Activity for HtmlCleaner

Fynn Godau created ticket #242

Fynn Godau — Tue, 30 Sep 2025 16:40:13 -0000

Whitespaces enclosed in their own tags are sometimes dropped

Richard Morley-Smith posted a comment on ticket #227

Richard Morley-Smith — Thu, 05 Jun 2025 13:56:23 -0000

Hi @scottwilson, this one has been fixed as a result of the changes to prevent stackoverflow in 2.29, so it can be closed.

Bilal Taha modified a comment on discussion Open Discussion

Bilal Taha — Mon, 30 Dec 2024 16:45:20 -0000

I have a Java method that uses HTMLCleaner version 2.4. Due to high CVE vulnerabilities, I need to update HTMLCleaner to version 2.29. However, the generated HTML output from version 2.29 contains nested tags, which is incorrect for my use case. For example, given the input: 323328.33 2024-12-20T16:00:00.000-05:00 Stam- 1234 TRADITIONAL_IRA...

Bilal Taha posted a comment on discussion Open Discussion

Bilal Taha — Mon, 30 Dec 2024 16:44:21 -0000

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Tue, 29 Oct 2024 20:17:18 -0000

Hi Marco, Its definitely going to happen, I just need to put the migration plan together. Scott

Marco De Toma posted a comment on discussion Open Discussion

Marco De Toma — Sat, 26 Oct 2024 07:58:18 -0000

Hi, is there any update to this migration? I'm considering to adopt this library but I've some security-wise concerns. Having this library on Github, it will make the fix of new CVE easier I think Marco

Simon Urli posted a comment on discussion Open Discussion

Simon Urli — Wed, 12 Jun 2024 07:50:57 -0000

Hi Scott, thanks for your answer. So then what are the next steps and how can we plan such a move to Github? I see two options there: 1. you do the move, you're still owner and it's an official migration and we contribute through pull requests at least at first 2. you keep HtmlCleaner here and we create a fork on Github that we maintain there personally I don't like option 2 and I'd really prefer to go towards option 1, but it depends on you. Simon

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Fri, 19 Apr 2024 13:47:52 -0000

Hi Simon, I think it's a good time to talk about the future of the library in general. I'm aware that I don't have a lot of time available to maintain it, and these days I'm doing 99% Python development in my day job, so each time I have to review a patch my first task is to get a Java setup working again! Certainly moving the project over to Github is something that's been on my mind for a while as there are clear advantages there. I think in general I'd be happier if people who depend on HtmlCleaner...

Simon Urli posted a comment on discussion Open Discussion

Simon Urli — Fri, 19 Apr 2024 09:38:15 -0000

Hello, I recently started trying to contribute directly to the code of HtmlCleaner for fixing a bug I reported, and I discovered that it wasn't that easy to contribute and get feedbacks on sourceforge. At least, not as easy as it can be on Github (or Gitlab). And I'm wondering if moving the project couldn't help get more contributions and have bug fixed more quickly. To give a bit of context, I'm one of the core committer of XWiki (https://www.xwiki.org) whose code in available on Github (https://github.com/xwiki)....

Michael Hamann posted a comment on ticket #241

Michael Hamann — Fri, 19 Apr 2024 09:18:19 -0000

I forgot to mention, this is with HTML 5 tag definitions, with HTML 4 the example input is kept as-is.

Michael Hamann created ticket #241

Michael Hamann — Fri, 19 Apr 2024 09:17:18 -0000

Wrong children of dl incorrectly wrapped in div

Mikhail Dvorkin created ticket #240

Mikhail Dvorkin — Wed, 10 Apr 2024 12:18:07 -0000

Behaviour on unknown tags depends on capitalization of letters

Simon Urli posted a comment on ticket #239

Simon Urli — Thu, 28 Mar 2024 17:01:33 -0000

I tried to work on that issue, I think I actually made too much changes: in particular I saw that XmlSerializer#dontEscape is used both for knowing if the content needs to be escaped and to know if CDATA should be added, which is a problem here as we still don't want to escape the content even without a CDATA. So I think same problem might apply to DomSerializer, in which case my code is probably wrong and I might miss adding a unit test somewhere.

