Skip to content

Update JSoup to 1.15.3 - #504

Merged
thomasegense merged 1 commit into
netarchivesuite:masterfrom
WEB-CHILD:upgrade-jsoup-to-1.15.3
Jun 24, 2026
Merged

Update JSoup to 1.15.3#504
thomasegense merged 1 commit into
netarchivesuite:masterfrom
WEB-CHILD:upgrade-jsoup-to-1.15.3

Conversation

@VictorHarbo

Copy link
Copy Markdown
Collaborator

Sorry for these small PRs, just wanting to keep them individual

Updating JSoup.

1.15.3 is a security update fixing the following:

  • CVE-2022-36033, an XSS hole where the HTML sanitizer (Cleaner/Safelist) could let through crafted javascript: URLs.

The important change here for SolrWayback is how output is normalised:

  • SolrWayback tests compare the full serialized HTML of doc.toString() against checked-in _expected.html fixtures. Jsoup 1.14.2's pretty-printer generated those fixtures. jsoup 1.15.1 changed how that pretty-printer emits whitespace, so the output shifted even though the parsed document and the rewritten URLs are identical.

@VictorHarbo
VictorHarbo requested a review from thomasegense June 23, 2026 09:53
@VictorHarbo VictorHarbo self-assigned this Jun 23, 2026
@VictorHarbo VictorHarbo added dependencies Pull requests that update a dependency file backend labels Jun 23, 2026

@thomasegense thomasegense left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

.replace("</style> <a", "</style>\n<a") // JSoup strangeness with lines starting with <a...>
.replace("</a> <a", "</a>\n<a")
.replace("--> <a", "-->\n<a")
// Put every tag boundary on its own line and collapse whitespace runs so that the comparison is

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That replaced some really ugly code.

@thomasegense
thomasegense merged commit 7bc6ce2 into netarchivesuite:master Jun 24, 2026
3 checks passed
@VictorHarbo
VictorHarbo deleted the upgrade-jsoup-to-1.15.3 branch June 24, 2026 12:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backend dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants