It seems that CssBox is set up to use <a href="https://mvnrepository.com/artifact/net.

I think we can use <code class="no

I've proposed the change to htmlunit-neko@3.0.0 in Apr. 2023, and further update today

Upgrade CSSbox to use active NekoHTML? about cssbox HOT 3 OPEN

radkovo commented on September 2, 2024

Upgrade CSSbox to use active NekoHTML?

from cssbox.

Comments (3)

soundasleep commented on September 2, 2024

With a bit of hacking I've found a way to configure a local installation (through Gradle) to use nekohtml 2.59.

Configure your build.gradle to exclude the transitive dependency:

implementation("net.sf.cssbox:cssbox:$cssboxVersion") {
  exclude group: "net.sourceforge.nekohtml", module: "nekohtml" 
}
implementation "net.sourceforge.htmlunit:neko-htmlunit:$nekoHtmlUnitVersion"

And then it looks like the only change one needs to make is to not use DefaultDOMSource:

public class BetterDOMSource extends DOMSource {
	public BetterDOMSource(DocumentSource src) {
		super(src);
	}

	@Override
	public Document parse() throws SAXException, IOException {
		DOMParser parser = new DOMParser(new HTMLConfiguration(););
		parser.setProperty("http://cyberneko.org/html/properties/names/elems", "lower");
		if (charset != null)
			parser.setProperty("http://cyberneko.org/html/properties/default-encoding", charset);
		parser.parse(new org.xml.sax.InputSource(getDocumentSource().getInputStream()));
		return parser.getDocument();
	}
}

And use this source to load your Documents instead:

ByteArrayInputStream is = new ByteArrayInputStream(html.getBytes(Charset.forName("UTF-8")));
StreamDocumentSource source = new StreamDocumentSource(is, url, "text/html");

DOMSource parser = new BetterDOMSource(source);
Document document = parser.parse();

from cssbox.

miurahr commented on September 2, 2024

I think we can use org.htmlunit:htmlunit-neko:3.6.0 for CSSBox project.
It solves CVE-2022-29546 and CVE-2022-28366.

I've changed DefaultDOMSource like

    public Document parse() throws SAXException, IOException
    {
        DOMParser parser = new DOMParser(HTMLDocumentImpl.class);
        parser.setProperty("http://cyberneko.org/html/properties/names/elems", "lower");
        if (charset != null)
            parser.setProperty("http://cyberneko.org/html/properties/default-encoding", charset);
        parser.parse(new org.xml.sax.InputSource(getDocumentSource().getInputStream()));
        return parser.getDocument();
    }