Merge branch 'master' into interpolation-defaults

apache · Sep 21, 2022 · 3656292 · 3656292
2 parents 1c1e138 + 1f92601
commit 3656292
Show file tree

Hide file tree

Showing 11 changed files with 122 additions and 55 deletions.
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -42,7 +42,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v3.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
@@ -29,8 +29,8 @@ jobs:
         java: [ 8 ]
 
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/cache@v3.0.5
+    - uses: actions/checkout@v3.0.2
+    - uses: actions/cache@v3.0.8
       with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -39,7 +39,7 @@ jobs:
     - name: Set up JDK ${{ matrix.java }}
       uses: actions/setup-java@v3
       with:
-        distribution: adopt
+        distribution: 'temurin'
         java-version: ${{ matrix.java }}
     - name: Build with Maven
       run: mvn -V test jacoco:report --file pom.xml --no-transfer-progress

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
@@ -34,11 +34,11 @@ jobs:
 #            experimental: true
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v3.0.2
     - name: Set up JDK ${{ matrix.java }}
       uses: actions/setup-java@v3
       with:
-        distribution: adopt
+        distribution: 'temurin'
         java-version: ${{ matrix.java }}
         cache: 'maven'
     - name: Build with Maven

diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
@@ -0,0 +1,67 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache license, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the license for the specific language governing permissions and
+# limitations under the license.
+
+name: "Scorecards supply-chain security"
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 1 * * 6"    # Weekly on Saturdays
+  push:
+    branches: [ "master" ]
+
+permissions: read-all
+
+jobs:
+
+  analysis:
+
+    name: "Scorecards analysis"
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write    # Needed to upload the results to the code-scanning dashboard.
+      actions: read
+      contents: read
+
+    steps:
+
+      - name: "Checkout code"
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b   # 3.0.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@ce330fde6b1a5c9c75b417e7efc510b822a35564    # 1.1.2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # A read-only PAT token, which is sufficient for the action to function.
+          # The relevant discussion: https://github.com/ossf/scorecard-action/issues/188
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          # Publish the results for public repositories to enable scorecard badges.
+          # For more details: https://github.com/ossf/scorecard-action#publishing-results
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8    # 3.1.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@b398f525a5587552e573b247ac661067fafa920b    # 2.1.22
+        with:
+          sarif_file: results.sarif
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -61,7 +61,7 @@ Making Changes
 --------------
 
 + Create a _topic branch_ for your isolated work.
-  * Usually you should base your branch on the `master` or `trunk` branch.
+  * Usually you should base your branch on the `master` branch.
   * A good topic branch name can be the JIRA bug id plus a keyword, e.g. `TEXT-123-InputStream`.
   * If you have submitted multiple JIRA issues, try to maintain separate branches and pull requests.
 + Make commits of logical units.

diff --git a/README.md b/README.md
@@ -44,9 +44,11 @@ Apache Commons Text
 ===================
 
 [![Build Status](https://travis-ci.org/apache/commons-text.svg)](https://travis-ci.org/apache/commons-text)
-[![Coverage Status](https://coveralls.io/repos/apache/commons-text/badge.svg)](https://coveralls.io/r/apache/commons-text)
-[![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.commons/commons-text/badge.svg)](https://maven-badges.herokuapp.com/maven-central/org.apache.commons/commons-text/)
+[![Coverage Status](https://codecov.io/gh/apache/commons-text/branch/master/graph/badge.svg)](https://app.codecov.io/gh/apache/commons-text/branch/master)
+[![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.commons/commons-text/badge.svg?gav=true)](https://maven-badges.herokuapp.com/maven-central/org.apache.commons/commons-text/?gav=true)
 [![Javadocs](https://javadoc.io/badge/org.apache.commons/commons-text/1.9.svg)](https://javadoc.io/doc/org.apache.commons/commons-text/1.9)
+[![CodeQL](https://github.com/apache/commons-text/workflows/CodeQL/badge.svg)](https://github.com/apache/commons-text/actions/workflows/codeql-analysis.yml?query=workflow%3ACodeQL)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/apache/commons-text/badge)](https://api.securityscorecards.dev/projects/github.com/apache/commons-text)
 
 Apache Commons Text is a library focused on algorithms working on strings.
 
@@ -79,7 +81,7 @@ There are some guidelines which will make applying PRs easier for us:
 + No tabs! Please use spaces for indentation.
 + Respect the code style.
 + Create minimal diffs - disable on save actions like reformat source code or organize imports. If you feel the source code should be reformatted create a separate PR for this change.
-+ Provide JUnit tests for your changes and make sure your changes don't break any existing tests by running ```mvn clean test```.
++ Provide JUnit tests for your changes and make sure your changes don't break any existing tests by running ```mvn```.
 
