DX | 24-01-2025 | Release

Changelog.md

@@ -1,6 +1,12 @@
 # Changelog
 
 A brief description of what changes project contains
+## Jan 20, 2025
+
+#### v1.2.13
+
+- Fix: Snyk issues
+
 ## Oct 21, 2024
 
 #### v1.2.12

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2012 - 2024 Contentstack
+Copyright (c) 2012 - 2025 Contentstack
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

pom.xml

@@ -4,7 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.contentstack.sdk</groupId>
     <artifactId>utils</artifactId>
-    <version>1.2.12</version>
+    <version>1.2.13</version>
     <packaging>jar</packaging>
     <name>Contentstack-utils</name>
     <description>Java Utils SDK for Contentstack Content Delivery API, Contentstack is a headless CMS</description>
@@ -20,16 +20,16 @@
         <maven-source-plugin.version>2.2.1</maven-source-plugin.version>
         <maven-javadoc-plugin.version>3.1.1</maven-javadoc-plugin.version>
         <junit.version>4.13.2</junit.version>
-        <jsoup.version>1.17.2</jsoup.version>
+        <jsoup.version>1.18.3</jsoup.version>
         <json.simple.version>1.1.1</json.simple.version>
         <maven-site-plugin.version>3.3</maven-site-plugin.version>
         <maven-gpg-plugin.version>1.5</maven-gpg-plugin.version>
         <nexus-staging-maven-plugin.version>1.6.7</nexus-staging-maven-plugin.version>
         <maven-release-plugin.version>2.5.3</maven-release-plugin.version>
         <validation-version>2.0.1.Final</validation-version>
-        <json-version>20240303</json-version>
-        <spring-web-version>6.1.14</spring-web-version>
-        <org.apache.commons-text>1.12.0</org.apache.commons-text>
+        <json-version>20250107</json-version>
+        <spring-web-version>6.2.1</spring-web-version>
+        <org.apache.commons-text>1.13.0</org.apache.commons-text>
     </properties>
 
     <developers>

src/main/java/com/contentstack/utils/node/NodeToHTML.java

@@ -29,35 +29,44 @@ private NodeToHTML() {
      */
     public static String textNodeToHTML(JSONObject nodeText, Option renderOption) {
         String text = nodeText.optString("text");
-        text = text.replace("\n", "<br />");
+        //Sanitization of text
+        String cleanedText = escapeTextNodes(text)
+                    .replace("\n", "<br />")
+                    .replace("\t", "&nbsp;&nbsp;&nbsp;&nbsp;");
+
         if (nodeText.has("superscript")) {
-            text = renderOption.renderMark(MarkType.SUPERSCRIPT, text);
+            cleanedText = renderOption.renderMark(MarkType.SUPERSCRIPT, cleanedText);
         }
         if (nodeText.has("subscript")) {
-            text = renderOption.renderMark(MarkType.SUBSCRIPT, text);
+            cleanedText = renderOption.renderMark(MarkType.SUBSCRIPT, cleanedText);
         }
         if (nodeText.has("inlineCode")) {
-            text = renderOption.renderMark(MarkType.INLINECODE, text);
+            cleanedText = renderOption.renderMark(MarkType.INLINECODE, cleanedText);
         }
         if (nodeText.has("strikethrough")) {
-            text = renderOption.renderMark(MarkType.STRIKETHROUGH, text);
+            cleanedText = renderOption.renderMark(MarkType.STRIKETHROUGH, cleanedText);
         }
         if (nodeText.has("underline")) {
-            text = renderOption.renderMark(MarkType.UNDERLINE, text);
+            cleanedText = renderOption.renderMark(MarkType.UNDERLINE, cleanedText);
         }
         if (nodeText.has("italic")) {
-            text = renderOption.renderMark(MarkType.ITALIC, text);
+            cleanedText = renderOption.renderMark(MarkType.ITALIC, cleanedText);
         }
         if (nodeText.has("bold")) {
-            text = renderOption.renderMark(MarkType.BOLD, text);
+            cleanedText = renderOption.renderMark(MarkType.BOLD, cleanedText);
         }
         if (nodeText.has("break")) {
-            if (!text.contains("<br />")) {
-                text = renderOption.renderMark(MarkType.BREAK, text);
+            if (!cleanedText.contains("<br />")) {
+                cleanedText = renderOption.renderMark(MarkType.BREAK, cleanedText);
             }
-            // text = renderOption.renderMark(MarkType.BREAK, text);
+            // cleanedText = renderOption.renderMark(MarkType.BREAK, cleanedText);
         }
-        return text;
+        return cleanedText;
     }
 
