Dave Wichers

I'd recommend going through all the rules and their CWE mappings and moving any CWEs that are marked 'Discouraged' or 'Prohibited' (Don't know if there are any prohibited mappings), so the ones being used are not marked 'Discouraged' or 'Prohibited'. As examples, these rules use 'Discouraged' CWEs: arrayIndexOutofBounds is mapped to CWE 788 (CWE - CWE-788: Access of Memory Location After End of Buffer (4.18) https://cwe.mitre.org/data/definitions/788.html) - Maybe should be mapped to 125 or 787 if...

For others reading this thread, the latest available version of Neko is currently (1.9.22): https://search.maven.org/artifact/net.sourceforge.nekohtml/nekohtml/1.9.22/jar - The 1.9.6.x version Sonicle refers to above is at an older set of artifact coordinates: https://search.maven.org/artifact/nekohtml/nekohtml/1.9.6.2/jar - If you are using that old version, you should switch to: net.sourceforge.nekohtml:nekohtml:1.9.22 or greater.

I was noticing that a bunch of dependencies are directly checked into the project. For example: lib/core (various directories and jars inside them) lib/extended (various directories and jars inside them) and yet it looks like most (all?) if these dependencies are also referenced in the gradle.build files. Can't these dependencies simply be removed from the git repo for YAJSW, and pulled into whatever is generated during the build by pulling them from Central during the Gradle build process? A number...