slachiewicz opened a new pull request, #1303: URL: https://github.com/apache/maven-site-plugin/pull/1303
Fixes #1298. Estate-wide context: apache/maven#12768. ## What and why `site:run` embedded Jetty 9.4 at compile scope. 9.4.58.v20250814 is the last release of the 9.4 line — no version bump is possible and future CVEs in it will not be fixed publicly (jetty/jetty.project#13918). `site:run` needs two things: serve a directory, and route document requests through the render-on-request loop. `com.sun.net.httpserver.HttpServer` (in the JDK since 6, `jdk.httpserver` module since 9) covers both, so this PR: - replaces `DoxiaFilter` (servlet `Filter`) with `DoxiaHandler` (`HttpHandler`) — same locale routing, welcome-file handling and external-report serving, plus path-traversal protection that the servlet container used to provide - rewrites `SiteRunMojo` on the JDK HTTP server (daemon executor, shutdown hook, `port=0` supported as before) - ports the test DAV server (`SimpleDavServerHandler`) to the JDK HTTP server and merges the `AuthAsyncProxyServlet` proxy-auth gate into it (Basic `Proxy-Authorization`, 407 on failure) — no test ever used Jetty's actual forwarding path - removes all seven Jetty artifacts, `javax.servlet-api` and the `jettyVersion` property from the pom - drops the `WEB-INF/web.xml` dummy webapp and `WebXmlTest` The Java 8 baseline is unchanged (option 2 — Jetty 12 — would have required 17). ## Behavior notes - Rendered documents are now served with an explicit `charset` from the site's output encoding (previously the servlet container's default). - No `304`/`If-Modified-Since` handling and no directory listings — both irrelevant for a loopback dev-preview server. - Headers are recorded lower-cased in the DAV tests, so their assertions now use lower-case names. ## Verification - `mvn verify` green, 3/3 tests (both WebDAV deploy tests, incl. the proxy-auth 407 flow). - Pre-checked that the JDK server accepts absolute-form request targets (`PUT http://toto.com/... HTTP/1.1`) as sent through a proxy. - Live smoke on a markdown sample: `/` renders on demand (`200 text/html; charset=UTF-8`), skin css/png served with correct content types, unknown paths 404, and both `/../` and `%2e%2e/` traversal attempts blocked. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