Simon Urli created ticket #239

Simon Urli — Thu, 28 Mar 2024 16:13:29 -0000

CDATA added for any kind of scripts even for application/json ones

Simon Urli created ticket #238

Simon Urli — Fri, 01 Mar 2024 09:36:47 -0000

Various tags incorrectly not marked as phrasing content in HTML5

Simon Urli posted a comment on ticket #228

Simon Urli — Fri, 01 Mar 2024 09:29:42 -0000

@scottwilson it seems you forgot to close that one: I can see a commit related to it before release 2.28, see https://sourceforge.net/p/htmlcleaner/code/595/

Dave posted a comment on ticket #94

Dave — Wed, 21 Jun 2023 03:00:20 -0000

Sure, let me see what I can do.

Scott Wilson modified ticket #161

Scott Wilson — Tue, 20 Jun 2023 08:04:37 -0000

PrettyHtmlSerialiser drops trailing space in tags

Scott Wilson posted a comment on ticket #161

Scott Wilson — Tue, 20 Jun 2023 08:04:37 -0000

Duplicate of 162.

Scott Wilson modified ticket #174

Scott Wilson — Tue, 20 Jun 2023 08:03:15 -0000

Building fails on JDK < 8 because of -Xdoclint:none flag to Maven Javadoc plugin

Scott Wilson posted a comment on ticket #174

Scott Wilson — Tue, 20 Jun 2023 08:03:02 -0000

As Java 7 is no longer supported I guess this is no longer so important.

Scott Wilson posted a comment on ticket #94

Scott Wilson — Tue, 20 Jun 2023 07:46:50 -0000

It's definitely something I keep coming back to, though usually there's something more pressing! If you wanted to submit a patch upgrading some of the more problematic classes that would be fantastic. I suspect most users will be directly interacting with TagNode the most, or possibly the serialisers, so those would probably be the first to apply updated patterns to.

Ralf Purnhagen posted a comment on discussion Open Discussion

Ralf Purnhagen — Tue, 20 Jun 2023 06:22:42 -0000

Thank you for your quick response!

Dave posted a comment on ticket #94

Dave — Mon, 19 Jun 2023 20:07:55 -0000

To modify my original suggestion, it's probably best to just return the object wrapped via an appropriate Collections method, e.g., Collections.unmodifiableList.

Scott Wilson modified ticket #237

Scott Wilson — Mon, 19 Jun 2023 19:15:04 -0000

customizing javadocExecutable in pom.xml breaks the build

Scott Wilson posted a comment on ticket #237

Scott Wilson — Mon, 19 Jun 2023 19:15:04 -0000

Fixed in 2.29

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Mon, 19 Jun 2023 19:00:35 -0000

This has a fix for CVE-2023-34624: Stack overflow with excessive nested tags. Also a fix for bug 237: customizing javadocExecutable in pom.xml breaks the build Thanks to niol, PoppingSnack, and Ralf Purnhagen for bug reports and contributions for this release! Note the addition of a maxDepth cleaner property that defines the maximum nested tag depth. The default is 1000.

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Mon, 19 Jun 2023 18:56:00 -0000

OK, fixed. There's a new release, 2.29, that implements an arbitrary maximum nesting depth. Its configurable via cleaner properties.

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Mon, 19 Jun 2023 18:55:54 -0000

OK, fixed. There's a new release, 2.29, that implements an arbitrary maximum nesting depth. Its configurable via cleaner properties.