+    private static String escapeTextNodes(String input) {
+        return input.replace("&", "&amp;")
+                    .replace("<", "&lt;")
+                    .replace(">", "&gt;");
+    }
 }

src/main/java/com/contentstack/utils/render/DefaultOption.java

@@ -6,8 +6,6 @@
 import com.contentstack.utils.node.MarkType;
 import org.apache.commons.text.StringEscapeUtils;
 import org.json.JSONObject;
-import org.jsoup.Jsoup;
-import org.jsoup.nodes.Document;
 
 import java.util.*;
 
@@ -104,79 +102,77 @@ private String escapeInjectHtml(JSONObject nodeObj, String nodeType) {
     public String renderNode(String nodeType, JSONObject nodeObject, NodeCallback callback) {
         String strAttrs = strAttrs(nodeObject);
         String children = callback.renderChildren(nodeObject.optJSONArray("children"));
-        // Jsoup sanitization
-        Document sanitizedChildren = Jsoup.parse(children);
-        String cleanChildren = sanitizedChildren.body().html();
+
         switch (nodeType) {
             case "p":
-                return "<p" + strAttrs + ">" + cleanChildren + "</p>";
+                return "<p" + strAttrs + ">" + children + "</p>";
             case "a":
-                return "<a" + strAttrs + " href=\"" + escapeInjectHtml(nodeObject, "href") + "\">" + cleanChildren + "</a>";
+                return "<a" + strAttrs + " href=\"" + escapeInjectHtml(nodeObject, "href") + "\">" + children + "</a>";
             case "img":
                 String assetLink = getNodeStr(nodeObject, "asset-link");
                 if (!assetLink.isEmpty()) {
                     JSONObject attrs = nodeObject.optJSONObject("attrs");
                     if (attrs.has("link")) {
-                        return "<a href=\"" + escapeInjectHtml(nodeObject, "link") + "\" >" + "<img" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "asset-link") + "\" />" + cleanChildren + "</a>";
+                        return "<a href=\"" + escapeInjectHtml(nodeObject, "link") + "\" >" + "<img" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "asset-link") + "\" />" + children + "</a>";
                     }
-                    return "<img" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "asset-link") + "\" />" + cleanChildren;
+                    return "<img" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "asset-link") + "\" />" + children;
                 }
-                return "<img" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "src") + "\" />" + cleanChildren;
+                return "<img" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "src") + "\" />" + children;
             case "embed":
-                return "<iframe" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "src") + "\"" + cleanChildren + "</iframe>";
+                return "<iframe" + strAttrs + " src=\"" + escapeInjectHtml(nodeObject, "src") + "\"" + children + "</iframe>";
             case "h1":
-                return "<h1" + strAttrs + ">" + cleanChildren + "</h1>";
+                return "<h1" + strAttrs + ">" + children + "</h1>";
             case "h2":
-                return "<h2" + strAttrs + ">" + cleanChildren + "</h2>";
+                return "<h2" + strAttrs + ">" + children + "</h2>";
             case "h3":
-                return "<h3" + strAttrs + ">" + cleanChildren + "</h3>";
+                return "<h3" + strAttrs + ">" + children + "</h3>";
             case "h4":
-                return "<h4" + strAttrs + ">" + cleanChildren + "</h4>";
+                return "<h4" + strAttrs + ">" + children + "</h4>";
             case "h5":
-                return "<h5" + strAttrs + ">" + cleanChildren + "</h5>";
+                return "<h5" + strAttrs + ">" + children + "</h5>";
             case "h6":
-                return "<h6" + strAttrs + ">" + cleanChildren + "</h6>";
+                return "<h6" + strAttrs + ">" + children + "</h6>";
             case "ol":
-                return "<ol" + strAttrs + ">" + cleanChildren + "</ol>";
+                return "<ol" + strAttrs + ">" + children + "</ol>";
             case "ul":
-                return "<ul" + strAttrs + ">" + cleanChildren + "</ul>";
+                return "<ul" + strAttrs + ">" + children + "</ul>";
             case "li":
-                return "<li" + strAttrs + ">" + cleanChildren + "</li>";
+                return "<li" + strAttrs + ">" + children + "</li>";
             case "hr":
                 return "<hr" + strAttrs + " />";
             case "table":
-                return "<table " + strAttrs + ">" + cleanChildren + "</table>";
+                return "<table " + strAttrs + ">" + children + "</table>";
             case "thead":
-                return "<thead " + strAttrs + ">" + cleanChildren + "</thead>";
+                return "<thead " + strAttrs + ">" + children + "</thead>";
             case "tbody":
-                return "<tbody" + strAttrs + ">" + cleanChildren + "</tbody>";
+                return "<tbody" + strAttrs + ">" + children + "</tbody>";
             case "tfoot":
-                return "<tfoot" + strAttrs + ">" + cleanChildren + "</tfoot>";
+                return "<tfoot" + strAttrs + ">" + children + "</tfoot>";
             case "tr":
-                return "<tr" + strAttrs + ">" + cleanChildren + "</tr>";
+                return "<tr" + strAttrs + ">" + children + "</tr>";
             case "th":{
                 if (nodeObject.has("attrs") && nodeObject.optJSONObject("attrs").has("void") && 
                     nodeObject.optJSONObject("attrs").optBoolean("void")) {
                   return "";
                 }else{
-                return "<th" + strAttrs + ">" + cleanChildren + "</th>";}}
+                return "<th" + strAttrs + ">" + children + "</th>";}}
             case "td":{
                 if (nodeObject.has("attrs") && nodeObject.optJSONObject("attrs").has("void") && 
                     nodeObject.optJSONObject("attrs").optBoolean("void")) {
                   return "";
                 }else{
-                return "<td" + strAttrs + ">" + cleanChildren + "</td>";}}
+                return "<td" + strAttrs + ">" + children + "</td>";}}
 
