 8's necessary `install`, all -scanner builds, and intentional release commits. Setup Java's pinned v6.1.0 +scanner builds, and intentional release commits. Setup Java's pinned v6.2.0 does expose cache controls, but this configuration does not rely on any of them. See [local quarantine guidance](../RELEASING.md#maven-storage-and-repository-controls). diff --git a/core/src/test/java/org/owasp/encoder/ContextBoundaryCompositionTest.java b/core/src/test/java/org/owasp/encoder/ContextBoundaryCompositionTest.java index be66bee..3cf8b39 100644 --- a/core/src/test/java/org/owasp/encoder/ContextBoundaryCompositionTest.java +++ b/core/src/test/java/org/owasp/encoder/ContextBoundaryCompositionTest.java @@ -122,13 +122,15 @@ public void testJavaScriptOpeningTagCannotEnterDoubleEscapedState() { } } } - // Jsoup 1.23.2 diverges from browsers for mixed-case double-escape - // starts. Use lowercase for this negative control; mixed-case raw - // tokens require a browser oracle. - Document negative = Jsoup.parse("