HtmlCleaner released /htmlcleaner/htmlcleaner v2.29/htmlcleaner-gui-2.29.zip

HtmlCleaner — Mon, 19 Jun 2023 18:46:02 -0000

HtmlCleaner released /htmlcleaner/htmlcleaner v2.29/htmlcleaner-2.29.zip

HtmlCleaner — Mon, 19 Jun 2023 18:46:02 -0000

HtmlCleaner released /htmlcleaner/htmlcleaner v2.29/htmlcleaner-src-2.29.zip

HtmlCleaner — Mon, 19 Jun 2023 18:46:02 -0000

Scott Wilson committed [r609] on Code

Scott Wilson — Mon, 19 Jun 2023 18:30:56 -0000

[maven-release-plugin] prepare for next development iteration

Scott Wilson committed [r608] on Code

Scott Wilson — Mon, 19 Jun 2023 18:30:55 -0000

[maven-release-plugin] copy for tag htmlcleaner-2.29

Scott Wilson committed [r607] on Code

Scott Wilson — Mon, 19 Jun 2023 18:30:51 -0000

[maven-release-plugin] prepare release htmlcleaner-2.29

Scott Wilson committed [r606] on Code

Scott Wilson — Mon, 19 Jun 2023 18:20:58 -0000

fake commit

Scott Wilson committed [r605] on Code

Scott Wilson — Mon, 19 Jun 2023 17:48:00 -0000

fix: Removed JavaDoc extension code - see bug #237. Thanks to niol for the report.

Scott Wilson committed [r604] on Code

Scott Wilson — Mon, 19 Jun 2023 17:44:11 -0000

fix: Updated POM version in GUI

Scott Wilson committed [r603] on Code

Scott Wilson — Mon, 19 Jun 2023 17:42:50 -0000

fix: Implemented a nesting limit to address CVE-2023-34624

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Mon, 19 Jun 2023 17:06:29 -0000

Hi Ralf, Slightly puzzling that it points to the Github fork from 10 years ago while referring to v2.28! I'll take a look at it.

Ralf Purnhagen modified a comment on discussion Open Discussion

Ralf Purnhagen — Mon, 19 Jun 2023 10:31:45 -0000

A couple of days ago CVE-2023-34624 has been published. Do you plan to release a fix for this CVE in a next version of HtmlCleaner? Thanks

Ralf Purnhagen posted a comment on discussion Open Discussion

Ralf Purnhagen — Mon, 19 Jun 2023 10:31:02 -0000

A couple of days ago CVE-2023-34624 has been published. Do you plan to release a fix for this CVE in a next version of HtmlCleaner? Best regards Ralf

Scott Wilson modified ticket #237

Scott Wilson — Tue, 13 Jun 2023 10:27:38 -0000

customizing javadocExecutable in pom.xml breaks the build

Scott Wilson posted a comment on ticket #237

Scott Wilson — Tue, 13 Jun 2023 10:27:38 -0000

Thanks - I'll remove it and re-release

niol created ticket #237

niol — Tue, 13 Jun 2023 04:24:12 -0000

customizing javadocExecutable in pom.xml breaks the build

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Mon, 12 Jun 2023 18:03:39 -0000

That was weird, I definitely uploaded them at the time! Oh well, I've redone the files.

HtmlCleaner released /htmlcleaner/htmlcleaner v2.28/htmlcleaner-gui-2.28.zip

HtmlCleaner — Mon, 12 Jun 2023 18:03:02 -0000

HtmlCleaner released /htmlcleaner/htmlcleaner v2.28/htmlcleaner-2.28-src.zip

HtmlCleaner — Mon, 12 Jun 2023 18:03:02 -0000

niol posted a comment on discussion Open Discussion

niol — Mon, 12 Jun 2023 08:20:58 -0000

Hi, I cannot find the release zip following the links in the download page. Am I missing something?

