[bpamiri]

Summary

Update Lucee to 7.0.5.41.

• Pins: the framework, wheels new template and starter app lucee.json move from 7.0.0.395 to 7.0.5.41. The Lucee 7 test image (lucee@7.0.5+41, tag v1.0.1), CI lucee.ci.json and the IIS CI install (new SHA-256) move from 7.0.1.100. Lucee Express 7.0.5.41 ships Tomcat 11.0.22.
• Docs: the 4.2 guides that show a pinned version (lucee.json examples, VM deployment) are updated. Pages that record a version something was measured on (screenshots, notes) are left as they are.

HTML encoding on Lucee 7.0.5

Lucee 7.0.5 bundles ESAPI extension 3.0.0.14, built on the OWASP Java Encoder; 7.0.0.395 bundles 2.6.0.1. The 3.x encoder escapes only what each context needs:

• /, :, (, ), [, ] and spaces stay literal;
• a double quote becomes " rather than ";
• its canonicalization keeps a backslash before a quote rather than dropping it.

<, & and quotes are still encoded everywhere they were.

The framework is unchanged, but 57 view specs compared helper output with strings captured from the 2.x encoder. They now go through wheels.tests._assets.view.HtmlEncoding:

• normalize() rewrites character references to one canonical form. &, <, " and ' always stay encoded, so a missing encoding still fails; htmlEncodingHelperSpec pins this.

• attributeProblem() / textProblem() check the injection cases without using the engine's encoder:

  • no attribute is injected;
  • no literal quote or < remains in an attribute value;
  • no literal <, > or quote remains in text;
  • the value decodes back to the input.

  A literal > is allowed inside a quoted attribute value, which is where the 3.x encoder leaves it.

• Specs whose output already matches on every engine keep their literal assertions.

• Four spec inputs drop a stray \", which only the 2.x canonicalizer removed.

Verification

Engine	Database	Scope	Result
Lucee 7.0.5.41 (native)	SQLite	full core suite	7292 pass, 0 fail
Lucee 7.0.0.395 (native, ESAPI 2.6.0.1)	SQLite	full core suite	7292 pass, 0 fail
Lucee 7 test image (rebuilt, 7.0.5.41)	SQLite	view specs	615 pass
BoxLang	SQLite	view specs	615 pass
Adobe 2023	SQLite	view specs	615 pass
Adobe 2025	SQLite	view specs	615 pass
RustCFML v0.732.0	SQLite	full suite	7276 pass, 0 fail

• CLI suite: 2446 pass. The one non-gating DoctorSpec failure comes from WHEELS_FRAMEWORK_PATH being set in the run's environment and is unrelated.
• tools/test-onboarding.sh on the 7.0.5.41 template: 49 pass, 0 fail, 2 skipped.
• Fresh app: wheels new → wheels start → wheels g scaffold → wheels migrate latest on 7.0.5.41. The CLI stages the SQLite driver into the new Express version, and /, /posts and /posts/new return 200.
• Guides site: builds.
• Complexity gate: passes.

The full compat matrix has not run yet.

🤖 Generated with Claude Code

[github-actions]

Wheels Test Results

260 820 tests   255 083 ✅  1h 56m 5s ⏱️
 21 000 suites    5 737 💤
     35 files          0 ❌

Results for commit d88a4bf.

[bpamiri]

Source review at d88a4bfce10a: no blocking source finding; final CI approval is held on the failed LuCLI job.

• normalize() leaves raw markup characters distinct from their encoded forms. Its one-pass normalization also preserves double-encoding differences. The added injection checks retain decoded-value equality and raw quote/< checks. These helpers are suitable for the double-quoted markup fixtures here; they are not a general HTML parser or sanitizer.
• Allowing literal > inside an intact double-quoted attribute is correct: it cannot terminate that attribute or tag. Text-specific assertions separately require encoded > where tested.
• The four changed inputs remove literal backslashes, not CFML quote escapes. Preserving those backslashes is a user-visible canonicalization change, correctly described in the fragment. Production view-helper code is unchanged.
• Active Lucee pins are consistent across repository/new-app/starter configuration, CI, Docker and current documentation. Remaining old-version references found in the CLI tests are isolated BundleStager fixture directory names, not runtime pins.

LOW, non-blocking:

• Add a focused regression for an input containing a literal backslash immediately before a quote, pinning the documented new canonicalization behavior while retaining compatibility with older encoders. The four rewritten inputs no longer exercise that difference.

Read all 35 raw results from matrix 38514892018: each discovered 600 bundles with 0 failures/errors. htmlEncodingHelperSpec passed 6/6 with no skips everywhere. All eight Lucee 7 legs, including the New York timezone leg, report 7.0.5.41. The matrix gate and RustCFML lane succeeded.

PR CI currently has 33 pass / 1 fail / 2 skip. The failing Lucee 7 + SQLite (LuCLI) job logs ZipException: zip END header not found while loading sqlite-jdbc.jar, followed by missing org.sqlite.JDBC. The sole CLI failure (ServerCommandsSpec, “test runner endpoint returns JSON”, missing totalPass) follows the same runner HTTP 500. This is not an encoding assertion failure; the failing check still needs disposition before final approval.

[bpamiri]

Delta review at b88f179c4: source approval carries forward. The only change since d88a4bfce10a is the backslash-before-quote regression in textfieldSpec.

It exercises the previously removed input, rejects an injected onclick attribute and raw markup characters in the class value, and checks the decoded value against the two supported canonicalization outcomes. This addresses the LOW coverage note. It deliberately permits both encoder generations rather than asserting which generation must preserve the backslash.

The prior full matrix covers unchanged production/configuration code. Final approval remains pending fresh PR CI on this head, including the LuCLI job.

[bpamiri]

Final review: APPROVE at b88f179.

The backslash-before-quote regression addresses the remaining review note. It independently checks attribute safety and accepts the two supported canonicalization outcomes without relying on a particular encoder's entity spelling.

Validation:

• Full matrix 38514892018 on d88a4bf: all 35 JVM legs audited from raw results, each with 600 bundles and zero failures/errors; the six encoding-helper specs passed on every leg. RustCFML and the matrix gate succeeded. The subsequent delta is spec-only.
• Fresh PR CI on b88f179: 33 passed, 2 skipped, no pending or failed checks.
• Exact-head LuCLI artifacts from run 38533000595: Lucee 7.0.5.41, core 7333/0/0, CLI 2449/0/0. The new backslash-before-quote testcase explicitly Passed, not skipped. The earlier corrupt-jar failure did not recur.

No remaining blocking findings.