             case "blockquote":
-                return "<blockquote" + strAttrs + ">" + cleanChildren + "</blockquote>";
+                return "<blockquote" + strAttrs + ">" + children + "</blockquote>";
             case "code":
-                return "<code" + strAttrs + ">" + cleanChildren + "</code>";
+                return "<code" + strAttrs + ">" + children + "</code>";
             case "reference":
                 return "";
             case "fragment":
-                return "<fragment" + strAttrs + ">" + cleanChildren + "</fragment>";
+                return "<fragment" + strAttrs + ">" + children + "</fragment>";
             default:
-                return cleanChildren;
+                return children;
         }
     }
 
@@ -197,16 +193,8 @@ String strAttrs(JSONObject nodeObject) {
                 for (String key : attrsObject.keySet()) {
                     Object objValue = attrsObject.opt(key);
                     String value = objValue.toString();
-
-                    StringBuilder escapedValue = new StringBuilder();
-                    for (char ch : value.toCharArray()) {
-                      if (ch == '&' || ch == '<' || ch == '>' || ch == '"' || ch == '\'') {
-                        escapedValue.append("&#").append((int) ch).append(';'); 
-                      } else {
-                        escapedValue.append(ch);
-                      }
-                    }
-                    value = escapedValue.toString();
+                     // Escape HTML entities using StringEscapeUtils
+                    value = StringEscapeUtils.escapeHtml4(value);
                     // If style is available, do styling calculations
                     if (Objects.equals(key, "style")) {
                         String resultStyle = stringifyStyles(attrsObject.optJSONObject("style"));