Unfortunately, fixing ANT to do this would not help all projects, because in contrast to Maven, the build.xml writer cannot decide which 'javadoc-plugin' is to be used, it depends on the Ant version installed on user's machine. Same applies for pre-1.5 JVMs as those dont have Javascript that's vulnerable, so patch will ignore them. Oracle JDK 1.7.0_25 (and Apple JDK 1.6.0_45) will correctly not be touched.

We tested this approach with various JVMs, it correctly detects the buggy javascript and patches for Oracle JDK 1.5.0_22, 1.6.0_32, 1.6.0_35, 1.7.0_21, 1.8.0-ea-b93, also Oracle JRockit and IBM J9 version 6 and 7. The similar patch, as used in Maven, could be ported 1:1 to Ant (replace plexus-utils with DirectoryScanner and IOUtil/FileUtils by the ANT equivalents): It would be good to modify the ANT javadoc task to do this transformation internally directly after calling the javadoc executable. The specified dir is the destination directory of the javadoc task. Is the platform default encoding (like the javadoc task).

Please make sure that the docencoding parameter uses the same charset like javadoc's docencoding. But we still want to patch our javadocs directly after generating them.įor Maven I provided a 'replacement pather with ASF license), see - Maven will release a new version ASAP.įor ANT, the Apache Lucene project has a ANT macro that can be called directly after the call ( ), looks like that: The Oracle patch tool is officially not ASF compliant (License-wise, see ), so cannot be include into official builds. ASF no longer allows to publish new javadocs with the frame injection bug anymore (see mail to all committers) and enforces all PMCs to 'patch' their web site. 1.5 or 1.6) and builds the release candidates using the 'official supported' Java version will produce Javadocs that can no longer be published on the internet, because it would bring any webserver administrator into trouble and may do harm to the company (e.g., the ASF). You can download 1.6.0_45 for MacOSX provided by Apple.Īny project that is on an older Java version (e.g. The problem is: There is no public available bugfix release for Java 6 or Java 5 (which are also affected by the security issue).

Recently Oracle released Java 7 update 25 to work around a serious frame injection bug in the Javadocs as produced by JDK's javadoc tool.

Plexus pos 2 9 cracker