Update js-beautify to avoid OWASP vulnerability report

[davejbur]

Currently, OWASP reports:

delight-nashorn-sandbox-0.3.1.jar (pkg:maven/org.javadelight/delight-nashorn-sandbox@0.3.1, cpe:2.3:a:javadelight:nashorn_sandbox:0.3.1:*:*:*:*:*:*:*) : CVE-2021-40660, CVE-2023-26919

Updating to js-beautify 1.14.7 avoids this. I tried to do this as a Github pull request, but, between them, Github/Netbeans/Windows mess with the line endings. Github then refuses to ignore line endings when looking at changes (yes, I do have what is allegedly the correct setting in .gitattributes) so it looks like the whole file has changed.

Changes required:
pom.xml line 30 from:

			<groupId>org.webjars.npm</groupId>

to

			<groupId>org.webjars.bower</groupId>

and line 32 from:

			<version>1.9.0</version>

to

			<version>1.14.7</version>

JsSanitizer.java line 50 from:

	private final static String BEAUTIFY_JS = "/META-INF/resources/webjars/js-beautify/1.9.0/js/lib/beautifier.js";

to

	private final static String BEAUTIFY_JS = "/META-INF/resources/webjars/js-beautify/1.14.7/js/lib/beautifier.js";

[davejbur]

OK, I've created #143 to fix this, but Snyk is failing it... can't see why?

[mxro]

Thank you for this! Looks great!!

Synk complains about https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050875

I don't think there is another patched version available? In doubt, I think I rather use 1.14 instead of 1.9, I guess?

[davejbur]

Maybe I'm missing something, but I thought that was exactly the change I was proposing! Snyk however seemed to be failing my proposal because it was working on the master instead of the branch pull request I'd created! Anyway, yes, the change is to move to 1.14.7 (and from org.webjars.bower instead of org.webjars.npm).

[mxro]

As far as I can understand it from Synk, this vulnerability applies to 1.14.7 as well.

In any case, will merge it for now since using the newer version should be preferable over using the older one!

[mxro]

New version released with https://github.com/javadelight/delight-nashorn-sandbox/releases/tag/0.3.2

But as said, could still be reporting the vulnerability!