"Simply" downgrading OWASP/Guard extension back to v2 ... after EVERY 7.1.x.x upgrade?

dev support
1

From what I can tell having upgraded dev from 7.0.0.395 to 7.1.0.204 and again to 7.1.1.3-SNAPSHOT, both times the OWASP/Guard extension also upgraded from v2 to v3.

I know that 2.6.0.1 requires libs with CVEs, but v3 does not appear to support allowing certain commonly used and critical HTML tags such as <img> via HtmlPolicyBuilder.

Yes I know I can “simply” downgrade back to v2, but the last time I did that it was not simple at all due to multiple hidden remnants of v3 which apparently Lucee was accessing and it was a huge pain getting rid of that and finally getting back to a working Lucee server.

This is more than just annoying. It makes me fear what might happen in production. So I now have two reasons (also see Mail spool bug) for not upgrading to 7.1.

Can this policy of forcing OWASP/Guard extension upgrade be made optional?

2 
#!/bin/bash

# Clears cached ESAPI files to force re-download and re-installation.

# 1. Stop Lucee
# 2. Make sure the Guard extension version is pinned in .CFConfig.json.
# 3. Update Lucee version if needed.
# For example, rename /opt/lucee/lib/lucee-7.0.0.395.jar to .bak, then:
# wget -O /opt/lucee/lib/lucee-7.0.5.41.jar 'https://download.lucee.org/download.cfm?version=7.0.5.41&type=jar'
# 4. Run this before starting Lucee again.

# sudo -i
# chmod +x clear-cached-Lucee-Guard-extension.sh
# ./clear-cached-Lucee-Guard-extension.sh

L=/opt/lucee/tomcat/lucee-server
ESAPI_ID="37C61C0A-5D7E-4256-8572639BE0CF5838"

echo "Removing cache folders"

rm -rf $L/felix-cache
rm -rf $L/context/cache
rm -rf $L/context/cfclasses
rm -rf $L/context/dynclasses
rm -rf $L/context/mvn/cache
rm -rf $L/context/temp
rm -rf $L/bundles/esapi.extension-*.jar
rm -rf $L/bundles/org.lucee.esapi.extension-*.jar

echo "Removing available extension files (if any)"
rm -f $L/context/extensions/available/$ESAPI_ID-*.lex

# Installed extension files are renamed to random hashes; inspect each .lex manifest for the UUID
for f in $L/context/extensions/installed/*.lex; do
	[ -e "$f" ] || continue
	if unzip -p "$f" META-INF/MANIFEST.MF 2>/dev/null | grep -qi "$ESAPI_ID"; then
		base=$(basename "$f" .lex)
		lex="$L/context/extensions/installed/$base.lex"
		obj="$L/context/extensions/installed/$base.obj"
		echo "Removing $lex"
		rm -f "$lex"
		if [ -e "$obj" ]; then
			echo "Removing $obj"
			rm -f "$obj"
		fi
	fi
done

# Separately remove any .obj files that contain the ESAPI ID
# because they might not have corresponding .lex files (orphaned).
for f in "$L"/context/extensions/installed/*.obj; do
	[ -e "$f" ] || continue
	if grep -aqi "$ESAPI_ID" "$f"; then
		echo "Removing $f"
		rm -f "$f"
	fi
done