 If you plan to contribute on a regular basis, please consider filing a [contributor license agreement](https://www.apache.org/licenses/#clas).
 You can learn more about contributing via GitHub in our [contribution guidelines](CONTRIBUTING.md).

diff --git a/pom.xml b/pom.xml
@@ -47,15 +47,15 @@
     <commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-text</commons.scmPubUrl>
     <commons.scmPubCheckoutDirectory>site-content</commons.scmPubCheckoutDirectory>
 
-    <checkstyle.plugin.version>3.1.2</checkstyle.plugin.version>
+    <checkstyle.plugin.version>3.2.0</checkstyle.plugin.version>
     <checkstyle.version>9.3</checkstyle.version>
 
-    <commons.spotbugs.plugin.version>4.7.1.0</commons.spotbugs.plugin.version>
-    <commons.spotbugs.impl.version>4.7.1</commons.spotbugs.impl.version>
-    <commons.pmd.version>3.17.0</commons.pmd.version>
-    <commons.pmd-impl.version>6.47.0</commons.pmd-impl.version>
+    <commons.spotbugs.plugin.version>4.7.2.0</commons.spotbugs.plugin.version>
+    <commons.spotbugs.impl.version>4.7.2</commons.spotbugs.impl.version>
+    <commons.pmd.version>3.19.0</commons.pmd.version>
+    <commons.pmd-impl.version>6.49.0</commons.pmd-impl.version>
 
-    <commons.mockito.version>4.6.1</commons.mockito.version>
+    <commons.mockito.version>4.8.0</commons.mockito.version>
     <commons.jacoco.version>0.8.8</commons.jacoco.version>
 
     <!-- apache-rat-plugin 0.13 and jdepend-maven-plugin 2.0 both fail with LinkageError when generating reports 
@@ -94,7 +94,7 @@
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter</artifactId>
-      <version>5.8.2</version>
+      <version>5.9.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -329,7 +329,7 @@
       </plugin>
       <plugin>
         <artifactId>maven-pmd-plugin</artifactId>
-        <version>3.17.0</version>
+        <version>3.19.0</version>
         <configuration>
           <targetJdk>${maven.compiler.target}</targetJdk>
         </configuration>

