empty branch for ACS-10154 dependencies

Fix for MNT-25359 Prevent XSS attack during posting a comment keeping the editor styles intact.

.github/workflows/ci.yml

@@ -15,6 +15,7 @@ on:
   workflow_dispatch:
 
 env:
+  JAVA_VERSION: '21'
   DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
   DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
   GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60
@@ -44,6 +45,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v8.24.1
       - name: "Init"
         run: bash ./scripts/ci/init.sh
@@ -65,6 +68,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - uses: Alfresco/alfresco-build-tools/.github/actions/veracode@v8.24.1
@@ -88,6 +93,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - uses: Alfresco/alfresco-build-tools/.github/actions/github-download-file@v8.24.1
         with:
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
@@ -104,7 +111,7 @@ jobs:
           mkdir temp-dir-for-sast
           bash ./scripts/ci/remove-sast-exclusions.sh ./packaging/war/target/alfresco.war temp-dir-for-sast/reduced.war
       - name: "Run SAST Scan"
-        uses: veracode/Veracode-pipeline-scan-action@v1.0.16
+        uses: veracode/Veracode-pipeline-scan-action@v1.0.20
         with:
           vid: ${{ secrets.VERACODE_API_ID }}
           vkey: ${{ secrets.VERACODE_API_KEY }}
@@ -144,6 +151,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - uses: Alfresco/ya-pmd-scan@v4.3.0
         with:
           classpath-build-command: "mvn test-compile -ntp -Pags -pl \"-:alfresco-community-repo-docker\""
@@ -177,6 +186,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run tests"
@@ -214,6 +225,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -249,6 +262,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: Run MariaDB ${{ matrix.version }} database
@@ -276,6 +291,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MariaDB 10.11 database"
@@ -303,6 +320,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MySQL 8 database"
@@ -329,6 +348,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 14.15 database"
@@ -355,6 +376,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 15.10 database"
@@ -381,6 +404,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 16.6 database"
@@ -405,6 +430,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run ActiveMQ"
@@ -461,6 +488,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Set transformers tag"
@@ -531,6 +560,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -570,6 +601,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run Postgres 16.6 database"
@@ -600,6 +633,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -632,6 +667,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -660,6 +697,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -706,6 +745,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |

.github/workflows/master_release.yml

@@ -7,6 +7,7 @@ on:
       - release/**
 
 env:
+  JAVA_VERSION: '21'
   GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
   GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
   GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
@@ -37,6 +38,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.24.1
@@ -66,6 +69,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.24.1

.secrets.baseline

@@ -133,7 +133,7 @@
         "filename": ".github/workflows/master_release.yml",
         "hashed_secret": "3e26d6750975d678acb8fa35a0f69237881576b0",
         "is_verified": false,
-        "line_number": 24,
+        "line_number": 25,
         "is_secret": false
       }
     ],

amps/ags/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo-amps</artifactId>
-      <version>25.3.0.57</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>25.3.0.57</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-automation-community-repo</artifactId>
-      <version>25.3.0.57</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <build>

amps/ags/rm-community/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>25.3.0.57</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <modules>

amps/ags/rm-community/rm-community-repo/pom.xml

@@ -8,7 +8,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-      <version>25.3.0.57</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <properties>

amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <build>

amps/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <modules>

amps/share-services/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-amps</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

core/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo</artifactId>
-      <version>25.3.0.57</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <dependencies>

data-model/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

mmt/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <dependencies>

packaging/distribution/pom.xml

@@ -9,6 +9,6 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 </project>

packaging/docker-alfresco/Dockerfile

@@ -1,5 +1,5 @@
 # More infos about this image: https://github.com/Alfresco/alfresco-docker-base-tomcat
-FROM alfresco/alfresco-base-tomcat:tomcat10-jre17-rockylinux9@sha256:00d89fb84bda7bb37c17b0117adb2cfe4f7cbddcd6c1e42b0a67ea8dbb41a734
+FROM alfresco/alfresco-base-tomcat:tomcat10-jre21-rockylinux9@sha256:ed568167f4c28efc9db4c5bc44a882ee117c475463b526b21ada99e1b6d568dd
 # Set default docker_context.
 ARG resource_path=target
 

packaging/docker-alfresco/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

packaging/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <modules>

packaging/tests/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <modules>

packaging/tests/tas-cmis/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <organization>
@@ -16,11 +16,11 @@
     </organization>
 
