Instruction:
作为 Java 安全专家，检测此代码中的安全漏洞：
## 内容1
### 文件路径：
ChangeLog
### 代码内容：
2019-03-09  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M3-git-02

       * Adding Drag & Drop capabilities to the standard JSPWiki editor:
         links automatically are converted to [descriptiol|url] format
         other content (text, tables, etc...) will be converted to wiki-markup.

2019-03-09  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M3-git-01

       * UserPreferences fixes
         - new toggle style for on/off switches
         - restyle bi-model checkboxes for Page Layout setting
         - fix a few style issues in the UserPreferences when in Dark Mode

       * The JSPWiki template should by default open up in the light mode.

       * Consistent css-style for the toolbar of the jspwiki wysiwyg editor

       * Added Description meta-tag to improve on-page SEO

       * Added the Content-Security-Policy meta-tag to reduce the risk of XSS attacks.

2019-03-04  Juan Pablo Santos (juanpablo AT apache DOT org)

       * prepare release for 2.11.0.M2

2019-02-21  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M2-git-10

       * o.a.jwpiki.util package moved to its own submodule

       * remove DefaultAclManager dependency from WikiEngine and other small refactors

2019-02-15  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M2-git-09

       * Clean browsers LocalStorage cache of unsaved page edits
         when switching between plain & WYSIWYG editors.

       * Fix (resizable) height of the wysiwig editor HTML viewer.

2019-02-15  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M2-git-08

       * WYSIWYG editor was still pointing to the Haddock template.

2019-02-15  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M2-git-07

       * JSPWIKI-1088: Fallback to default template if jspwiki.templateDir if the requested template folder is
         not found

       * JSPWIKI-1092: Upgrade bundled dependencies
         * flexmark to 0.40.16
         * gson to 2.8.5
         * lucene to 7.7.0
         * nekohtml to 1.9.22
         * stripes to 1.7.0-async (needed to test JSPWIKI-1088)
         * tomcat to 8.5.38

       * fixed css path and packaging of webresources

       * updated both new and missing es resources

2019-02-14  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M2-git-06

       * lots of internal refactorings, mostly around a) Task's implementations extracted to their own package
         and b) PageManager and PageLock moved to o.a.w.pages package, in order to untangle some class/package
         circular dependencies

       * JUnit updated to 5.4.0

2019-02-13  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M2-git-05

       * Adding DARK template to the User Preference.

2019-02-13  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M2-git-04

       * JSPWIKI-1091: Broken DIFF view
         Added some missing JSP in default template. (caused by template rename)

       * Added missing <html lang=..> localization

2019-02-08  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M2-git-03

       * merged [PR#10](https://github.com/apache/jspwiki/pull/10): DOCTYPE and HTML lang="en" attribute addition
         (thanks to Scott Fredrickson)

       * `o.a.w.util` package ready to be extracted to its own module

       * new `o.a.w.pages` package, with `PageSorter` becoming a `Comparator< String >` and no longer accesible from WikiContext
         * `PageSorter` is accesed now through `PageManager`
         * to compare WikiPages use `wikiPage.compareTo( anotherWikiPage );`
         * `sortPages` methods are also gone, as an alternative you can use something along these lines (see
           `AttachmentManager#listAttachments` for another example):
           `Collections.< WikiPage >sort( pages, Comparator.comparing( WikiPage::getName, m_engine.getPageManager().getPageSorter() ) );`
         * as a side effect of this change, `AbstractReferalPlugin#filter[AndSort]Collection` methods operate with
           `Collection< String >` instead of with plain `Collection` (except for `RecentChangesPlugin`, plugins
           inheriting this method were already doing it), custom plugins inheriting this method will have to use
           new `filterWikiPageCollection` method instead

       * other internal code refactors

2019-02-03  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M2-git-02

       * JSPWIKI-1074: Fixed buggy header width in Fixed Page Layout

2019-02-03  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M2-git-01

       * JSPWIKI-1090: Fixed READER view, bug caused by the rename of the HADDOCK template

2019-01-25  Juan Pablo Santos (juanpablo AT apache DOT org)

       * prepare release for 2.11.0.M1

2019-01-20  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-15: JSPWIKI-1086 - selenide-based functional tests infrastructure + login/logout
         associated tests (selenium tests currently kept for reference)

       * JSPWIKI-1085 - JSPWiki locale can be set server-side - to determine the locale used, the following order is used:
         1.- user-preference settings
         2.- if not set, see if there is a locale set server-side, as noted by
             jspwiki.preferences.default-locale setting on jspwiki[-custom].properties
         3.- if not set, browser's preferred language setting
         4.- if not set, JVM's default

       * JSPWIKI-1087 - upgrade bundled dependencies
         - commons-fileupload to 1.4
         - flexmark to 0.40.12
         - hsqldb updated to 2.4.1
         - cargo plugin to 1.7.1

2018-12-25  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-14: upgrade bundled dependencies
         - commons-fileupload to 1.3.3
         - ehcache to 2.10.6
         - flexmark to 0.35.0
         - junit to 5.3.2
         - lucene to 7.6.0
         - tomcat to 8.5.37

       * escape entities on Captcha.jsp request parameters

       * JSPWIKI-1084 - Jenkinsfile now builds both source and website, jspwiki-site job can still be triggered manually

       * few more polishing and minor refactors

2018-12-24  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M1-git-13: AJAX based search results are not shown.
         Fixing AJAXSearch.jsp.
         The java '<>' diamond operator is not allowed for source level below 1.7.

2018-12-15  Dirk Frederickx (brushed AT apache DOT org)

       * 2.11.0-M1-git-12: JSPWIKI-1083 - fixing bugs related to the new default template.
         - Rename HADDOCK template to DEFAULT template.
         - Moving a number of default jsp's (common for all templates)
           from templates/210 to templates/default.

2018-12-07  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-11: JSPWIKI-1082 - fix from 2.11.0.M1-rc1 - revert change from commit
	     87bf9b941fdf (Nov/11/2018) that ended up causing lots of ClassCastException

2018-12-03  Juan Pablo Santos (juanpablo AT apache DOT org)

       * prepare release for 2.11.0.M1

2018-11-20  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-10: backwards-incompatible change - move TextUtil.getRequiredProperty to WikiEngine

       * some more polishing and minor refactors

2018-11-13  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-09: fix JSP compilation error; added jspc plugin to ensure JSPs remain well-formed

       * JSPWiki's custom tags TLD moved to main module

       * some more polishing and minor refactors

2018-11-11  Juan Pablo Santos (juanpablo AT apache DOT org)

       * no version bump: some more polishing and minor refactors

2018-11-05  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-08: JSPWIKI-1080 try to load as many external third-party plugin jars as possible,
         instead of all-or-nothing

       * small backwards-incompatible changes:
         - CryptoUtil#verifySaltedPassword doesn't throw UnsupportedEncodingException anymore
         - TextUtil#urlDecode methods don't throw UnsupportedOperationException anymore
         - ClassUtil#getMappedObject methods now throw ReflectiveOperationException, IllegalArgumentException
           instead of WikiException
         - ClassUtil#getMappedClass method now throws ClassNotFoundException instead of WikiException

       * fix possible concurrency issue at ReferenceManager#serializeAttrsToDisk

       * remove commons-codec usage from source (it's carried onto the war as a transitive
         dependency though), plus several other small refactors

2018-11-02  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-07: removed a bunch of warnings throughout the code

       * added a Jenkinsfile

       * small backwards-incompatible change: WikiEngine#getRecentChanges() now returns a Set instead of a Collection

2018-10-30  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-06: fix JSPs using methods removed on 2.11.0-M1-git-05

2018-10-29  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-05: JSPWIKI-1081 - maven build refactor
         - java code split into its own module: custom extensions should now rely on
           the new org.apache.jspwiki:jspwiki-main dependency, instead of the
           org.apache.jspwiki:jspwiki-war:classes old one
         - parent-pom: clean-up + dependencies and plugins versions' set as maven properties
         - jspwiki-markdown module included into main war

       * several small code refactors, including some backwards-incompatible ones:
         - PropertiesUtils moved to the util package
         - ReferenceManager#findReferrers returns Set< String > instead of Collection< String >
         - AttachmentManager#listAttachments returns a List<Attachment> instead of a Collection
         - WikiEngine#findPages( String query, WikiContext wikiContext ) is removed, use
           WikiEngine#getSearchManager()#findPages( String query, WikiContext wikiContext ) instead

2018-10-26  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-04: JSPWIKI-1078 - update tests to JUnit 5.3.1

       * updated versions of maven plugins

       * flexmark updated to 0.34.56

2018-10-21  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-03: JSPWIKI-1083 - Haddock is now the default template
         - to bring back the 2.10 template set the jspwiki.templateDir property to "210"

