Tweak both isValidSafeHTML methods to always log a warning mentioning deprecation and the GitHub Security Advisory.

Author: kwwall

src/main/java/org/owasp/esapi/reference/DefaultValidator.java

@@ -98,6 +98,10 @@
 public class DefaultValidator implements org.owasp.esapi.Validator {
     private static Logger logger = ESAPI.log();
     private static volatile Validator instance = null;
+    private static boolean alreadyLogged = false;
+    private static String deprecationWarning = "WARNING: You are using the Validator.isValidSafeHTML interface, " +
+        "which has been deprecated and should be avoided. See GitHub Security Advisory " +
+        "https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-r68h-jhhj-9jvm for details.";
 
     public static Validator getInstance() {
         if ( instance == null ) {
@@ -382,6 +386,12 @@ public Date getValidDate(String context, String input, DateFormat format, boolea
      */
     @Override
     public boolean isValidSafeHTML(String context, String input, int maxLength, boolean allowNull) {
+        // Ensure a message about deprecation is logged once if this or the
+        // other isValidSafeHTML method is called.
+        if ( ! alreadyLogged ) {
+            logger.always(Logger.SECURITY_AUDIT, deprecationWarning);
+            alreadyLogged = true;
+        }
         try {
             getValidSafeHTML( context, input, maxLength, allowNull);
             return true;
@@ -395,6 +405,12 @@ public boolean isValidSafeHTML(String context, String input, int maxLength, bool
      */
     @Override
     public boolean isValidSafeHTML(String context, String input, int maxLength, boolean allowNull, ValidationErrorList errors) throws IntrusionException {
+        // Ensure a message about deprecation is logged once if this or the
+        // other isValidSafeHTML method is called.
+        if ( ! alreadyLogged ) {
+            logger.always(Logger.SECURITY_AUDIT, deprecationWarning);
+            alreadyLogged = true;
+        }
         try {
             getValidSafeHTML( context, input, maxLength, allowNull);
             return true;