     <properties>
-        <maven.build.sourceVersion>17</maven.build.sourceVersion>
+        <maven.build.sourceVersion>21</maven.build.sourceVersion>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
         <maven-release.version>2.5.3</maven-release.version>
-        <java.version>17</java.version>
+        <java.version>21</java.version>
         <suiteXmlFile>${project.basedir}/src/test/resources/cmis-suite.xml</suiteXmlFile>
         <cmis.binding />
         <cmis.basePath />

packaging/tests/tas-email/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <developers>

packaging/tests/tas-integration/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <developers>

packaging/tests/tas-restapi/pom.xml

@@ -8,18 +8,18 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>
         <suiteXmlFile>${project.basedir}/src/test/resources/restapi-suite.xml</suiteXmlFile>
-        <maven.build.sourceVersion>17</maven.build.sourceVersion>
+        <maven.build.sourceVersion>21</maven.build.sourceVersion>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <rest.api.explorer.branch>master</rest.api.explorer.branch>
         <httpclient-osgi-version>4.5.6</httpclient-osgi-version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
         <scribejava-apis.version>8.3.3</scribejava-apis.version>
-        <java.version>17</java.version>
+        <java.version>21</java.version>
     </properties>
 
     <profiles>

packaging/tests/tas-restapi/src/main/java/org/alfresco/rest/core/RestWrapper.java

@@ -675,6 +675,11 @@ public class RestWrapper extends DSLWrapper<RestWrapper>
         {
             returnedResponse = onRequest().get(restRequest.getPath(), restRequest.getPathParams()).andReturn();
         }
+        else if (HttpMethod.PATCH.equals(httpMethod))
+        {
+            returnedResponse = onRequest().body(restRequest.getBody())
+                    .patch(restRequest.getPath(), restRequest.getPathParams()).andReturn();
+        }
         else
         {
             returnedResponse = onRequest().get(restRequest.getPath(), restRequest.getPathParams()).andReturn();

packaging/tests/tas-webdav/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <developers>

packaging/war/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

pom.xml

@@ -2,7 +2,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>alfresco-community-repo</artifactId>
-    <version>25.3.0.57</version>
+    <version>25.3.0.64-SNAPSHOT</version>
     <packaging>pom</packaging>
     <name>Alfresco Community Repo Parent</name>
 
@@ -38,7 +38,7 @@
         <builder.name>entitled-builder</builder.name>
         <local.registry>127.0.0.1:5000</local.registry>
 
-        <java.version>17</java.version>
+        <java.version>21</java.version>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <maven.build.sourceVersion>${java.version}</maven.build.sourceVersion>
@@ -154,7 +154,7 @@
         <connection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</connection>
         <developerConnection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</developerConnection>
         <url>https://github.com/Alfresco/alfresco-community-repo</url>
-        <tag>25.3.0.57</tag>
+        <tag>HEAD</tag>
     </scm>
 
     <distributionManagement>

remote-api/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <dependencies>

remote-api/src/main/java/org/alfresco/repo/web/scripts/comments/CommentsPost.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Remote API
  * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software. 
  * If the software was purchased under a paid Alfresco license, the terms of 
@@ -31,7 +31,10 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
+import org.apache.commons.lang3.StringUtils;
 import org.json.simple.JSONObject;
+import org.owasp.html.HtmlPolicyBuilder;
+import org.owasp.html.PolicyFactory;
 import org.springframework.extensions.webscripts.Cache;
 import org.springframework.extensions.webscripts.Status;
 import org.springframework.extensions.webscripts.WebScriptRequest;
@@ -67,6 +70,35 @@ public class CommentsPost extends AbstractCommentsWebScript
         // get json object from request
         JSONObject json = parseJSON(req);
 
+        // Validating and Sanitizing comment content to prevent XSS
+        String commentContent = getOrNull(json, "content");
+        if (StringUtils.isBlank(commentContent))
+        {
+            throw new IllegalArgumentException("Comment content must not be empty");
+        }
+        else
+        {
+            // Allowed HTML elements and attributes in comment content e.g. Text formatting ,Lists and Structure & Styling
+            String[] allowedElements = {"b", "i", "u", "strong", "em", "ul", "ol", "li", "p", "br", "span", "div"};
+
+            PolicyFactory policy = new HtmlPolicyBuilder()
+                    .allowElements(allowedElements)
+                    .allowAttributes("style").matching((elementName, attributeName, value) -> {
+                        String lowerValue = value.toLowerCase();
+                        if (lowerValue.matches("(?s).*(color\\s*:\\s*[^;]+).*") ||
+                                lowerValue.matches("(?s).*(background-color\\s*:\\s*[^;]+).*"))
+                        {
+                            return value;
+                        }
+                        return null;
+                    }).onElements("span", "div", "p")
+                    .allowStandardUrlProtocols()
+                    .toFactory();
+
+            String safeContent = policy.sanitize(commentContent);
+            json.replace("content", safeContent);
+        }
+
         /* MNT-10231, MNT-9771 fix */
         this.behaviourFilter.disableBehaviour(nodeRef, ContentModel.ASPECT_AUDITABLE);
 

remote-api/src/main/resources/alfresco/templates/webscripts/org/alfresco/repository/forms/pickerresults.lib.ftl