diff --git a/src/changes/changes.xml b/src/changes/changes.xml
@@ -71,39 +71,37 @@ The <action> type attribute can be add,update,fix,remove.
     <action issue="TEXT-209" type="fix" dev="ggregory" due-to="Arturo Bernal">Use Math.min() call instead of doing it manually. #335.</action>
     <action                  type="fix" dev="ggregory" due-to="ValentijnvdBeek, Gary Gregory">TextStringBuilder: Throw OutOfMemoryError instead of NegativeArraySizeException.</action>
     <action                  type="fix" dev="ggregory" due-to="ValentijnvdBeek, Gary Gregory">TextStringBuilder: Can't grow to sizes up to Integer.MAX_VALUE.</action>
+    <action                  type="fix" dev="mattjuntunen">Make default string lookups configurable via system property. Remove dns, url, and script lookups from defaults. If these lookups are required for use in StringSubstitutor.createInterpolator(), they must be enabled via system property. See StringLookupFactory for details.</action>
     <!-- ADD -->
     <action issue="TEXT-207" type="add" dev="mattjuntunen">Add DoubleFormat utility.</action>
     <action issue="TEXT-190" type="add" dev="kinow" due-to="Benjamin Bing">Document negative limit for WordUtils abbreviate method</action>
     <action issue="TEXT-188" type="add" dev="kinow" due-to="Jakob Vesterstrøm">Speed up LevenshteinDistance with threshold by exiting early</action>
     <action issue="TEXT-185" type="add" dev="ggregory" due-to="Larry West, Gary Gregory">Release Notes page hasn't been updated for 1.9 release yet.</action>
     <action                  type="add" dev="ggregory" due-to="Gary Gregory">Add StrBuilder.isNotEmpty().</action>
     <!-- UPDATE -->
-    <action                  type="update" dev="mattjuntunen">Make default string lookups configurable via system property. Remove dns, url, and script lookups from defaults. If these lookups are required for use in StringSubstitutor.createInterpolator(), they must be enabled via system property. See StringLookupFactory for details.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot">Bump actions/setup-java from v1.4.0 to 3 #147, #156, #155, #172, #215, #314.</action>
-    <action                  type="update" dev="kinow" due-to="Dependabot">Bump actions/checkout from v1 to 3 #138, #146, #165, #183, #274, #279, #304.</action>
-    <action                  type="update" dev="kinow" due-to="Dependabot">Bump actions/cache from v2 to v3.0.5 #205, #217, #234, #339.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot">Bump github/codeql-action from 1 to 2 #319.</action>
     <action                  type="update" dev="ggregory" due-to="Dependabot">Bump checkstyle from 8.34 to 9.3, #141, #168, #182, #188, #193, #201, #208, #211, #228, #235, #245, #253, #255, #262, #270, #280, #287, #299, #315, #321.</action>
-    <action                  type="update" dev="ggregory" due-to="Gary Gregory, Dependabot">Bump spotbugs-maven-plugin from 4.0.0 to 4.7.1.0, #144, #150, #167, #176, #194, #210, #223, #250, #268, #273, #277, #278, #286, #293, #303, #320, #325, #338.</action>
-    <action                  type="update" dev="ggregory" due-to="Gary Gregory, Dependabot">Bump spotbugs from 4.1.3 to 4.7.1 #175, 189, #209, #218, #247, #256, #264, #275, #284, #289, #296, #306.</action>
-    <action                  type="update" dev="ggregory" due-to="Dependabot">Bump mockito-inline from 3.4.4 to 4.6.1, #143, #148, #149, #152, #153, #154, #158, #159, #166, #177, #180, #187, #195, #197, #207, #216, #231, #236, #237, #243, #258, #259, #260, #261, #272, #285, #291, #305, #317, #330, #331.</action>
-    <action                  type="update" dev="kinow" due-to="Dependabot">Bump junit-jupiter from 5.6.2 to 5.8.2 #163, #204, #232, #265, #269, #288.</action>
+    <action                  type="update" dev="ggregory" due-to="Gary Gregory, Dependabot">Bump spotbugs-maven-plugin from 4.0.0 to 4.7.2.0, #144, #150, #167, #176, #194, #210, #223, #250, #268, #273, #277, #278, #286, #293, #303, #320, #325, #338, #344, #354.</action>
+    <action                  type="update" dev="ggregory" due-to="Gary Gregory, Dependabot">Bump spotbugs from 4.1.3 to 4.7.2 #175, 189, #209, #218, #247, #256, #264, #275, #284, #289, #296, #306, #355.</action>
+    <action                  type="update" dev="ggregory" due-to="Dependabot">Bump mockito-inline from 3.4.4 to 4.8.0, #143, #148, #149, #152, #153, #154, #158, #159, #166, #177, #180, #187, #195, #197, #207, #216, #231, #236, #237, #243, #258, #259, #260, #261, #272, #285, #291, #305, #317, #330, #331, #347, #352.</action>
+    <action                  type="update" dev="kinow" due-to="Dependabot">Bump junit-jupiter from 5.6.2 to 5.9.0 #163, #204, #232, #265, #269, #288, #343.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot, Gary Gregory">Bump assertj-core from 3.16.1 to 3.23.1 #151, #157, #160, #178, #184, #199, #244, #267, #294.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot, Gary Gregory">Bump commons-io from 2.7 to 2.11.0 #161 #251.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot, Gary Gregory">Bump commons-parent from 51 to 53 #145.</action>
-    <action                  type="update" dev="kinow" due-to="Dependabot">Bump maven-pmd-plugin from 3.13.0 to 3.17.0 #186, #263, #302, #334.</action>
+    <action                  type="update" dev="kinow" due-to="Dependabot">Bump maven-pmd-plugin from 3.13.0 to 3.19.0 #186, #263, #302, #334, #349, #353.</action>
     <action                  type="update" dev="kinow" due-to="Gary Gregory">Bump pmd from 6.42.0 to 6.46.0.</action>
     <action                  type="update" dev="ggregory" due-to="Dependabot">Bump graalvm.version from 20.2.0 to 22.0.0.2 #185, #198, #206, #227, #252, #276, #295, #300.</action>
     <action                  type="update" dev="ggregory" due-to="Gary Gregory">Bump commons.japicmp.version from 0.14.3 to 0.15.3.</action>
     <action                  type="update" dev="ggregory" due-to="Gary Gregory">Bump commons.jacoco.version 0.8.5 to 0.8.8; fixes Java 15 build.</action>
-    <action                  type="update" dev="kinow" due-to="Dependabot">Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2 #202.</action>
+    <action                  type="update" dev="kinow" due-to="Dependabot">Bump maven-checkstyle-plugin from 3.1.1 to 3.2.0 #202, #348.</action>
     <action                  type="update" dev="ggregory" due-to="Gary Gregory">Bump commons-lang3 3.11 -> 3.12.0.</action>
     <action                  type="update" dev="ggregory" due-to="Gary Gregory">Bump commons.javadoc.version from 3.2.0 to 3.4.0.</action>
     <action                  type="update" dev="ggregory" due-to="Gary Gregory">Bump commons.project-info.version from 3.1.0 to 3.1.2.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot">Bump jmh.version from 1.32 to 1.35 #254, #292, #313.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot">Bump commons-rng-simple from 1.3 to 1.4 #266.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot">Bump taglist-maven-plugin from 2.4 to 3.0.0 #297.</action>
-    <action                  type="update" dev="kinow" due-to="Dependabot">Bump commons.pmd-impl.version from 6.44.0 to 6.47 #323, #336.</action>
+    <action                  type="update" dev="kinow" due-to="Dependabot">Bump commons.pmd-impl.version from 6.44.0 to 6.49.0 #323, #336, #345, #350.</action>
     <action                  type="update" dev="kinow" due-to="Dependabot">Bump exec-maven-plugin from 3.0.0 to 3.1.0 #340.</action>
   </release>
   <release version="1.9" date="2020-07-21" description="Release 1.9. Requires Java 8.">

