Guard extension

dev
1

Does the Guard extension allow for the building of PolicyBuilder policies?

I am trying to do this but getting an error on
policyBuilder = createObject(“java”, “org.owasp.html.HtmlPolicyBuilder”).init();

error message:
org.owasp.html.HtmlPolicyBuilder not found by lucee.core [125]

I included the latest bundle which is from March 2026. Maybe that is the issue as I see the bundle for Guard is from 2025.

2
1 Like
3

Is dropping the bundle into the bundles folder no longer possible?

4

Dropping an extension’s .jar into bundles folder is probably still supported (you could verify by trying it then loading the Bundle (jar) Info page in Lucee admin), but I’d expect it to be inadvisable, not only because only .lex files are available for download, but also because the extension’s .lex file contains multiple .jar files plus esapi-function.fld which defines the functions available to Lucee.

More than important than the installation method for me was the fact that not only did the new OWASP/ESAPI/Guard extension break my automated tests, but most significantly does not appear to support allowing certain commonly used and critical HTML tags such as <img> via HtmlPolicyBuilder.

I know that 2.6.0.1 requires libs with CVEs, but I don’t have time to deal with the multiple breaking changes, so for now I’m not updating the extension beyond that last v2 nor refactoring major portions of my own Lucee udf library and dependent apps.

5

I dropped the jar files into the Bundle folder did not work. Using the maven attributes on createObject did.

var oPolicyBuilder = CreateObject( “java”, “org.owasp.html.HtmlPolicyBuilder”, { maven: [ “com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1”] } )

1 Like