@@ -1,92 +1,83 @@
-<#macro renderParent node indent="   ">
+<#macro renderParent node indent="   ">
-	<#escape x as jsonUtils.encodeJSONString(x)>
+	<#escape x as jsonUtils.encodeJSONString(x)>
-	${indent}"parent":
+	${indent}"parent":
-	${indent}{
+	${indent}{
-	<#if (node != rootNode) && node.parent??>
+	<#if (node != rootNode) && node.parent??>
-		<@renderParent node.parent indent+"   " />
+		<@renderParent node.parent indent+"   " />
-	</#if>
+	</#if>
-		${indent}"type": "${node.typeShort}",
+		${indent}"type": "${node.typeShort}",
-		${indent}"isContainer": ${node.isContainer?string},
+		${indent}"isContainer": ${node.isContainer?string},
-		${indent}"name": "${node.properties.name!""}",
+		${indent}"name": "${node.properties.name!""}",
-		${indent}"title": "${node.properties.title!""}",
+		${indent}"title": "${node.properties.title!""}",
-		${indent}"description": "${node.properties.description!""}",
+		${indent}"description": "${node.properties.description!""}",
-		<#if node.properties.modified??>${indent}"modified": "${xmldate(node.properties.modified)}",</#if>
+		<#if node.properties.modified??>${indent}"modified": "${xmldate(node.properties.modified)}",</#if>
-		<#if node.properties.modifier??>${indent}"modifier": "${node.properties.modifier}",</#if>
+		<#if node.properties.modifier??>${indent}"modifier": "${node.properties.modifier}",</#if>
-		${indent}"displayPath": "${node.displayPath!""}",
+		${indent}"displayPath": "${node.displayPath!""}",
-		${indent}"qnamePath": "${node.qnamePath!""}",
+		${indent}"qnamePath": "${node.qnamePath!""}",
-		<#if node.aspects??>
+		<#if node.aspects??>
-        ${indent}"aspects": 
+        ${indent}"aspects": 
-        ${indent}[
+        ${indent}[
-           <#list node.aspects as aspect>
+           <#list node.aspects as aspect>
-                 "${shortQName(aspect)}"
+                 "${shortQName(aspect)}"
-              <#if aspect_has_next>,</#if>
+              <#if aspect_has_next>,</#if>
-           </#list>
+           </#list>
-        
+        
-           ${indent}],
+           ${indent}],
-       </#if>
+       </#if>
-		${indent}"nodeRef": "${node.nodeRef}"
+		${indent}"nodeRef": "${node.nodeRef}"
-	${indent}},
+	${indent}},
-	</#escape>
+	</#escape>
-</#macro>
+</#macro>
-
+
-<#macro pickerResultsJSON results>
+<#macro pickerResultsJSON results>
-	<#escape x as jsonUtils.encodeJSONString(x)>
+	<#escape x as jsonUtils.encodeJSONString(x)>
-{
+{
-	"data":
+	"data":
-	{
+	{
-<#if parent??>
+<#if parent??>
-	<@renderParent parent />
+	<@renderParent parent />
-</#if>
+</#if>
-		"items":
+		"items":
-		[
+		[
-		<#list results as row>
+		<#list results as row>
-			{
+			{
-				"type": "${row.item.typeShort}",
+				"type": "${row.item.typeShort}",
-				"parentType": "${row.item.parentTypeShort!""}",
+				"parentType": "${row.item.parentTypeShort!""}",
-				"isContainer": ${row.item.isContainer?string},
+				"isContainer": ${row.item.isContainer?string},
-				<#if row.container??>"container": "${row.container!""}",</#if>
+				<#if row.container??>"container": "${row.container!""}",</#if>
-                <#if row.item.properties?? && row.item.properties.name??>
+				"name": "${row.item.properties.name!""}",
-                	"name": "${row.item.properties.name!""}",
+				<#if row.item.aspects??>
-                <#else>
+                 "aspects": [
-                	"name": "${(row.item.name)!row.item?string!""}",
+                   <#list row.item.aspects as aspect>
-                </#if>
+                     "${shortQName(aspect)}"
-                <#if row.item.aspects??>
+                      <#if aspect_has_next>,</#if>
-                 "aspects": [
+                   </#list>
-                   <#list row.item.aspects as aspect>
+                   ],
-                     "${shortQName(aspect)}"