       * JSPWIKI-1077 - added the following pages to the core pages' bundles, as they enable some more haddock functionality
         - CSSBackgroundGradients: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Background%20Gradients
         - CSSBackgroundPatterns: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Background%20Patterns
         - CSSInstagramFilters: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Instagram%20Filters
         - CSSPrettifyThemeTomorrowNightBlue: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Prettify%20Theme%20Tomorrow%20Night%20Blue
         - CSSPrettifyThemeTomorrowPrism: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Prettify%20Theme%20Prism
         - CSSRibbon: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Ribbon
         - CSSStripedText: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Striped Text
         - CSSThemeCleanBlue: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Clean%20Blue%20Theme
         - CSSThemeDark: see https://jspwiki-wiki.apache.org/Wiki.jsp?page=Dark%20Theme

2018-09-30  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-02: JSPWIKI-1076 - minimum required Servlet / JSP is now 3.1 / 2.3

       * JSPWIKI-1079 - add jspwiki-markdown to the main build

       * flexmark updated to 0.34.46

2018-09-14  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.11.0-M1-git-01: JSPWIKI-1076 - minimum required to build/run is now Java 8 / Maven 3.5.0

       * fix for JSPWIKI-932 - Failed to start managers. java.util.ConcurrentModificationException

2018-08-31  Juan Pablo Santos (juanpablo AT apache DOT org)

       * update flexmark to 0.34.22 and ASF parent pom to 21

       * prepare release for 2.10.5

2018-08-31  Siegfried Goeschl (sgoeschl@apache.org)

       * 2.10.5-git-09 : JSPWIKI-1073 Upgrade the jspwiki-portable build

2018-07-08  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.5-git-08 : update flexmark to 0.34.6 and slf4j to 1.7.25

2018-07-09  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.5-git-07 : fix to plain haddock editor related to the new
         functionality to recover unsaved page edits.

         You can test this like so:
         - open a page for edit in the haddock template
         - make some changes to the page
         - move to another page without saving (or close the browser tab)
         - click LEAVE when the popup 'changes you made may not be saved' appears.
         - reopen the page for edit
         - you should now receive a new popup which allows you to restore or abandon
           the unsaved changes

2018-07-08  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.5-git-06 : update bundled Apache Tomcat on portable JSPWiki to 7.0.90

2018-07-01  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.5-git-05 : few more haddock template updates

       * The haddock editor has now a page restore functionality to recover unsaved page
         edits.  When your session or login timer expires, or your accidentally close a
         browser tab without saving, etc...  your last changes are now preserved in the
         localstorage area of your browser.
         At the start of a new edit sessions,  you will be presented with a modal dialog
         to restore the cached page.

       * The "attach" and the "info" menu are now combined into a single navigation menu.
         The INFO or ATTACHMENT UPLOAD page can be accessed with an additional
         click of a button. This also improves usability on touch devices.

       * Small refinements of the Search and User buttons (top-right corner)
         to improve support for touch devices. (issue reported by Juan Pablo)

2018-06-17  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.5-git-04  Fine-tuning Haddock for mobile devices.

       * Improve accessibility on hover-menu's for touch-devices. They'll open after
         a touch-down event; and will close when touching any area outside the menu.

       * Fixing access to the Find and User menu's for touch devices.

       * Several small style improvements on the navigation bar for mobile devices
         (hiding CARET to indicate hover-menu's, ...)

       * Added touch-support for %%magnify style.

       * Breadcrumbs are now moved to a proper drop-down menu (...) on the navigation bar
         instead of the previously not-so-obvious 'mouse-over-zone' under the pagename.
         This also makes breadcrumbs accessible to the tablet & phone users.

       * Fixed a display error when uploading multiple attachements in one step.

2018-06-05  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.5-git-03  JSPWIKI-1071 Ajax request header 'Connection' forbidden
         impacting the DEFAULT jspwiki template.

2018-06-03  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.5-git-02

       * JSPWIKI-1070: (properly) Support JDK 10 builds

       * Generate sha1 and sha512 checksums for build artifacts

2018-05-27  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.5-git-01

       * JSPWIKI-1070: Support JDK 10 builds

2018-04-29  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.4-git-10  Bugfix in AddCSS.JS related to url() parsing

2018-04-28  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.4-git-09  Better support for mobile devices in the Haddock Template
            See JSPWIKI-835
            - Updates various styles to better fit small screens.  (tabs, accordion, columns, ...)
            - On small screens,  the sidebar is by default closed.
              On wider screens, the sidebar is open/closed based on the previous state
              which is saved in a cookie.

2018-04-22  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.4-git-08  Adding support for mobile devices to the Haddock Template
            See JSPWIKI-835
            Part-1 -- many style adjustment to fit smaller screens
            - Sidebar now slides over the main page on mobile devices
            - Header (pagename, and menu bar) are better fit for small screens
            - Width of several menu's and dropdowns is restricted for small screens
            - Editor toolbar resized for small screens

            Other:
            - JSPWIKI-1058 Editor toolbar now remains on screen, even when scrolling down
            - Small tweaks of the RecentChanges output
            - JSPWIKI-1068 : fixing positioning of the TitleBox

2018-04-19  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.4-git-07 Adding a favicon to the haddock template

2018-04-11  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.4-git-06  JSPWIKI-1069 i18n errors in german translation

2018-03-31  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.4-git-05  JSPWIKI-1068 TitleBox rendering on Haddock

2018-03-29  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.4-git-04

       * JSPWIKI-1039/JSPWIKI-1067: ACLs are not taken into account when cache
         is disabled / View-only ACLs are not enforced

2018-03-29  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.4-git-03

       * Main page can be revealed when invoking some JSPs without parameters
         (reported by Motohiko Matsuda, thanks!)

2018-03-25  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.4-git-02

       * Further fix on JSPWIKI-1064 - Link to non-existing page doesn't change if
         linked page is created, not all page caches were properly flushed.

2018-03-04  Juan Pablo Santos (juanpablo AT apache DOT org)

       * Fixed all javadoc errors when building using java 8 - no version bump

2018-02-25  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.4-git-01  Fixing Admin JSP Bugs

       * Quick fix to admin and user management pages:  adding proper tabs to
         the ADMIN page, fixing javascript bugs in user management page
         (reported by Harry)

2018-02-03  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-48

       * JSPWIKI-835 - better mobile experience: move sidebar to bottom on
         extra-small devices (< 768px, only on haddock template)

       * Some internal refactors to org.apache.wiki.WatchDog

       * Flexmark updated to 0.28.38.

2018-01-27  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-47

       * Another fix on JSPWIKI-1064 - Link to non-existing page doesn't change if
         linked page is created, as the page render cache must also take into account
         if the plugins should be rendered or not.

       * JSPWiki portable: Update bundled Apache Tomcat to latest version on 7.x branch
         and launch4j to 3.11.

       * JSPWiki portable: As appbundler is not longer accesible through java.net, use
         fork at https://github.com/teras/appbundler instead.

       * Updated maven plugins' versions to latest + use latest ASF parent pom.

2018-01-21  Juan Pablo Santos (juanpablo AT apache DOT org)

       * Updated <scm/> section from main pom.xml so it points to github repo

       * Flexmark updated to 0.28.34 (no version bump).

2017-12-30  Juan Pablo Santos (juanpablo AT apache DOT org)

       * Upgraded all test from JUnit 3 to JUnit 4 (no version bump).

2017-12-27  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-46

       * JSPWIKI-802 - Markdown support
         * urls are not set on attribute provider derived classes, as this has some
           unwanted side effects. Introduced JSPWikiLink, a wrapper around Flexmark's
           links which retain the original wiki link.
         * updated Flexmark to 0.28.24.

2017-12-16  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-45

       * Fixed JSPWIKI-1064 - Link to non-existing page doesn't change if linked page
         is created

       * Improvement on JSPWIKI-843 - exclude tests from test-jar

2017-12-08  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-44

       * JSPWIKI-802 - initial markdown support see
         https://jspwiki-wiki.apache.org/Wiki.jsp?page=Markdown%20Support
         for details

2017-12-03  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-43

       * Fixed JSPWIKI-843 - generate test-jar for jspwiki-war (wasn't being generated)

       * Extract WikiLink parsing operations from JSPWikiMarkupParser, LinkParser,
         VariableManager to their own class, LinkParsingOperations

       * Move (private) JSPWikiMarkupParser#getLocalBooleanProperty to
        (public) WikiContext#getBooleanWikiProperty

2017-11-16  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-42

       * small refactor to move some private constants to public at MarkupParser and
         WikiRenderer, so they can be reused throughout the code and custom extensions.

2017-08-22  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-41

       * WysiwygEditingRenderer isn't hardcoded in JSPs anymore, and can be substituted
         through jspwiki.renderingManager.renderer.wysiwyg property on jspwiki.properties.
         This allows to develop custom renderers which do not expect the same information
         as the existing ones.

       * Fixed DefaultFilterManager#modules not returning Collection< WikiModuleInfo >,
         as it was supposed to. This method wasn't used anywhere, until now, where it
         is used through FilterBean, a new JSPWiki AdminBean exposing existing filters
         information.

       * FilterBean runs parallel to PluginBean, which allowed some more minor internal
         refactorings and code polishing.

       * Moved some constants from JSPWikiMarkupParser to MarkupParser.

2017-07-16  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.3-git-40

       * Some small changes around JSPWikiMarkupParser, needed to develop
         custom markup parsers, which do not rely on the former class or
         WikiDocument.

       * Some other minor internal refactorings and code polishing

2017-05-14  Harry Metske (metskem@apache.org)

       * 2.10.3-git-39

       * JSPWIKI-1059 - ConcurrentModificationException in SessionMonitor

2017-04-22  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-38  Haddock Template updates

       * Fixing some minor issues with the Image plugin ALIGN parameter

       * %%magnify: add a magnifying glass to to reveal details of a cropped images.
         Hover the mouse above the image to see the effect.

       * Redesigned Header
         The header (including the menu bar) now shifts up when you scroll down,
         and reappears when scrolling back-up.  So you can quickly have access
         to all the menu's and the quick search function.  Clicking the pagename
         in the header get's you immediately back to the top of the page.
         The menu bar has now become part of the (coloured) header section.

       * Editor:
         Improved the speed of the editor quick preview when editing large pages.
         Updates to various editor auto-suggest dialogs.

2017-03-18  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-37  Haddock Template

       * JSPWIKI-1055:  Haddock Special Block Marker
         Added a few icons to improve rendering of contextual blocks in B/W.

2017-03-14  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-36  Haddock Template

       * Few fixes on the %%column style

2017-03-12  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-35  Haddock Template updates

       * ImagePlugin:  minor update to apply the css class and styles
         parameters to the image container, not to the whole table;
         escape HTML entities in captions.

       * several CSS stylesheet additions
         - image styles : effects, captions, frames, animation
         - background styles : color, background images

       * %%columns: bugfix, few more column styles

2017-03-05  Harry Metske (metskem@apache.org)

       * 2.10.3-git-34

       * JSPWIKI-1044 - URL in password recovery mail is relative while it should be absolute

2017-03-03  Harry Metske (metskem@apache.org)

       * 2.10.3-git-33.

       * Fixed JSPWIKI-1051 - Startup fails due to jspwiki.log (Permission denied)

2017-02-04  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-32

       * JSPWIKI-1050 The find and replace do not seem to work  (Haddock editor)

         Pressing Ctrl-F has been removed as short-cut key for the wiki editor.
         Ctrl-F brings you always to the standard browser dialog. (as expected)
         To open JSPWiki's Find&Replace dialog, click the toolbar button.

         The Find&Replace dialog now also indicates if text was selected before.
         If that case, the Find&Replace will run only on the selected text.

2017-01-21  Harry Metske (metskem@apache.org)

       * 2.10.3-git-31.

       * Fixed JSPWIKI-1047 - Access Control Lists do not work if page cache is deactivated (thanks to E. Poth)
       * minor bugfix in SessionsPlugin (StringIndexOutOfBoundsException when using the distinctUsers option

2017-01-21  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-30
         [JSPWIKI-1046 ]IE11 detection fixed, txs to patch of Albrecht Striffler.

2017-01-17  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-29
         JSPWIKI-1046 IE11 scrolling in content page blocked.
         IE detection not working on IE11; ok on Edge. New detection method implemented.

2017-01-15  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-28
         JSPWIKI-1045 IE11 rendering is broken for %%graphBars using color names.

2017-01-14  Harry Metske (metskem@apache.org)

       * 2.10.3-git-27.

       * Fixed JSPWIKI-1042 - Impossible to change user profile loginName, fullname, password (patch by Eric Kraußer)
       * Fixed JSPWIKI-1043 - Encode email subjects as UTF-8 (patch by Eric Kraußer)

2017-01-06  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-26
         JSPWIKI-1041: fix some lines in skin.css

2017-01-03  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-git-25: few Haddock template fixes

       * Remove the editor suggestion-dialogs scroll-bars (only visible on Windows)
         Fix a few formatting errors in sugestion dialogs.

       * Fixed the width of the table filter input field

       * Added console-logs to the editor for debugging on IE/EDGE
         (positioning of suggestion dialogs seems to be broken)

       * Update JSON XmlHttpRequest header to avoid IE/EDGE XML5619 Document Syntax errors

2016-12-31  Harry Metske (metskem@apache.org)

       * 2.10.3-git-24.

       * Fixed JSPWIKI-1035 - merged branch JSPWIKI-1035 back to master

2016-12-27  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-23.

       * Fix nesting of ul/li in RefferedPAgesPlugin.

2016-12-26  Harry Metske (metskem@apache.org)
       * Fixed JSPWIKI-1035 - Get rid of jspwiki.baseURL
         fixed remaining unit tests
       * changed Release postfix from "svn" to "git"

2016-12-19  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-22  Various HADDOCK updates & fixes.

       * [JSPWIKI-1038]: Fix allowing flexbox in Edge. (but not in IE)

2016-12-18  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-21  Various HADDOCK updates & fixes.

       * [JSPWIKI-1038]: IE's flexbox implementation is broken,
         no workaround for now.

2016-12-17  Dirk Frederickx (brushed AT apache DOT org)

       * Fixing RSSGenerator test with latest WeblogPlugin changes

2016-12-17  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-20  Various HADDOCK updates & fixes.

       * JSPWiki BLOGS
         Final update of the styling of JSPWiki's BLOGs.
         Also the fancy weblog calendar is now back in the sidebar
         when viewing a blog post.

       * Add-Comment JSP refactored:
         When adding a comment to a wiki-page, you will see the content of the main page
         at the top of the editing screen,  so you know what your are commenting on.
         Improved hover menu on the SAVE/POST button for entering the change-note and
         comment-signature fields.

       * Plain Editor:
         Many JS improvements related to the handling of text snippets.
         Several style updates to the editor and the auto-suggest dialogs.

       * Small refactoring of the Install.jsp to fit the bootstrap framework.

       * %%columns-<width>: fix the broken width parameter

       * %%graphbars: fix support for HTML-color-names (chrome, FF)

       * [JSPWIKI-979]: fix support for %%small {{{ preformatted text blocks }}}

       * [JSPWIKI-937]: fix handling of broken image links (also for FF)
         Fix for rendering of the attachement icon, e.g. in RecentChanges page.

       * Improved visualisation of interwiki links for Edit, Raw, Reader and Groups.

       * The Delete group command now gets you back to the Group view pages,  so it is
         easier for issuing subsequent group commands. (create,edit,delete)

       * Added %%maps to generate google maps viewer by simply including the address.

       * Few html5 FORM improvements: required fields, email input type, ...

       * Updated to bootstrap 3.3.7.

2016-12-13  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-19

       * JSPWIKI-1032 : Use image "src" attribute instead of "href"

2016-12-13  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-18

       * [JSPWIKI-1037] UI will not display with IE 9 or IE10.
          Issue with Flexbox implementation in IE.  (also applies to IE11)

       * Small style update on %%categories dropdown

2016-12-11  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-17

       * Allow concatenation of css-styles (classes) by using a "." separator,
         which is useful when adopting styles from the bootstrap framework

         EG. %%btn.btn-primary.btn-xs This looks like a small Button /%

2016-12-03  Harry Metske (metskem@apache.org)
       * Fixed JSPWIKI-1036 - Search for non-Latin characters fails (reported by Peter Paessler)

2016-09-16  Harry Metske (metskem@apache.org)
       * Fixed JSPWIKI-1033 - Incorrect relative navigations (reported by Niklas Polke)

2016-09-16  David Vittor (dvittor@apache.org)
       * Test commit to our new git repo.

2016-09-16  Harry Metske (metskem@apache.org)
       * Test commit to see how our new git repo works.

2016-08-25  Harry Metske (metskem@apache.org)

       * 2.10.3-svn-14

       * Fixed JSPWIKI-1031 provide stacktrace when throwing InternalWikiException, fix by Jürgen Weber.

2016-08-18  Harry Metske (metskem@apache.org)

       * 2.10.3-svn-13

       * Fixed JSPWIKI-1029 WebLogic does not find the properties file, fix by Jürgen Weber.

2016-08-18  Harry Metske (metskem@apache.org)

       * 2.10.3-svn-12

       * Fixed JSPWIKI-396 UTF-8 characters in wiki pages incorrectly rendered if served by Weblogic
         A rigorous fix by Jürgen Weber, ditched UtilJ2eeCompat, introduced new property "jspwiki.nofilterencoding".

2016-04-17  Harry Metske (metskem@apache.org)

       * 2.10.3-svn-11

       * Fixed JSPWIKI-936 error when remove page with link (Fix by Andrew Krasnoff)

2016-04-17  Harry Metske (metskem@apache.org)

       * 2.10.3-svn-10

       * Fixed JSPWIKI-935  RenderingManager uses ehcache if "jspwiki.usePageCache = false"

2016-04-06  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-9  Few fixes on the HADDOCK template

       * improved styling of broken image links

       * [JSPWIKI-934] Haddock: "page modified" markup differs to the original edits
         Improved styling of the PageModified/Conflict jsp's

       * Allow google-fonts in %%add-css

2016-04-03  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-8  Few more fixes on the HADDOCK template

       * Reorganize the attachment detail view, changing the
         order of columns to a more logical format.

       * Improve the rendering of the RecentChanges page

       * Fix the font for text in buttons with an icon

       * Fix the popup dialog position in the plain editor
         in case the textarea contains '<', '>' or '&' characters.

