Guava removal breaks compatibility (with JDK9)

[csware]

The minimum required Java version was explicitly raised to 9 with the recent removal of Guava (cf. commit 3b6cc1b).

I appreciate that Guava was dropped recently, however, there is a problem:
Map.copyOf (also List.copyOf) was first introduced with Java 10.

The method Files.readString used in the tests, was introduced with Java 11 (here, Commons-IO could be used, or just plain new String(Files.readAllBytes(path), Charsets.toCharset(charset));).

I suppose reasons are:

1. The compiler plugin is too old and does not support the --release parameter (cf. Update the maven-compiler-plugin to make the --release check work #304)
2. No automatic checks are automatically executed (cf. Add GitHub actions for testing #305)

[csware]

PR #302 reduces the usage of *.copyOf, still there are some places where it is used.

Should we introduce our own helper method? Or build a multi-release jar in which the helper just delegates to the JRE classes?

In general, JDK8 compatibility can be achieved without too much effort if needed.

[csware]

Btw. for me the following tests fails (itroduced by commit 91c5fdc):

org.owasp.html.HtmlPolicyBuilderTest
testRelLinksWhenRelisPartOfData(org.owasp.html.HtmlPolicyBuilderTest)
junit.framework.AssertionFailedError: Failure in testRelLinksWhenRelisPartOfData

[melloware]

I am not sure Java9 should be supported as its a Non LTS version: https://www.oracle.com/java/technologies/java-se-support-roadmap.html

I think Java 11 LTS is the lowest version that should be supported

[csware]

Many Apache Common projects still target 1.8 that's why I'm asking. Otherwise, we should target Java 11 (and update all respective references).

[csware]

Here you can find a proof of concept for supporting Java 1.8: https://github.com/csware/java-html-sanitizer/tree/target-jdk8, diff: https://github.com/csware/java-html-sanitizer/compare/main..target-jdk8

[melloware]

I like the idea of supporting JDK8

[csware]

I'd like to have the other PRs mergred first, then I can provide a new MR that will bring JDK9 and (if wanted) JDK8 compatibility. Please merge the other PRs first as there are dependencies.

I have two questions:

• At several places I've spotted <? extends String> what is the reason for that? String is final. What about changing these to <String> (especially for internal classes, cf. https://github.com/csware/java-html-sanitizer/tree/cleanup-classtypeparameters)?
• In

  java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicies.java

  Line 56 in 91c5fdc

  this.attrPolicies = Map.copyOf(attrPolicies);

  ,

  java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java

  Line 1011 in 91c5fdc

  this.extra = Set.copyOf(extra);

  and

  java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java

  Line 877 in 91c5fdc

  this.attributeNames = List.copyOf(attributeNames);

  copies are made, but the constructors are package scope so those are technically not requiured as in

  java-html-sanitizer/src/main/java/org/owasp/html/PolicyFactory.java

  Line 69 in 91c5fdc

  this.textContainers = textContainers;

  ). Can we drop these? Or replace by Collections.unmodifiable*() (and remove those calles from the calling side)?

[melloware]

Ok I think we should shoot for JDK8