Skip to content

Fix JPMS split-package error by bundling shims into the main JAR #379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aleruz-dt wants to merge 1 commit into
base: main
Choose a base branch
from
+61 −1
Open

Fix JPMS split-package error by bundling shims into the main JAR #379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,5 @@ target
.settings
.idea
out
PLAN.md
dependency-reduced-pom.xml
5 changes: 5 additions & 0 deletions change_log.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
# OWASP Java HTML Sanitizer Change Log

Most recent at top.
* Next release
* Fix: `java8-shim` and `java10-shim` are now bundled inside the main JAR,
resolving the JPMS split-package error on the module path. Consumers no
longer need to declare the shim artifacts as direct dependencies. Both
shim JARs remain published on Maven Central for backwards compatibility.
* Release 20240325.1
* Remove dependency on Guava
* Raise minimum supported JVM release to 8
Expand Down
6 changes: 5 additions & 1 deletion docs/maven.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,16 @@ Including among your POMs `<dependencies>` this snippet of XML...
<dependency>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>owasp-java-html-sanitizer</artifactId>
<version>20180219.1</version>
<version>20240325.1</version>
</dependency>
```

...will make the sanitizer available.

The sanitizer JAR is self-contained: the `java8-shim` and `java10-shim` artifacts
are bundled inside it and do **not** need to be declared as separate dependencies,
including when using the JPMS module path.

Be sure to change the
[version](https://cwiki.apache.org/confluence/display/MAVENOLD/Dependency+Mediation+and+Conflict+Resolution#DependencyMediationandConflictResolution-DependencyVersionRanges)
to a range suitable to your project. There are no unstable releases
Expand Down
44 changes: 44 additions & 0 deletions owasp-java-html-sanitizer/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,10 @@
<configuration>
<instructions>
<Export-Package>org.owasp.html</Export-Package>
<!-- Explicit JPMS automatic module name so consumers using the
module path can require this module by a stable name that
is independent of the JAR filename. -->
<Automatic-Module-Name>owasp.java.html.sanitizer</Automatic-Module-Name>

@aalmiray aalmiray Jun 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would make more sense to use a proper module descriptor at this point. The module descriptor should be placed in the versioned space of the JAR, i.e, META-INF/versions/9

</instructions>
</configuration>
</plugin>
Expand All @@ -86,17 +90,57 @@
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<executions>
<execution>
<phase>package</phase>
<goals><goal>shade</goal></goals>
<configuration>
<!-- Inline java8-shim and java10-shim into this JAR so that
consumers using the JPMS module path do not encounter a
split-package error from org.owasp.shim appearing in
multiple JARs. See https://github.com/OWASP/java-html-sanitizer/issues/341 -->
<artifactSet>
<includes>
<include>com.googlecode.owasp-java-html-sanitizer:java8-shim</include>
<include>com.googlecode.owasp-java-html-sanitizer:java10-shim</include>
</includes>
</artifactSet>
<filters>
<filter>
<artifact>*:*</artifact>
<excludes>
<!-- Exclude shim Maven metadata to avoid duplicate
pom.properties / pom.xml entries in the JAR -->
<exclude>META-INF/maven/com.googlecode.owasp-java-html-sanitizer/java*/**</exclude>
</excludes>
</filter>
</filters>
<!-- Replace the original JAR with the shaded one as the
main artifact; do not attach a separate shaded artifact -->
<shadedArtifactAttached>false</shadedArtifactAttached>
<!-- Generate a reduced POM that omits the now-inlined shim
dependencies, keeping the published POM accurate -->
<createDependencyReducedPom>true</createDependencyReducedPom>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>

<dependencies>
<dependency>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>java8-shim</artifactId>
<optional>true</optional>

@aalmiray aalmiray Jun 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the shims are included in the final JAR then there's no sense in publishing them separately to Maven Central. They should be skipped from deployment.

</dependency>
<dependency>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>java10-shim</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>commons-codec</groupId>
Expand Down
5 changes: 5 additions & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,11 @@ application while protecting against XSS.
<artifactId>maven-verifier-plugin</artifactId>
<version>1.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<version>3.6.0</version>
</plugin>
</plugins>
</pluginManagement>
<plugins>
Expand Down