Joseph Andres Jr posted a comment on ticket #236

Joseph Andres Jr — Thu, 25 May 2023 07:07:07 -0000

"Hello" becomes " **Hello** " using PrettyHtmlSerialiser

Joseph Andres Jr created ticket #236

Joseph Andres Jr — Thu, 25 May 2023 06:24:54 -0000

added whitespace when using tags

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Sun, 30 Apr 2023 19:54:30 -0000

🎉 I just realised it's been nearly 10 years since I took over the reins of HtmlCleaner, making my first release as the 'new' maintainer back in May 2013. The project itself was started by Vladimir Nikic back in 2006! I've not always been as responsive as I'd like to be over the years as I've had a lot of other things going on, and I've more or less given up on the idea of doing a major architecture overhaul and rewrite for 'v3.0', but sometimes slow change is good. I'm also still using HC as a command...

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Sat, 29 Apr 2023 19:37:02 -0000

April. 29, 2023: HtmlCleaner release 2.28 228 svg incorrectly not marked as phrasing content in HTML5 229 style-tag should not be allowed in body in HTML5 230 Div element wrongly filtered out from dl children when using HTML 5 231 SVG moved after

elements Thanks to jlacour31, Simon Urli and Michael Hamann for bug reports and contributions for this release!

Scott Wilson committed [r602] on Code

Scott Wilson — Sat, 29 Apr 2023 18:51:34 -0000

[maven-release-plugin] prepare for next development iteration

Scott Wilson committed [r601] on Code

Scott Wilson — Sat, 29 Apr 2023 18:51:31 -0000

[maven-release-plugin] copy for tag htmlcleaner-2.28

Scott Wilson committed [r600] on Code

Scott Wilson — Sat, 29 Apr 2023 18:51:30 -0000

[maven-release-plugin] prepare release htmlcleaner-2.28

Scott Wilson committed [r599] on Code

Scott Wilson — Sat, 29 Apr 2023 18:29:47 -0000

doc: completed missing javadoc comments

Scott Wilson committed [r598] on Code

Scott Wilson — Sat, 29 Apr 2023 18:14:42 -0000

fix: remove accidental import!

Scott Wilson committed [r597] on Code

Scott Wilson — Sat, 29 Apr 2023 18:12:33 -0000

Fix: Added newline to manifest.

Scott Wilson committed [r596] on Code

Scott Wilson — Sat, 29 Apr 2023 18:12:02 -0000

Fix: Implemented test for bug 230. Thanks to Simon Urli for the report.

Scott Wilson posted a comment on ticket #230

Scott Wilson — Sat, 29 Apr 2023 18:11:04 -0000

Fixed; will be in 2.28 release.

Scott Wilson posted a comment on ticket #231

Scott Wilson — Sat, 29 Apr 2023 18:07:37 -0000

Fixed and will be in v2.28 release.

Scott Wilson posted a comment on ticket #228

Scott Wilson — Sat, 29 Apr 2023 18:07:13 -0000

228 is now fixed and will be in release version 2.28. Odd coincidence!

Scott Wilson committed [r595] on Code

Scott Wilson — Sat, 29 Apr 2023 18:06:27 -0000

Fix: Implemented fix for bug 228, where SVG was not marked as phrasing content. Thanks to Michael Hamann for the report.

Scott Wilson modified ticket #232

Scott Wilson — Sat, 29 Apr 2023 17:55:10 -0000

Wrong parsing

Scott Wilson modified ticket #230

Scott Wilson — Sat, 29 Apr 2023 17:54:29 -0000

Div element wrongly filtered out from dl children when using HTML 5

Scott Wilson modified ticket #231

Scott Wilson — Sat, 29 Apr 2023 17:54:19 -0000

SVG moved after

elements

Scott Wilson posted a comment on ticket #229

Scott Wilson — Sat, 29 Apr 2023 17:52:14 -0000

Fixed; will be in 2.28 release

Scott Wilson committed [r594] on Code

Scott Wilson — Sat, 29 Apr 2023 17:51:59 -0000

Fix: Implemented fix for bug 229, removing STYLE tags from the document body in HTML5 as per WHATWG. Thanks to Michael Hamann for the report.