       * Hide the section-editlinks for weblog comments.

       * Fix the handling of the editor-type switch in the editor.

2016-03-27  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-7  Few more small fixes on the HADDOCK template

       * [JSPWIKI-918] HADDOCK: the "view" menu is back as a better way
         to navigate back to the main page from "Attach" or "Info" views.
         (also removed the ugly "Back to Parent Page" button)

       * [JSPWIKI-901] : Undo/Redo doesn't work in HADDOCK editor

       * [WeblogPlugin] : added support for filtering weblog entries according to weblog
            start-date and number of days. Now you can select weblog entries
            from a link from the WeblogArchive plugin.

       * [JSPWIKI-897] : Long page names in Haddock don't wrap gracefully
            Fixing printing issues with long page names.

       * Replace the attachment info icon, for not-inlined attachments

       * [JSPWIKI-904]: HADDOCK – the display status of the LeftMenu is retained,
         also after a page refresh.  (by means of a new "Sidebar" user-pref cookie)
         The "Hide-Sidebar" option is obsolete and thus removed from the UserPreferences.

2016-03-15  Harry Metske (metskem@apache.org)

       * 2.10.3-svn-6

       * Fixed JSPWIKI-931 VersioningFileProvider sets page author to "unknown" when it should be an authenticated user

2016-03-12  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-5

       * %%ADD-CSS: fix regexp for inline images on IE.

       * Fix posting of comments in the Haddock template

       * Fixed some missing localization of the weblogplugin.
         Few more tweaks of the styling of weblog entries & comments.

2016-03-08  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-4  Few more small fixes related to the HADDOCK template

       * Few fixes on well formed HTML (SearchBox.jsp, PageInfo.jsp, Nav.jsp)

       * Fixed some missing localizations in Nav.jsp.

       * Various improvements of the JSPWiki Weblog implementation and css styling.

       * Only show scrollbars on prettified blocks when appropriate (WINDOWS issues)

2016-03-08  Harry Metske (metskem@apache.org)

       * 2.10.3-svn-3

       * Added MaxPageNameLength support in SpamFilter

2016-02-28  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-2  Few more small fixes on the HADDOCK template

       * Added 2 new inter wiki references :
         [Raw:MainPage] for displaying the raw wikimarkup of a page
         [Reader:MainPage] to display a simplified reader view of a page
             (no left menu, layout fit for printing)

       * Fixing JS error on <IE11 : missing Array.from() (compatibility with mootools 1.5.1)

       * Fix for flexbox feature test  (IE)

2016-02-28  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.3-svn-1  Various small fixes on the HADDOCK template

       * Fix %%viewer "Mixed content" error  (avoid serving http content via https )
       * Fix visibility if the Titlebox page has no content
       * Add fallback for IE, when the browser doesn't support FLEXBOX support
       * Fix scrollbars on prettified sections on windows (IE, Chrome)
       * Add fallback font (SegoeUI) for windows because Helvetica Neue is not supported

       * Fix consistency of the styling of the "OK" buttons in many forms.
       * Fix indentation of section dropdown entries (plain editor)
       * Fix sorting by dates in the Attachment and Info view
       * JSPWIKI-921: increase legibility of the plain editor
       * JSPWIKI-928: fix odd fonts in the user control panel pop-up window
       * Add new Apache feather.png as logo background

       * Upgrade to mootools 1.6.0

2016-02-05  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-43

       * Added IP ban support in SpamFilter

2016-02-06  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-42

       * JSPWIKI-570: Cannot use another MarkupParser - hardcoded references to
         RenderingManager and JSPWikiMarkupParser - thanks to Piotr Tarnowski for all the
         analysis at JSPWIKI-570

2016-02-02  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-41

       * JSPWIKI-852: JSPWikiMarkupParser should report on which page a plugin was missing

2015-12-09  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-40

       * JSPWIKI-923: doreplace.png image is missing from CleanBlue skin

2015-09-19  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-39

       * [JSPWIKI-916] Pre-formatted text within a list renders
         to an unpleasantly small font size, due to relative font sizing.

2015-09-07  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-38

       * [JSPWIKI-903] Fixed a page redirect after attachment delete.

2015-09-06  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-37  Few Attachment tweaks in the HADDOCK template

       * Fixed display issue with long attachment names
       * Show loading animation after pressing the upload button
       * Improved display of file sizes with support for KB,MB,GB,TB.

2015-09-05  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-36  Improved Attachment upload in the HADDOCK template

       * Fixed the AttachementServlet so you can now select multiple files
         before pressing the upload button.  You can also use
         drap & drop if your browser supports it.

        * [JSPWIKI-903] Fixed a page redirect issue when deleting an
         attachment from the Attachment info page.

       * Fixed the zebra-stripes of the FIND AJAXSearch.jsp

       * Few small improvements on the plain editor suggestion dialogs.

2015-08-28  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-35

       * [JSPWIKI-912] Haddock Template: fixing the position of headers
         below the fixed navigation bar, when returning from a section edit.

2015-08-23  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-34  WYSIWYG improvements

       * Added the wysiwyg editor to the wro4j build process

       * Improved the stability of the  WysiwygEditingRenderer

2015-08-22  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-33  Fixed JSPWIKI-910 support configuring jspwiki with envvars
                        having dots replaced with underscores in the varnames

2015-08-16  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-32  Haddock Template updates & WYSIWYG editing

       Haddock Template:

       * [JSPWIKI-902] Printing improvements for the HADDOCK template,
         hiding sidebar, userbox, wrapping long page-names, and a few other tweaks.

       * The Page Footer now sticks to the bottom of the screen, even for short pages

       * Fixed an issue with the persistence of the status of collapsible lists

       * Added fixes for IE compatibility for the bootstrap css framework.

       * [JSPWIKI-892] Haddock editor should put the cursor at the top of the textarea,
         also when opening the editor with a certain section

       * Improved the header layout (suggestion of Harry) moving the quick search field
         into the searchbox dropdown.

       * [JSPWIKI-908] The basic editor toolbar icons (bold, italic, link, etc..)
         are back in the plain editor of HADDOCK.

       WYSIWYG further enhancements

       * (experimental) Included a plain vanilla wysiwyg editor to JSPWiki.
         This editor is based on mooEditable, MIT licensed.
         This editor is unfortunately not compatible with the default template.

         You can still add your own wysiwyg editor to JSPWiki -- hooks are provided
         for TinyMCE and CKeditor.

       * Added ajax-based live-preview for wysiwyg editors to the Haddock Template.
         When editing in wysiwyg mode, you now get immediately a preview of the wiki markup.
         (similar to the live-preview mode of the plain editor)

       * The wysiwyg editors are now resizable, just like the plain editor..

2015-08-04  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-31  Haddock Template small fixes

       * Loading error on hadock.js and haddock-edit.js fixed. (async attribute)
         Was breaking all editing js functions !

       * IEx tweaks
         - remove unnecessary scrollbars
         - attempt to resolve the broken icon-fonts on IE11

       * %%add-css style fix to handle special html entities

2015-08-04  David Vittor (dvittor@apache.org)

       * 2.10.2-svn-30

       * [JSPWIKI-900]: Fixed Problem with the WikiFormsPlugin Text Area

2015-08-02  Dirk Frederickx (brushed AT apache DOT org)

       * Fixed the unit tests for HtmlStringToWikiTranslatorTest

2015-08-02  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-29

       Some more Haddock template "tweaks":

       * Hide the attach & info navigation menu's for non-existing page

       * Improved the Info dropdown when no Author page exists.

       * Section titles remain visible, even with a sticky navigation menu.
         Eg. when clicking a table of contents entry, you should end up
         with a visible section header just below the sticky menu line.

       * Fixed: the top border of a TABLE was gone.

       * Added a version check on the user-preference cookie to be more robust ico changes.
         (hopefully no more cookie clean-up is needed when upgrading JSPWiki)

       * Sidebar:
         - The sidebar height now extends till the bottom of the page
         - 3 Sidebar modes are now working: left(default), right and hidden

       * Fixed the <wiki:Link> tag to support "cssClass" as attribute.

       * [JSPWIKI-430] All confirmation dialogs are now build with regular DOM elements.
         (check out the Log-out or Delete confirmation dialogs to see the improvement)

       WYSIWYG editors:

       * Added support for the WYSIWYG editor TinyMCE.jsp

       * Improved server side handling of HtmlStringToWiki translation

       * [JSPWIKI-622] Added an editor selection switch to the editor toolbar.
         It is now possible to switch between editors (plain, or other installed
         wysiwyg editors) while in Edit. (no need to go first via the Preferences screen)

2015-07-26  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-28

       Haddock Template commit of the remaining JSP's: UI for handling groups,
       workflow UI, and refactored JSP's for Login/Lostpw/Register.
       This concludes the re-design of all the haddock template JSP's.

       Other changes:

       * Fixed page redirections and improved the back button handling.
         Eg. Attachment DELETE will get you now back to the ATTACH view,
         not the INFO view.  See also [JSPWIKI-867]

       * Tabs & Accordion toggles can now include other markup, rather than only text.

