Skip to content

Give the eBay and Slashdot examples a run(Reader, Appendable) method - #418

Merged
jmanico merged 1 commit into
mainfrom
examples-run
Sep 8, 2026
Merged

jmanico merged 1 commit into
mainfrom
examples-run

Conversation

@jmanico

@jmanico jmanico commented Sep 8, 2026

Copy link
Copy Markdown
Member

Follow-up to #415. The review of that PR left two suggestions open; this resolves the one that turned out to have real value and drops the other.

Why

The two stdin-to-stdout examples did all their work inside main, so the only test of them swapped System.in, System.out and System.err for capture buffers, invoked main reflectively, and could only feed them empty input. That was the last test in the suite that mutates process-global state. It also hid a coverage gap: SlashdotPolicyExample.POLICY_DEFINITION had no direct test anywhere, and no non-empty input ever passed through either example.

What changes

  • EbayPolicyExample and SlashdotPolicyExample gain public static void run(Reader in, Appendable out), the same shape UrlTextExample.run already had. main keeps its command-line handling (usage message, [Reading from STDIN] notice) and delegates. Purely additive; the package is not OSGi-exported.
  • ExamplesTest calls the examples directly with a StringReader and StringBuilder: an empty-input case for all three, plus real-content assertions for the Slashdot and eBay policies covering allowed markup, attribute canonicalization, rel="nofollow", and dropped script, iframe, event handlers and javascript: links. No reflection, no stream swapping, no parameterized test. AllExamples existed only to drive the old test and is removed.
  • The javadoc exclusion *.example never matched the org.owasp.html.examples package, so the examples have shipped in the published javadoc since the pattern was added. It is now *.examples. Verified by running javadoc:javadoc with each pattern: the old one leaves org/owasp/html/examples in the output, the new one removes it, with the 38 core pages unchanged.

Not done, deliberately: the Surefire display-name reporter suggested in the same review. Nothing machine-reads the reports, and with the parameterized test gone there is nothing left to rename.

Verification

./mvnw clean verify on JDK 11: 381 tests, 0 failures, 0 skipped (unchanged total; ExamplesTest still contributes 6). A grep of src/test for System.setIn, setOut, setErr, getDeclaredMethod, ParameterizedTest or AllExamples returns nothing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BZfawfTUAFHN7cocUjcpQK

The two stdin-to-stdout examples did all their work inside main, so the
only test of them swapped System.in, System.out and System.err for
capture buffers, invoked main reflectively, and could only feed them
empty input.  The Slashdot policy had no direct test at all.

Each example now has a public run(Reader, Appendable) that does the
sanitizing, as UrlTextExample.run already did; main keeps its command
line handling and delegates.  ExamplesTest calls the examples directly
and asserts real output for both policies.  AllExamples, which existed
only to drive the reflective test, is gone.

The javadoc exclusion pattern `*.example` never matched the
`org.owasp.html.examples` package, so the examples have shipped in the
published javadoc since the pattern was added; it is now `*.examples`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BZfawfTUAFHN7cocUjcpQK
@jmanico
jmanico merged commit 2b00648 into main Sep 8, 2026
7 checks passed
@jmanico
jmanico deleted the examples-run branch September 11, 2026 01:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant