OWASP/java-html-sanitizer release-20260921.1

Release 20260921.1

on GitHub

Changelog

• b8d90c9 Release version 20260921.1 (GitHub Actions)
• 37d9212 Preserve form text policy across implied tables (Jim Manico)
• 7ae2b5c Stabilize list-item closure across output contexts (Jim Manico)
• 9059be1 Preserve text after an ignored form in a dropped table (Jim Manico)
• 27d2c04 Preserve nested list context for browser tree stability (Jim Manico)
• 1901496 Cover dropped-template list residuals (Jim Manico)
• 0a55504 Stabilize list contexts after dropped wrappers (Jim Manico)
• 6e0254c Stabilize text after bare dropped-table parts (Jim Manico)
• 7b4e234 Take the review: keep select retirement synchronized and scoped (Jim Manico)
• 50a7d01 Fix browser-round-trip text gates for #497 (Jim Manico)
• 9ebd255 Take the review: keep the rule to the container, not to table scope (Jim Manico)
• 6469377 Take the third review: keep the formatting a browser keeps, and say what changed (Jim Manico)
• ee953d2 Take the second review: judge every barrier by the output, keep the option's item (Jim Manico)
• afe8e8e Take the review: bound the resumption queue, judge barriers by the output (Jim Manico)
• 2a9ede4 Take the probe: do not resume formatting inside an element read as raw text (Jim Manico)
• a9f9abb Close the open list item for a list item start tag, through formatting (Jim Manico)
• f9a0c87 Take the review: a dropped template bounds no table scope, and holds a col directly too (Jim Manico)
• 24c6c78 Give a caption or column group under a dropped template its table in Sanitizers.TABLES (Jim Manico)
• 8b6c865 Take the second review: push the table out from below the dropped entries (Jim Manico)
• 2560fc8 Take the probe: stop the select's scan at the select's own logical item (Jim Manico)
• 1cb96ab Take the review: judge the select's place by the nearest emitted ancestor, keep the dropped cell's end tag (Jim Manico)
• ec40ba1 Take the third review: the output decides an element's containment under a known root (Jim Manico)
• 2c5a5c6 Keep item 2 out: judge only an option under a dropped template here (Jim Manico)
• 3120ddc Take the probe: an option under a dropped template inside a table gets a foster-parented select (Jim Manico)
• 61c3ffe Take the probe: forward foreign table parts only while the input names a root, outside raw-text nodes (Jim Manico)
• d8c9c25 Take the review: judge a dropped template's parts in the output, foster-parent the select out of a kept table (Jim Manico)
• 3d02eb5 Take the second review: forward foreign table parts, no select for a foreign option (Jim Manico)
• 16e9003 Take the probe: keep the table parts' wrappers as they were, judge parts under a dropped template where it stood (Jim Manico)
• 780c355 Apply the free wrappers under every container past the wrapper's set (Jim Manico)
• e07877a Take the probe: keep HTML containment for a raw-text-named foreign node (Jim Manico)
• b75252a Take the review: bound the root by what the parsers still have open (Jim Manico)
• 4aff8a1 Take the review: leave more of a document behind before the throw (Jim Manico)
• 9a1979e Judge content below the foreign root as in a fresh body (Jim Manico)
• 74d8e25 Test that openDocument resets what a throwing receiver left open (Jim Manico)
• 6dba384 Keep the list's implied item out of a forwarded foreign root (Jim Manico)
• a750b4a Take the review: let the select's item through the limit check (Jim Manico)
• 10c8952 Never emit the list item implied for content a select cannot hold (Jim Manico)
• fd0fd4c Take the review: open a suppressed option's policy entry under its canonical name (Jim Manico)
• b5f6bca Document the nesting limit's exception and report dropped tags under one name (Jim Manico)
• 6c1fb9f Take the review: forget a queued formatting element its end tag or a new link ends (Jim Manico)
• bd1bf23 Take the review: keep disallowed text out of the element a suppressed part lands in (Jim Manico)
• cfb21b6 Take the review: index the output names that bound a form's table scope (Jim Manico)
• 3387e8c Take the review: do not resume formatting around a wrapper implied for a tag (Jim Manico)
• cf8bad6 Take the review: keep cell text of a dropped table in an integration point (Jim Manico)
• c772698 Take the review: forward a dropped foreign root's children beside a table (Jim Manico)
• eb11921 Take the review: keep a dropped select's options out of an implied list item (Jim Manico)
• 33c2b90 Take the review: replay a form's start decision at its end tag (Jim Manico)
• f2fc154 Take the review: do not spend the nesting budget on dropped unknown tags (Jim Manico)
• f043355 Take the review: reset the two fields the document lifecycle missed (Jim Manico)
• adf82d8 Take the review: report a form start ignored for the form pointer (Jim Manico)
• 51e5a35 Take the review: skip the outputless-table scans when no table is marked (Jim Manico)
• 462adc5 Take the review: assert the browser's view of content around table forms (Jim Manico)