       * Added CSS3-based automatic text hyphenation for browsers who support this.
         (also works with none justified text)

       * Attachment Upload UI improved: attachment types are represented by icons
         from the icon-font.

       * Attachment Info page to access version information on attachments
         should now be more user-friendly, with an extra INFO action button.
         (iso a hidden link via the version number)

2015-07-16  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-27

       More Haddock Template tweaks:

       * Removed annoying scroll-bars from the dropdown menu's which appeared in some browsers

       * Improved rendering of inserted dropdown's like the MoreMenu and HomeMenu,
         to make them better fit with bootstrap dropdown menu's.

       * Few fixes of the layout of the UserPreferences menu, and some refactoring
         of the UserPreferences.jsp and the Login.jsp.

       * Fixed an editor bug causing the Live Preview to slow down after some time.

       WYSIWYG editor in JSPWiki

       * Refreshed the WYSIWIG editor with the latest stable version of the
         CKeditor v4.5.1. (replacement of FCK) Standard version, with BootstrapCK4 skin.
         The update was done for both for the default and the Haddock template.
         FFS: server side translation from wiki-markup to HTML needs more work.
         ( WysiwygEditingRenderer.getString() often crashes )

2015-07-13  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-26

       * JSPWIKI-899: Russian set of wiki pages, contributed by Victor Fedorov, thanks!

2015-07-12  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-25

       * [JSPWIKI-896] Haddock template – user preferences are not saved.
         haddock-pref.js was not properly included into the build, due to lowercase
         issue in wro-haddock.xml.

       * [JSPWIKI-518] Saving after editing a section will return you to that  section.
         Fixed missing commits on wiki.js. Should work now.

       * Fixed issue with Accesskey

       * [JSPWIKI-433] Allow back button for TAB keys.
         It is now also possible to click a link to a hidden pane of a tabbed section
         (eg from the Table Of Contents) to automatically open that TAB pane.

       * Added a "title" attribute to the pagename in the header.  In case a very long
         pagename is truncated (with ellipsis ...) you can still see the full
         pagename when you hover the mouse over the pagename.

2015-07-09  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-24

       * Minor improvements:
       ** Use of StringBuilder over StringBuffer whenever possible.
       ** SLF4J upgraded to 1.7.12
       ** JUnit upgraded to 4.12, Jetty upgraded to 8.1.15

2015-07-05  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-23

       * [JSPWIKI-895] Haddock template links contain raw URL information when printed
         including a few tweaks on the print css

       * [JSPWIKI-518] Saving after editing a section will return you to that  section

       * Improved formatting of the Quick Navigation drop-down to show the text and the
         search score on a single line.  (Firefox)

2015-06-30  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-22

       * [JSPWIKI-894] Section editing using Haddock template appears broken.
         Fixed.  Also fixed for the default template.

2015-06-30  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-21

       HADDOCK Template fixes:

       * JSPWIKI-892  Haddock editor when launched is always at bottom of window in Firefox

       * Fixing latest update of Icon Styles

2015-06-28  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-20

       * JSPWIKI-891: Fixed annoying jumping behaviour in Firefox of the Haddock editor

       * JSPWIKI-885: LivePreview doesn't work
         The HADDOCK template has refresh mechanism based on "change events".
         (no periodic refreshes, like the default template)
         Improved trigger mechanism to catch all keystrokes; and at the same time
         reducing the debounce period (read - refresh time-out) to 1sec.

2015-06-28  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-19

       More Haddock template fixes

       * JSPWIKI-890 (Haddock template) popups dissappear when trying to get
         your mouse to it. Removed the space between the menu and the dropdown.

       * JSPWIKI-887 Slimbox image style for embedded images fixed to show
         readable link description even in case of missing *title* or *alt* attributes.

       * Updated JSPWikiFont, fixing display issues in FireFox.

2015-06-27  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-18

       Small fixes and tweaks on haddock template
       * Few improvements of the Reader template
       * SLIMBOX support for interwiki links
       * Small style tweaks
       * Fix UserBox issue in non-default language

2015-06-26  Siegfried Goeschl (sgoeschl@apache.org)

       * Fixed JSPWIKI-888 Enable cache timeouts for Portable JSPWiki.

2015-06-22  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.2-svn-17

       This is the third major check-in of the HADDOCK template, with mainly
       stabilization fixes related for the plain editor, and many UI improvements.
       The HADDOCK template is close to completion - go ahead and play with it.
       (group related JSPs still to be done)

       Summary of main changes:

       * Many Suggestion dialogs are added to the plain editor:
         links, link-options, images, acls, plugins, variables, %%styles,
         hexadecimal colors, fonts, symbols, %%icons, ...
         You can create new suggestion dialogs via json snippets in Wiki.Snips.js

       * Fixed [JSPWIKI-482] Wrong insert from the suggestion box

       * The editor toolbar is simplified, as most functions are reachable via the
         suggestion dialogs. The find & replace UI can be repositioned on the screen.

       * Sticky menu bar, which stays on top of the screen when scrolling down.

       * The Quick Navigation menu is redesigned to improve usability for creating
         and cloning new pages.
         [JSPWIKI-531] usability: hints on or mechanism for creating a page

       * New %%styles added:  %%dropcaps, %%flip, %%flop, %%addcss, %%progress,
         %%scrollable-250 (limit the height of a code-block, so it becomes scrollable )

       * Show READER view (also great for printing) has been added to the More menu.

       * [JSPWIKI-788] TabbedSection - support multiple tabbedSections in single
         document with same tab-identifiers

       * Updated to the latest mootools v1.5.1
       * Updated to wro4j 1.7.8

       * Some additional i18n properties added -- but translation still to be done.

2015-05-31  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-16

       * Fixed JSPWIKI-882 test-failure when using existing localized locale in OutComeTest (thanks to Marco Roeland)

2015-04-18  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-15

       * Fixed JSPWIKI-880 Glassfish 4 Wrong Chars Solution - Brasil PT, thanks to Renato Grosz

2015-03-06  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-14

       * Fixed JSPWIKI-878 (following up JSPWIKI-660) you can now also use environment variables to configure JSPWiki

2015-02-12  David Vittor (dvittor@apache.org)

       * 2.10.2-svn-13

       * Fixed JSPWIKI-867 - Deleting attachments should retain focus on the Attach tab

       * JSPWIKI-566 - problem with Cookie set preferences and the GSon.fromJson() parser

       * Fixed search icon in Smart Template "search.gif" instead of "search.png"

2015-01-30  David Vittor (dvittor@apache.org)

       * 2.10.2-svn-12

       * Fixed JSPWIKI-566 - Complete rewrite of AJAX functionality for JSPWiki

       * Fixed JSPWIKI-502 & JSPWIKI-760 - Show Wikipages in Search without Authorization

       * Fixed JSPWIKI-859 - Expose the WikiModuleInfo to the plugins and filters

       * Fixed JSPWIKI-866 - Additional parameters (url,version,desc,htmltemplate,authorurl) to jspwiki_module.xml WikiModuleInfo

2015-01-25  David Vittor (dvittor@apache.org)

       * 2.10.2-svn-11

       * Fixed JSPWIKI-876 - NotePlugin does not work on wiki without context

       * Fixed JSPWIKI-869 - JSPWiki Maven project cannot be imported into Eclipse

       * Updated JSPWIKI-867 - Deleting attachments should retain focus on the Attach tab

       * Updated JSPWIKI-566 - Some Ajax functionality added - not complete re-write yet

2014-12-08  Siegfried Goeschl (sgoeschl@apache.org)

       * Fixed JSPWIKI-829 - [Portable] Integrate jspwiki-portable into the jspwiki maven build

2014-11-04  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-10

       * Fixed JSPWIKI-874 - IllegalStateException running JSPWiki in Oracle Glassfish Server

2014-11-04  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-9

       * Fixed JSPWIKI-871 - upgraded nekohtml (0.9.5 => 1.9.21) and xercesImpl (2.4 => 2.10.0)

2014-11-04  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-8

       * Fixed JSPWIKI-870 - JSPWiki does not start, if tomcat directory path contains a white space.

2014-09-21  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-7

       * Fixed JSPWIKI-856 - Enhance FileSystemProvider to be able to save page attributes as properties, provided by David Vittor

2014-08-12  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-6

       * Fixed JSPWIKI-855: NullPointerException in FormInput.java:92, patch provided by Jürgen Weber - thanks!

2014-07-31  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-5

       * Fixed JSPWIKI-195 - do not allow more than one account with the same email address.
          ==> a new key (security.error.email.taken) was added to CoreResources.properties

       * minor encoding correction for the CoreResources_nl.properties

2014-07-07  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-4

       * Dependencies' upgrade: EhCache to 2.6.9, SLF4J to 1.7.7, Selenium to 2.42.0, Stripes to 1.5.7-classloaderfix
         and Jetty to 8.1.15

2014-06-23  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-3

       * Fixed JSPWIKI-847 - Recent Changes Plugin breaks markup if generates an empty table, reported by Dave Koelmeyer

2014-06-05  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.2-svn-2

       * Fixed JSPWIKI-843 - generate test-jars

       * Fixed JSPWIKI-844 - Replace org.apache.catalina dependency by applying Ichiro's patch. Thanks!