+                 </#if>
-                      <#if aspect_has_next>,</#if>
+				"title":<#if row.item.properties["lnk:title"]??>"${row.item.properties["lnk:title"]}",
-                   </#list>
+						<#elseif row.item.properties["ia:whatEvent"]??>"${row.item.properties["ia:whatEvent"]}",
-                   ],
+						<#else>"${row.item.properties.title!""}",</#if>
-                 </#if>
+				"description": "${row.item.properties.description!""}",
-                <#if row.item.properties??>
+				<#if row.item.properties.modified??>"modified": "${xmldate(row.item.properties.modified)}",</#if>
-					"title":<#if row.item.properties["lnk:title"]??>"${row.item.properties["lnk:title"]}",
+				<#if row.item.properties.modifier??>"modifier": "${row.item.properties.modifier}",</#if>
-							<#elseif row.item.properties["ia:whatEvent"]??>"${row.item.properties["ia:whatEvent"]}",
+				<#if row.item.siteShortName??>"site": "${row.item.siteShortName}",</#if>
-							<#else>"${row.item.properties.title!""}",</#if>
+				<#if row.item.properties["ia:fromDate"]??>"fromDate": "${xmldate(row.item.properties["ia:fromDate"])}",</#if>
-					"description": "${row.item.properties.description!""}",
+				"displayPath": "${row.item.displayPath!""}",
-                <#else>
+				"qnamePath": "${row.item.qnamePath!""}",
-					"title": "${(row.item.name)!row.item?string!""}",
+				<#if row.item.typeShort != "cm:person" && row.item.typeShort != "cm:authorityContainer">
-					"description": "",
+					"userAccess":
-                </#if>
+					{
-				<#if row.item.properties.modified??>"modified": "${xmldate(row.item.properties.modified)}",</#if>
+						"create": ${row.item.hasPermission("CreateChildren")?string},
-				<#if row.item.properties.modifier??>"modifier": "${row.item.properties.modifier}",</#if>
+						"edit": ${row.item.hasPermission("Write")?string},
-				<#if row.item.siteShortName??>"site": "${row.item.siteShortName}",</#if>
+						"delete": ${row.item.hasPermission("Delete")?string}
-				<#if row.item.properties["ia:fromDate"]??>"fromDate": "${xmldate(row.item.properties["ia:fromDate"])}",</#if>
+					},
-				"displayPath": "${row.item.displayPath!""}",
+				</#if>
-				"qnamePath": "${row.item.qnamePath!""}",
+				"nodeRef": "${row.item.nodeRef}"<#if row.selectable?exists>,
-				<#if row.item.typeShort != "cm:person" && row.item.typeShort != "cm:authorityContainer">
+				"selectable" : ${row.selectable?string}</#if>
-					"userAccess":
+			}<#if row_has_next>,</#if>
-					{
+		</#list>
-						"create": ${row.item.hasPermission("CreateChildren")?string},
+		]
-						"edit": ${row.item.hasPermission("Write")?string},
+	}
-						"delete": ${row.item.hasPermission("Delete")?string}
+}
-					},
+	</#escape>
-				</#if>
-				"nodeRef": "${row.item.nodeRef}"<#if row.selectable?exists>,
-				"selectable" : ${row.selectable?string}</#if>
-			}<#if row_has_next>,</#if>
-		</#list>
-		]
-	}
-}
-	</#escape>
 </#macro>

repository/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.57</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <dependencies>
@@ -840,12 +840,12 @@
                     </execution>
                 </executions>
                 <configuration>
-                    <complianceLevel>17</complianceLevel>
+                    <complianceLevel>${java.version}</complianceLevel>
                     <outxml>false</outxml>
                     <verbose>true</verbose>
                     <showWeaveInfo>true</showWeaveInfo>
-                    <source>17</source>
+                    <source>${java.version}</source>
-                    <target>17</target>
+                    <target>${java.version}</target>
                     <additionalCompilerArgs>
                         <arg>-parameters</arg>
                     </additionalCompilerArgs>