• 2c2d2bf Take the review: keep text that lands beside a retired output table (Jim Manico)
• 147f3fa Take the review: keep the table open for a form in a dropped row group (Jim Manico)
• 350cc3a Take the review: leave a foreign root in place outside table modes (Jim Manico)
• 58dd112 Take the review: latch the form pointer only for a form that is emitted (Jim Manico)
• 16e132d Take the review: answer the balancer from the policy behind a listener (Jim Manico)
• 756d10c Take the review: forward unrecognized starts under their canonical name (Jim Manico)
• f3f4406 Take the review: count forwarded elements toward the nesting limit (Jim Manico)
• 19b5fd2 Judge formatting resumption by the insertion point, not by the tag (Jim Manico)
• bceeb7f Do not resume formatting where content is inserted under foreign rules (Jim Manico)
• e92ffb3 Forget forwarded elements inside a suppressed option by count, not depth (Jim Manico)
• 6fd3a1f Close popped foreign elements by identity and balance forwarded elements (Jim Manico)
• 69cde7e Track form pointer, foreign and template contexts for #484 review fixes (Jim Manico)
• 14e4d29 Handle forms in table insertion modes (Jim Manico)
• a75248f Preserve text gates in renamed literal elements (Goutam Adwant)
• 5fab8e6 docs: clarify module guides and improve navigation (Jim Manico)
• d170ec1 docs: add module README guides (Jim Manico)
• 94a3a6c Balance table parts outside their context (Jim Manico)
• 2356e1f Close elements emitted at the nesting limit (Jim Manico)
• 705b331 Preserve custom policy reporter compatibility (Jim Manico)
• 3240a05 Fix table foster-parenting edge cases (Jim Manico)
• 77fc910 Judge pushed-out content by the element that holds the table (Jim Manico)
• 6025077 Stop the return to a pushed-out table at a table-scope boundary (Jim Manico)
• b93f7b6 Keep a table open across content a browser would put in front of it (Jim Manico)
• a59c4e6 Report the renderer's tag and attribute drops to HtmlChangeListener (Jim Manico)
• 5a9d28b Judge a renamed element by the name the author wrote (Jim Manico)
• 99764a3 Fix stale Javadoc link to the renamed foreign-content root set (Jim Manico)
• 669b266 Rework the literal-text tag filter for fidelity and footprint (Jim Manico)
• c62be95 Fix review follow-ups for literal content and links (Jim Manico)
• 599af06 Close two more ways past the literal-text filter, and back it in the renderer (Jim Manico)
• 3d617f3 Report policy-filtered literal text to listeners (Jim Manico)
• 0ac7b29 Fail closed for an open dialog like search in foreign content (Jim Manico)
• 07cb81b Take the review: the comment element is not literal content (Jim Manico)
• b83b617 Drop a tag the input ends inside; read "</" plus a non-letter as a comment (Jim Manico)
• 86cfa80 Wrap a test line to 80 columns (Jim Manico)
• 7b06316 Stop a link inside a table cell from ending a link outside the table (Jim Manico)
• 430cadc Take the review: bind the text hook per document, see through wrappers (Jim Manico)
• 95ba82f Strip every tag from the text of kept literal-content elements (Jim Manico)
• f9819fa Fix foreign-content tracker gaps found in review (Jim Manico)
• 2eeecfa Tidy pre-existing javadoc errors and over-long lines (Jim Manico)
• e236121 Report emptied elements' attributes, their values, and dropped text (Jim Manico)
• 5a5c0c6 Track HTML stack mutations in foreign content (Jim Manico)
• b7936a9 Record the widened authority rejection and bound the relative-only reach (Jim Manico)
• 9e05566 Fail closed when an HTML end tag's effect on foreign content is unknown (Jim Manico)
• 4ed47ef Reject browser-equivalent URL authorities (Jim Manico)
• c7d8455 Update AGENTS.md (Jim Manico)
• 192a0e8 Add an explicit relative-only URL policy (Jim Manico)
• eb1d986 Document where the URL protocol guard runs relative to author policies (Jim Manico)
• 0308408 Close foreign content on the end tag of an enclosing HTML element (Jim Manico)
• 2f2d53f Track parser context for foreign self-closing tags (Jim Manico)
• 02a0ce1 Honor the self-closing flag on start tags inside svg and math (Jim Manico)
• 3cd7853 Add a JPMS module descriptor in META-INF/versions/9 (Jim Manico)
• c920a45 Let the default URL protocol guard yield in PolicyFactory.and (Jim Manico)
• fa404e0 Add AGENTS.md guidance for AI-assisted work (Jim Manico)
• 176d6a6 Take the review: constant-time gate, and disallowTextIn wherever x appears (Jim Manico)
• f9e8977 Gate text by its enclosing elements, and honour disallowTextIn on dropped ones (Jim Manico)
• b701e1a Report a renamed element as kept, not discarded (Jim Manico)
• 3a55b6b Restore the brace the merge dropped between two test blocks (Jim Manico)
• b7bf310 Let contain what browsers put in template.content (Jim Manico)
• 6d712ce Stop PolicyFactory from retaining the builder that made it (Jim Manico)
• 5395a45 Take the review: list Dependabot directories, cover both matching arms (Jim Manico)
• 413b35a Cover matching(Predicate) here, and configure Dependabot for new modules (Jim Manico)
• f1d6b62 Correct the examples ...