       * Fixed JSPWIKI-311 - Cannot save user profile in container managed authentication mode

       * Applied patch on JSPWIKI-841, which solves part of the issue, on unsuccesful login there is no error message
         with container managed authentication

2014-05-29  Harry Metske (metskem@apache.org)

       * 2.10.2-svn-1

       * Fixed JSPWIKI-396 - by making the server signature comparison case insensitive (reported by Jürgen Weber)

2014-05-23  Harry Metske (metskem@apache.org)

       * 2.10.1-svn-17

       * Fixed JSPWIKI-535 - direct links to sections with accents doesn't work

2014-04-20  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.1-svn-16

       * First steps integrating Siegfried Goeschl's Wiki On A Stick (https://github.com/sgoeschl/apache-jspwiki -
         thanks!), portable module still pending.
       ** Fixes JSPWIKI-826 - [Portable] PropertyReader ignores the web app class loader

       * Lucene updated to 4.7.0

2014-04-20  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.1-svn-15

       * Fixed JSPWIKI-822 - NPE thrown by PluginContext#getText()

       * JSPWIKI-814 - VersioningFileProvider does migrate original page properties (thanks to Brian Burch)

2014-04-20  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.1-svn-14

       * Fixed JSPWIKI-832 - [Portable] Problems setting up multiple wikis using a shared JSPWiki libraries
         (patch by Siegfried Goeschl - thanks!)

       * Upgraded selenium-*-drivers to 2.41.0

2014-04-01  Harry Metske (metskem@apache.org)

       * 2.10.1-svn-13

       * Fixed JSPWIKI-831 - Container managed authorization does not work in tomcat

2014-03-17  Harry Metske (metskem@apache.org)

       * 2.10.1-svn-12

       * Fixed JSPWIKI-833 - temp policy file is created with wrong content (thanks to Dietrich Schmidt)

2014-03-11  Harry Metske (metskem@apache.org)

       * Fixed JSPWIKI-823 - set java.io.tmpdir to ${project.build.directory} in pom.xml

2014-03-11  Harry Metske (metskem@apache.org)

       * Fixed JSPWIKI-827 - Migrate the mvn_cheatsheet.txt to Markdown

2014-03-03  Harry Metske (metskem@apache.org)

       * 2.10.1-svn-11

       * Fixed JSPWIKI-813 - ReferenceManagerTest - two cases fail (thanks to Brian Burch)

2014-03-02  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.1-svn-10

       This is the second major check-in of the HADDOCK template, with
       fixes and improvements mainly related to the plain editor.

       * Livepreview has been fixed, with ajax based on the fly page rendering.
         The livepreview area can now also be displayed side-by-side next to the editor textarea,
         so you can immediately see the rendered wiki-markup during edit.

       * Suggestion dialog boxes are shown while you type to assist entrance of more advanced
         wiki-markup such as links, %%styles, colors, fonts, plugins, and symbols.
         (but still heavily under development)

       * Section Editing has been improved: you can choose which part of the page you want to edit.

       * All icons are now based on an icon Font, replacing the FamFamFam icon set.
         Based on Font Awesome by Dave Gandy - http://fontawesome.iohttp://fontawesome.io/icons/

       * The find & replace UI has been enhanced, showing number of occurrences,
         supporting regular expressions, and supporting replacement for the first or all matches.

       * Text is automatically indented based on the indentation level of the previous line.

       * Using the TAB key inside the textarea will indent a line. Use shift+TAB to un-indent.
         Indentation also works when selecting multiple lines.

       * You can use shift+Enter to quickly insert line-breaks. (\\)

       Fixing following editor related JIRA tickets :

       * [JSPWIKI-382]  Remove posteditor.js

       * [JSPWIKI-482]  Wrong insert from the suggestion box

       * [JSPWIKI-443]  Full screen editor.
         Added a collapsible sidebar, and a side-by-side display of the live-preview area.

       * [JSPWIKI-336]  section selection box not working properly. Fixed.

       * Fixed the User-Preference page-unload event.

       Other changes :

       * New "layout" user-preference to switch between fluid or fixed-width page layout.

       * Added a info drop-down menu with a summary of the page-info.
         This is similar to page-footer section, but now accessible at the top of the page.

       * Replacing all *.png based icons by an icon font.  (eg. slimbox, filter, rss-feed )

2014-02-20  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.1-svn-9

       * JS fix in haddock template : RegExp expression cause FF to crash.

2014-02-20  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.1-svn-8

       * [JSPWIKI-769 related] jspwiki-portable module, right now only Windows executable is generated, cfr. with
         https://jspwiki-wiki.apache.org/Wiki.jsp?page=PortableBinaries

       * [JSPWIKI-817 related] Install.jsp is broken ==> Translation corrections (install.jsp.intro.[p1|p2|p3]) for ES

       * [JSPWIKI-821] TestEngine sometimes creates testrepositories with double timestamps after r1567444

2014-02-18  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.1-svn-7

       * Various small fixes on the HADDOCK template (jsp/css/js) :

       * Fixing %%category dropdowns which were clipped when inside a %%accordion.
         Replacing js based animation by2.10.1-svn-12 css3 animation to show/hide the popup.

       * Fixing bug when saving the Preferences (detected by Harry)

       * Changed fixed-width layout into fluid layout, occupying all screen real-estate.
         (this could become a user-preference setting in the future)
         Slightly decreasing the size of the sidebar.

2014-02-18  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.1-svn-6

       * Fixing the JSONRPCMAnager.emitJSONCall(..) so that it now renders
         the correct JSON RPC invocation javascript.

         You can test the RPCSamplePlugin like this:

              [{RPCSamplePlugin

              test
              }]

         We are still getting error-code: 490, "No permission to access this AJAX method!"
         when invoking a plugin generated json-rpc call.

2014-02-14  Dirk Frederickx (brushed AT apache DOT org)

       * 2.10.1-svn-5

         Introducing the HADDOCK template, a new template/ui for Apache JSPWiki.

         This template contains various UI improvements and JSP simplifications,
         a major redesign of the JSPWiki CSS stylesheet based on BOOTSTRAP
         (now modularly build with LESS) and a rework of the javascript routines
         based on mootools v1.4.x. (also the js is now split into modular class files)

         Be aware: this is a first commit -- expect things to be broken.
         More work is needed on the plain editor; the Group UI is to be fixed.
         Validation has been done against Safari, Chrome & FF;  IE testing is left
         to the adventurous user.

         HADDOCK lives peacefully next to the default template. To activate the new
         template, add following line to your jspwiki-custom.properties:

              jspwiki.templateDir = haddock

       * [JSPWIKI-504] New default look for 3.0

       * [JSPWIKI-431] Attachment Upload, support upload of multiple files, drag&drop,
              improved progress bars.
              However the server functionality to upload multiple files is
              currently broken. FFS

       * [JSPWIKI-432] Simplify Tabbed Section Markup
              Still maintaining backwards compatibility with the current %%tabbedSection
              markup.

       * [JSPWIKI-712] Entites in ChangeNote should be decoded with "keep editing"

       * [JSPWIKI-797] Refactoring the JSPWiki javascript routines, upgrade js libs:
               mootools-core-1.4.5
               mootools-more-1.4.0.1
               prettify (dd. 4 mar 2013)

       * [JSPWIKI-798] Refactoring the JSPWiki main CSS stylesheet -
               now based on the BOOTSTRAP CSS Framework

       * [JSPWIKI-430] DOM based popups to replace regular js alert or prompt dialog boxes
               Also the edit/clone UI has been refactored.
               Some delete confirmation dialog boxes are still to be converted.

       * [JSPWIKI-429] Improved SLIMBOX to support Youtube, flash and other formats.
                You can now also 'slimbox' another wiki-page or an external url.
                Based on this media viewer, also a %%carousel style has been added.

       * [JSPWIKI-478] Remember cookies of collapsible for all contexts
                Collapsible lists and boxes have been refactored, and styled with BOOTSTRAP.
                In general, all %%dynamic-styles are re-styled with BOOTSTRAP css components.

       * [JSPWIKI-693] style issues

       * [JSPWIKI-463] display error in default template

       * [JSPWIKI-449] Menuhide functionality is illogical
                The sidebar (aka Favorites) can be shown/hidden via a toggle button.
                By default, the sidebar is hidden in the Edit/Comment view, to give
                maximum square-meters to the edit text-area.