diff --git a/src/main/java/org/apache/commons/text/StrBuilder.java b/src/main/java/org/apache/commons/text/StrBuilder.java
@@ -29,8 +29,8 @@
 import org.apache.commons.lang3.StringUtils;
 
 /**
- * Builds a string from constituent parts providing a more flexible and powerful API
- * than StringBuffer.
+ * Builds a string from constituent parts providing a more flexible and powerful API than {@link StringBuffer} and
+ * {@link StringBuilder}.
  * <p>
  * The main differences from StringBuffer/StringBuilder are:
  * </p>
@@ -39,32 +39,31 @@
  * <li>Not final</li>
  * <li>Subclasses have direct access to character array</li>
  * <li>Additional methods
- *  <ul>
- *   <li>appendWithSeparators - adds an array of values, with a separator</li>
- *   <li>appendPadding - adds a length padding characters</li>
- *   <li>appendFixedLength - adds a fixed width field to the builder</li>
- *   <li>toCharArray/getChars - simpler ways to get a range of the character array</li>
- *   <li>delete - delete char or string</li>
- *   <li>replace - search and replace for a char or string</li>
- *   <li>leftString/rightString/midString - substring without exceptions</li>
- *   <li>contains - whether the builder contains a char or string</li>
- *   <li>size/clear/isEmpty - collections style API methods</li>
- *  </ul>
+ * <ul>
+ * <li>appendWithSeparators - adds an array of values, with a separator</li>
+ * <li>appendPadding - adds a length padding characters</li>
+ * <li>appendFixedLength - adds a fixed width field to the builder</li>
+ * <li>toCharArray/getChars - simpler ways to get a range of the character array</li>
+ * <li>delete - delete char or string</li>
+ * <li>replace - search and replace for a char or string</li>
+ * <li>leftString/rightString/midString - substring without exceptions</li>
+ * <li>contains - whether the builder contains a char or string</li>
+ * <li>size/clear/isEmpty - collections style API methods</li>
+ * </ul>
  * </li>
  * <li>Views
- *  <ul>
- *   <li>asTokenizer - uses the internal buffer as the source of a StrTokenizer</li>
- *   <li>asReader - uses the internal buffer as the source of a Reader</li>
- *   <li>asWriter - allows a Writer to write directly to the internal buffer</li>
- *  </ul>
+ * <ul>
+ * <li>asTokenizer - uses the internal buffer as the source of a StrTokenizer</li>
+ * <li>asReader - uses the internal buffer as the source of a Reader</li>
+ * <li>asWriter - allows a Writer to write directly to the internal buffer</li>
+ * </ul>
  * </li>
  * </ul>
  * <p>
- * The aim has been to provide an API that mimics very closely what StringBuffer
- * provides, but with additional methods. It should be noted that some edge cases,
- * with invalid indices or null input, have been altered - see individual methods.
- * The biggest of these changes is that by default, null will not output the text
- * 'null'. This can be controlled by a property, {@link #setNullText(String)}.
+ * The aim has been to provide an API that mimics very closely what StringBuffer provides, but with additional methods.
+ * It should be noted that some edge cases, with invalid indices or null input, have been altered - see individual
+ * methods. The biggest of these changes is that by default, null will not output the text 'null'. This can be
+ * controlled by a property, {@link #setNullText(String)}.
  * </p>
  *
  * @since 1.0

diff --git a/src/main/java/org/apache/commons/text/StringEscapeUtils.java b/src/main/java/org/apache/commons/text/StringEscapeUtils.java
@@ -664,7 +664,7 @@ public static final String escapeJson(final String input) {
      *
      * @param input  the {@code String} to escape, may be null
      * @return a new escaped {@code String}, {@code null} if null string input
-     * @see #unescapeXml(java.lang.String)
+     * @see #unescapeXml(String)
      */
     public static String escapeXml10(final String input) {
         return ESCAPE_XML10.translate(input);
@@ -693,7 +693,7 @@ public static String escapeXml10(final String input) {
      *
      * @param input  the {@code String} to escape, may be null
      * @return a new escaped {@code String}, {@code null} if null string input
-     * @see #unescapeXml(java.lang.String)
+     * @see #unescapeXml(String)
      */
     public static String escapeXml11(final String input) {
         return ESCAPE_XML11.translate(input);