Scott Wilson committed [r593] on Code

Scott Wilson — Sat, 29 Apr 2023 17:16:37 -0000

Fix: Implemented fix for but 234. Thanks to Michael Hamann for the report and fix.

Scott Wilson modified ticket #21

Scott Wilson — Sat, 29 Apr 2023 17:04:18 -0000

Patches to build on openjdk 15

Scott Wilson modified ticket #22

Scott Wilson — Sat, 29 Apr 2023 17:03:38 -0000

[Patch] CVE-2021-33813 vulnerability update

Scott Wilson modified ticket #174

Scott Wilson — Sat, 29 Apr 2023 17:01:52 -0000

Building fails on JDK < 8 because of -Xdoclint:none flag to Maven Javadoc plugin

Scott Wilson modified ticket #229

Scott Wilson — Sat, 29 Apr 2023 17:01:15 -0000

style-tag should not be allowed in body in HTML5

Scott Wilson modified ticket #228

Scott Wilson — Sat, 29 Apr 2023 16:55:07 -0000

svg incorrectly not marked as phrasing content in HTML5

Scott Wilson modified ticket #232

Scott Wilson — Sat, 29 Apr 2023 16:54:34 -0000

Wrong parsing

Scott Wilson modified ticket #235

Scott Wilson — Sat, 29 Apr 2023 16:50:57 -0000

Support for modern JDK?

Scott Wilson posted a comment on ticket #228

Scott Wilson — Fri, 21 Apr 2023 17:39:08 -0000

Hi both! Always happy to help. I'll take a look at these next week. If it's just a case of tweaking the tag provider and going through unit tests that shouldn't take much work. I was away from the project for a while (lots happening in the day job) and then found it hard to get back into it again as new versions of Eclipse were making things rather difficult. Since I moved over to IntelliJ I'm feeling a lot more productive, and that I can now dip back into HC and start fixing things again with a...

Michael Hamann posted a comment on ticket #228

Michael Hamann — Thu, 20 Apr 2023 14:36:35 -0000

Similar bugs also affect the math, embed, img, data, object, picture, video, iframe, and q tags. All of them are phrasing content in the current HTML standard but not allowed as phrasing content in HtmlCleaner (at least not as children of tags like strong). See https://github.com/xwiki/xwiki-commons/blob/ce23e117d1cd1515250855eab9bcd7226e66a72f/xwiki-commons-core/xwiki-commons-xml/src/main/java/org/xwiki/xml/internal/html/XWikiHTML5TagProvider.java how we currently modify the HTML 5 tag definitions...

Vincent Massol posted a comment on ticket #228

Vincent Massol — Thu, 20 Apr 2023 09:20:56 -0000

Hi @scottwilson. Long time no speak! How are you? We have several issues reported quite a while ago, like this one (also reported at https://sourceforge.net/p/htmlcleaner/bugs/231/) or https://sourceforge.net/p/htmlcleaner/bugs/230/ and are wondering if we could expect some fixes. Anything we could do to help out? Thank you very much, you've always been very helpful to the XWiki project. -Vincent

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Thu, 06 Apr 2023 07:45:07 -0000

The open and close tags, rather than self-closing tags, are how HTML is typically serialised. If you want to omit the XML tag, use props.setOmitXmlDeclaration(true);

Nazarets Danylo posted a comment on discussion Open Discussion

Nazarets Danylo — Thu, 06 Apr 2023 07:28:07 -0000

no, I got some like this.

Text for text, , 1>0 5<10

But, I fixed this using next code: HtmlCleaner cleaner = new HtmlCleaner(); CleanerProperties props = cleaner.getProperties(); props.setTreatUnknownTagsAsContent(true); props.setNamespacesAware(false); props.setOmitHtmlEnvelope(true); props.setOmitXmlDeclaration(false); TagNode node = cleaner.clean(input); String result = new CompactHtmlSerializer(props).getAsString(node); return result.replaceAll("<\\?xml.*\\?>",...