       * [JSPWIKI-512] CSS Error with Firefox 2.0.20

       *  Upgrade wro4j to latest version 1.7.3

2014-02-12  Juan Pablo Santos (juanpablo AT apache DOT org)

       * 2.10.1-svn-4

       * Fixed JSPWIKI-819: Consider replacing ECS with JDOM, thanks to Ichiro Furusato

       * TestEngine( Properties ) uses a different directory as page repo (JSPWIKI-813 related)

## 内容2
### 文件路径：
jspwiki-main/src/main/java/org/apache/wiki/Release.java
### 代码内容：
/*
    Licensed to the Apache Software Foundation (ASF) under one
    or more contributor license agreements.  See the NOTICE file
    distributed with this work for additional information
    regarding copyright ownership.  The ASF licenses this file
    to you under the Apache License, Version 2.0 (the
    "License"); you may not use this file except in compliance
    with the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing,
    software distributed under the License is distributed on an
    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    KIND, either express or implied.  See the License for the
    specific language governing permissions and limitations
    under the License.
 */

package org.apache.wiki;

import org.apache.commons.lang.StringUtils;

/**
 *  Contains release and version information.  You may also invoke this class directly, in which case it prints
 *  out the version string.  This is a handy way of checking which JSPWiki version you have - just type
 *  from a command line:
 *  <pre>
 *  % java -cp JSPWiki.jar org.apache.wiki.Release
 *  2.5.38
 *  </pre>
 *  <p>
 *  As a historical curiosity, this is the oldest JSPWiki file.  According to the CVS history, it dates from 6.7.2001,
 *  and it really hasn't changed much since.
 *  </p>
 *  @since  1.0
 */
public final class Release {

    private static final String VERSION_SEPARATORS = ".-";

    /**
     *  This is the default application name.
     */
    public static final String     APPNAME       = "JSPWiki";

    /**
     *  This should be empty when doing a release - otherwise keep it as "cvs" so that whenever someone checks
     *  out the code, they know it is a bleeding-edge version.  Other possible values are "alpha" and "beta" for
     *  alpha and beta versions, respectively.
     *  <p>
     *  If the POSTFIX is empty, it is not added to the version string.
     */
    private static final String    POSTFIX       = "M3-git";

    /** The JSPWiki major version. */
    public static final int        VERSION       = 2;

    /** The JSPWiki revision. */
    public static final int        REVISION      = 11;

    /** The minor revision.  */
    public static final int        MINORREVISION = 0;

    /** The build number/identifier.  This is a String as opposed to an integer, just so that people can add
     *  other identifiers to it.  The build number is incremented every time a committer checks in code, and reset
     *  when the a release is made.
     *  <p>
     *  If you are a person who likes to build his own releases, we recommend that you add your initials to this
     *  identifier (e.g. "13-jj", or 49-aj").
     *  <p>
     *  If the build identifier is empty, it is not added.
     */
    public static final String     BUILD         = "02";

    /**
     *  This is the generic version string you should use when printing out the version.  It is of
     *  the form "VERSION.REVISION.MINORREVISION[-POSTFIX][-BUILD]".
     */
    public static final String     VERSTR        =
        VERSION+"."+REVISION+"."+MINORREVISION+ ((POSTFIX.length() != 0 ) ? "-"+POSTFIX : "") + ((BUILD.length() != 0 ? "-"+BUILD : ""));

    /**
     *  Private constructor prevents instantiation.
     */
    private Release() {
    }

    /**
     *  This method is useful for templates, because hopefully it will
     *  not be inlined, and thus any change to version number does not
     *  need recompiling the pages.
     *
     *  @since 2.1.26.
     *  @return The version string (e.g. 2.5.23).
     */
    public static String getVersionString() {
        return VERSTR;
    }

    /**
     *  Returns true, if this version of JSPWiki is newer or equal than what is requested.
     *  @param version A version parameter string (a.b.c-something). B and C are optional.
     *  @return A boolean value describing whether the given version is newer than the current JSPWiki.
     *  @since 2.4.57
     *  @throws IllegalArgumentException If the version string could not be parsed.
     */
    public static boolean isNewerOrEqual( String version ) throws IllegalArgumentException {
        if( version == null ) {
        	return true;
        }
        String[] versionComponents = StringUtils.split( version, VERSION_SEPARATORS );
        int reqVersion       = versionComponents.length > 0 ? Integer.parseInt( versionComponents[0] ) : Release.VERSION;
        int reqRevision      = versionComponents.length > 1 ? Integer.parseInt( versionComponents[1] ) : Release.REVISION;
        int reqMinorRevision = versionComponents.length > 2 ? Integer.parseInt( versionComponents[2] ) : Release.MINORREVISION;

        if( VERSION == reqVersion ) {
            if( REVISION == reqRevision ) {
                if( MINORREVISION == reqMinorRevision ) {
                    return true;
                }

                return MINORREVISION > reqMinorRevision;
            }

            return REVISION > reqRevision;
        }

        return VERSION > reqVersion;
    }

    /**
     *  Returns true, if this version of JSPWiki is older or equal than what is requested.
     *
     *  @param version A version parameter string (a.b.c-something)
     *  @return A boolean value describing whether the given version is older than the current JSPWiki version
     *  @since 2.4.57
     *  @throws IllegalArgumentException If the version string could not be parsed.
     */
    public static boolean isOlderOrEqual( String version ) throws IllegalArgumentException {
        if( version == null ) {
        	return true;
        }

        String[] versionComponents = StringUtils.split( version, VERSION_SEPARATORS );
        int reqVersion       = versionComponents.length > 0 ? Integer.parseInt( versionComponents[0] ) : Release.VERSION;
        int reqRevision      = versionComponents.length > 1 ? Integer.parseInt( versionComponents[1] ) : Release.REVISION;
        int reqMinorRevision = versionComponents.length > 2 ? Integer.parseInt( versionComponents[2] ) : Release.MINORREVISION;

        if( VERSION == reqVersion ) {
            if( REVISION == reqRevision ) {
                if( MINORREVISION == reqMinorRevision ) {
                    return true;
                }

                return MINORREVISION < reqMinorRevision;
            }

            return REVISION < reqRevision;
        }

        return VERSION < reqVersion;
    }

    /**
     *  Executing this class directly from command line prints out the current version.  It is very useful for
     *  things like different command line tools.
     *  <P>Example:
     *  <PRE>
     *  % java org.apache.wiki.Release
     *  1.9.26-cvs
     *  </PRE>
     *
     *  @param argv The argument string.  This class takes in no arguments.
     */
    public static void main( String[] argv ) {
        System.out.println(VERSTR);
    }

}

## 内容3
### 文件路径：
jspwiki-war/src/main/webapp/XHRMarkup2Wysiwyg.jsp
### 代码内容：
<%--
    Licensed to the Apache Software Foundation (ASF) under one
    or more contributor license agreements.  See the NOTICE file
    distributed with this work for additional information
    regarding copyright ownership.  The ASF licenses this file
    to you under the Apache License, Version 2.0 (the
    "License"); you may not use this file except in compliance
    with the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing,
    software distributed under the License is distributed on an
    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    KIND, either express or implied.  See the License for the
    specific language governing permissions and limitations
    under the License.
--%>

<%@ page language="java" pageEncoding="UTF-8"%>
<%@ page import="java.util.Properties" %>
<%@ page import="org.apache.log4j.*" %>
<%@ page import="org.apache.wiki.*" %>
<%@ page import="org.apache.wiki.render.*" %>
<%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
<%!
  public void jspInit()
  {
    wiki = WikiEngine.getInstance( getServletConfig() );
  }
  //Logger log = Logger.getLogger("XHRMarkup2Wysiwyg");
  WikiEngine wiki;
%>
<%
  WikiContext wikiContext = wiki.createContext( request, WikiContext.VIEW );
  //WikiEngine engine = wikiContext.getEngine();

  if( !wiki.getAuthorizationManager().hasAccess( wikiContext, response ) ) return;

  response.setContentType("text/html; charset="+wiki.getContentEncoding() );
  //response.setHeader( "Cache-control", "max-age=0" );
  //response.setDateHeader( "Expires", new Date().getTime() );
  //response.setDateHeader( "Last-Modified", new Date().getTime() );

  String usertext = request.getParameter( "markupPageText" );

  if( usertext != null )
  {

    String pageAsHtml;
    try
    {
        pageAsHtml = wiki.getRenderingManager().getHTML( wikiContext, usertext );
    }
        catch( Exception e )
    {
        pageAsHtml = "<div class='error'>Error in converting wiki-markup to well-formed HTML <br/>" + e.toString() +  "</div>";

        /*
        java.io.StringWriter sw = new java.io.StringWriter();
        java.io.PrintWriter pw = new java.io.PrintWriter(sw);
        e.printStackTrace(pw);
        pageAsHtml += "<pre>" + sw.toString() + "</pre>";
        */
    }

   // Disable the WYSIWYG_EDITOR_MODE and reset the other properties immediately
   // after the XHTML for wysiwyg editor has been rendered.
   wikiContext.setVariable( RenderingManager.WYSIWYG_EDITOR_MODE, Boolean.FALSE );
   wikiContext.setVariable( WikiEngine.PROP_RUNFILTERS,  null );

%><%= pageAsHtml %><%
  }
%>

Output:
【漏洞类型】XSS（跨站脚本攻击）
【严重性】High（高）
【漏洞摘要】这是一个XSS漏洞。`XHRMarkup2Wysiwyg.jsp`文件中，`usertext`参数直接从HTTP请求中获取，并且没有进行适当的HTML转义。如果攻击者能够提交恶意代码，这些代码将在生成的HTML中直接显示，从而可能被其他用户执行。具体问题行在`<%= pageAsHtml %>`处。
【关键代码模式】
- `request.getParameter("markupPageText")`
- `<%= pageAsHtml %>`
【修复方法说明】通过删除`XHRMarkup2Wysiwyg.jsp`文件来移除此潜在的XSS漏洞。该JSP文件未被其他部分引用，因此可以直接安全地移除。


Instruction:
作为 Java 安全专家，检测此代码中的安全漏洞：
## 内容1
### 文件路径：
src/org/thoughtcrime/securesms/linkpreview/LegalUrlPatterns.java
### 代码内容：
package org.thoughtcrime.securesms.linkpreview;

import java.util.regex.Pattern;

public class LegalUrlPatterns {

  public static final Pattern LATIN    = Pattern.compile("[" +
                                                         "\\x{0041}-\\x{005A}" +
                                                         "\\x{0061}-\\x{007A}" +
                                                         "\\x{00AA}"        +
                                                         "\\x{00BA}"        +
                                                         "\\x{00C0}-\\x{00DC}" +
                                                         "\\x{00D8}-\\x{00F6}" +
                                                         "\\x{00F8}-\\x{01BA}" +
                                                         "]");

  public static final Pattern CYRILLIC = Pattern.compile("[" +
                                                          "\\x{0400}-\\x{0481}" +
                                                          "\\x{0482}"        +
                                                          "\\x{0483}-\\x{0484}" +
                                                          "\\x{0487}"        +
                                                          "\\x{0488}-\\x{0489}" +
                                                          "\\x{048A}-\\x{052F}" +
                                                          "\\x{1C80}-\\x{1C88}" +
                                                          "\\x{1D2B}"        +
                                                          "\\x{1D78}"        +
                                                          "\\x{2DE0}-\\x{2DFF}" +
                                                          "\\x{A640}-\\x{A66D}" +
                                                          "\\x{A66E}"        +
                                                          "\\x{A66F}"        +
                                                          "\\x{A670}-\\x{A672}" +
                                                          "\\x{A673}"        +
                                                          "\\x{A674}-\\x{A67D}" +
                                                          "\\x{A67E}"        +
                                                          "\\x{A67F}"        +
                                                          "\\x{A680}-\\x{A69B}" +
                                                          "\\x{A69C}-\\x{A69D}" +
                                                          "\\x{A69E}-\\x{A69F}" +
                                                          "\\x{FE2E}-\\x{FE2F}" +
                                                          "]");

  public static final Pattern GREEK     = Pattern.compile("[" +
                                                          "\\x{0370}-\\x{0373}" +
                                                          "\\x{0375}" +
                                                          "\\x{0376}-\\x{0377}" +
                                                          "\\x{037A}" +
                                                          "\\x{037B}-\\x{037D}" +
                                                          "\\x{037F}" +
                                                          "\\x{0384}" +
                                                          "\\x{0386}" +
                                                          "\\x{0388}-\\x{038A}" +
                                                          "\\x{038C}" +
                                                          "\\x{038E}-\\x{03A1}" +
                                                          "\\x{03A3}-\\x{03E1}" +
                                                          "\\x{03F0}-\\x{03F5}" +
                                                          "\\x{03F6}" +
                                                          "\\x{03F7}-\\x{03FF}" +
                                                          "\\x{1D26}-\\x{1D2A}" +
                                                          "\\x{1D5D}-\\x{1D61}" +
                                                          "\\x{1D66}-\\x{1D6A}" +
                                                          "\\x{1DBF}" +
                                                          "\\x{1F00}-\\x{1F15}" +
                                                          "\\x{1F18}-\\x{1F1D}" +
                                                          "\\x{1F20}-\\x{1F45}" +
                                                          "\\x{1F48}-\\x{1F4D}" +
                                                          "\\x{1F50}-\\x{1F57}" +
                                                          "\\x{1F59}" +
                                                          "\\x{1F5B}" +
                                                          "\\x{1F5D}" +
                                                          "\\x{1F5F}-\\x{1F7D}" +
                                                          "\\x{1F80}-\\x{1FB4}" +
                                                          "\\x{1FB6}-\\x{1FBC}" +
                                                          "\\x{1FBD}" +
                                                          "\\x{1FBE}" +
                                                          "\\x{1FBF}-\\x{1FC1}" +
                                                          "\\x{1FC2}-\\x{1FC4}" +
                                                          "\\x{1FC6}-\\x{1FCC}" +
                                                          "\\x{1FCD}-\\x{1FCF}" +
                                                          "\\x{1FD0}-\\x{1FD3}" +
                                                          "\\x{1FD6}-\\x{1FDB}" +
                                                          "\\x{1FDD}-\\x{1FDF}" +
                                                          "\\x{1FE0}-\\x{1FEC}" +
                                                          "\\x{1FED}-\\x{1FEF}" +
                                                          "\\x{1FF2}-\\x{1FF4}" +
                                                          "\\x{1FF6}-\\x{1FFC}" +
                                                          "\\x{1FFD}-\\x{1FFE}" +
                                                          "\\x{2126}" +
                                                          "\\x{AB65}" +
                                                          "\\x{10140}-\\x{10174}"+
                                                          "\\x{10175}-\\x{10178}"+
                                                          "\\x{10179}-\\x{10189}"+
                                                          "\\x{1018A}-\\x{1018B}"+
                                                          "\\x{1018C}-\\x{1018E}"+
                                                          "\\x{101A0}"+
                                                          "\\x{1D200}-\\x{1D241}"+
                                                          "\\x{1D242}-\\x{1D244}"+
                                                          "\\x{1D245}"+
                                                          "]");
}

## 内容2
### 文件路径：
src/org/thoughtcrime/securesms/linkpreview/LinkPreviewUtil.java
### 代码内容：
package org.thoughtcrime.securesms.linkpreview;

import android.support.annotation.NonNull;
import android.text.SpannableString;
import android.text.TextUtils;
import android.text.style.URLSpan;
import android.text.util.Linkify;

import com.annimon.stream.Stream;

import java.util.Collections;
import java.util.List;

import okhttp3.HttpUrl;

public final class LinkPreviewUtil {

  /**
   * @return All whitelisted URLs in the source text.
   */
  public static @NonNull List<Link> findWhitelistedUrls(@NonNull String text) {
    SpannableString spannable = new SpannableString(text);
    boolean         found     = Linkify.addLinks(spannable, Linkify.WEB_URLS);

    if (!found) {
      return Collections.emptyList();
    }

    return Stream.of(spannable.getSpans(0, spannable.length(), URLSpan.class))
                 .map(span -> new Link(span.getURL(), spannable.getSpanStart(span)))
                 .filter(link -> isWhitelistedLinkUrl(link.getUrl()))
                 .toList();
  }

  /**
   * @return True if the host is present in the link whitelist.
   */
  public static boolean isWhitelistedLinkUrl(@NonNull String linkUrl) {
    HttpUrl url = HttpUrl.parse(linkUrl);
    return url != null                                   &&
           !TextUtils.isEmpty(url.scheme())              &&
           "https".equals(url.scheme())                  &&
           LinkPreviewDomains.LINKS.contains(url.host()) &&
           isLegalUrl(linkUrl);
  }

  /**
   * @return True if the top-level domain is present in the media whitelist.
   */
  public static boolean isWhitelistedMediaUrl(@NonNull String mediaUrl) {
    HttpUrl url = HttpUrl.parse(mediaUrl);
    return url != null                                                &&
           !TextUtils.isEmpty(url.scheme())                           &&
           "https".equals(url.scheme())                               &&
           LinkPreviewDomains.IMAGES.contains(url.topPrivateDomain()) &&
           isLegalUrl(mediaUrl);
  }

  public static boolean isLegalUrl(@NonNull String url) {
    if (LegalUrlPatterns.LATIN.matcher(url).find()) {
      return !LegalUrlPatterns.CYRILLIC.matcher(url).find() &&
             !LegalUrlPatterns.GREEK.matcher(url).find();
    }
    return true;
  }
}

Output:
【漏洞类型】URL 拼写混淆漏洞（也称为 URL homograph 攻击）
【严重性】High
【漏洞摘要】原始代码在 `isLegalUrl` 方法中使用正则表达式来验证 URL 是否包含拉丁、西里尔或希腊字符集，但未考虑 URL 拼写混淆的可能性。由于 URL 中的某些字符可以用不同的字符集表示，攻击者可以构造恶意的 URL，看起来与合法 URL 几乎相同，但实际指向不同的目标。例如，攻击者可以使用西里尔字符集中的 "а"（小写字母 "а"）来替代拉丁字符集中的 "a"，从而创建一个看起来合法但实际上是恶意的 URL。
【关键代码模式】`isLegalUrl` 方法中使用正则表达式匹配拉丁、西里尔和希腊字符集。
【修复方法说明】修复方法通过使用 `DOMAIN_PATTERN` 捕获 URL 的域名部分，并进一步验证域名中是否只包含 ASCII 或非 ASCII 字符，从而防止 URL 拼写混淆攻击。