Scott Wilson posted a comment on discussion Open Discussion

Scott Wilson — Wed, 05 Apr 2023 18:13:57 -0000

Unless I'm missing something (Sourceforge does odd things with formatting) then I think thats a reasonable interpretation of the snippet. I presume what you get is something like this?

Text for text, , 1>0 5<10

Nazarets Danylo modified a comment on discussion Open Discussion

Nazarets Danylo — Wed, 05 Apr 2023 10:02:33 -0000

I have input some like this

Text for text, , 1>0 5<10

But replace brackets only for "1>0 5<10" and create with close slash.

Nazarets Danylo posted a comment on discussion Open Discussion

Nazarets Danylo — Wed, 05 Apr 2023 09:50:17 -0000

I have input some like this

Text for text, , 1>0 5<10

But replace brackets only for "1>0 5<10"

Ruoyu Zhong posted a comment on ticket #235

Ruoyu Zhong — Fri, 24 Mar 2023 20:26:04 -0000

Thanks again, @scottwilson! Yes, I can confirm that the build works fine now.

Scott Wilson posted a comment on ticket #235

Scott Wilson — Fri, 24 Mar 2023 19:18:31 -0000

That'll teach me to read my own release docs - I'd constructed the release hierarchy incorrectly. I've been meaning to write a proper release script for some time, maybe this will give me the incentive to actually do it. Hopefully you can get a package build from src now.

HtmlCleaner updated /htmlcleaner/htmlcleaner v2.27/htmlcleaner-2.27-src.zip

HtmlCleaner — Fri, 24 Mar 2023 19:17:02 -0000

Scott Wilson posted a comment on ticket #235

Scott Wilson — Fri, 24 Mar 2023 19:14:15 -0000

Hmm, when I do a clean package from the project root all is well, but not from the releases/src generated from it. I'll investigate further.

Ruoyu Zhong posted a comment on ticket #235

Ruoyu Zhong — Fri, 24 Mar 2023 16:52:38 -0000

Thanks for the quick response! Unfortunately now it's org.htmlcleaner.CommandLine that's missing. I inspected the jarfile and noticed that no classes are present. Any ideas? I noticed some warnings in the build which may be useful: [INFO] Scanning for projects... [WARNING] The project net.sourceforge.htmlcleaner:htmlcleaner:bundle:2.27 uses prerequisites which is only intended for maven-plugin projects but not for non maven-plugin projects. For such purposes you should use the maven-enforcer-plugin....

Scott Wilson committed [r592] on Code

Scott Wilson — Fri, 24 Mar 2023 16:42:46 -0000

Added location of sonatype repo to release docs so I don't have to keep googling it

Scott Wilson committed [r591] on Code

Scott Wilson — Fri, 24 Mar 2023 16:42:13 -0000

Update version of gui

Scott Wilson committed [r590] on Code

Scott Wilson — Fri, 24 Mar 2023 16:42:05 -0000

Update license dates

Scott Wilson posted a comment on ticket #235

Scott Wilson — Fri, 24 Mar 2023 16:40:31 -0000

OK, give it another try. Its the first time I've created a release for a long time, so I was bound to do something wrong :D

HtmlCleaner updated /htmlcleaner/htmlcleaner v2.27/htmlcleaner-2.27-src.zip

HtmlCleaner — Fri, 24 Mar 2023 16:39:03 -0000

Scott Wilson posted a comment on ticket #235

Scott Wilson — Fri, 24 Mar 2023 16:34:13 -0000

I'll fix that now!

Scott Wilson posted a comment on ticket #235

Scott Wilson — Fri, 24 Mar 2023 16:33:43 -0000

Argh, that's entirely my fault. I included the wrong MANIFEST.MF when building the zips