how to prevent xdd attack to childlist selector in AEM?

Question

I'm having an issue to block xss attacks to childlist selector:

/xh1x.childrenlist.json//%3Csvg%20onload=alert('XSS')%3E.htmlxx/etc/designs/xh1x.childrenlist.json

I've tried adding several stuff in dispatcher.any and httpd.conf, to block the url or redirect to somewhere else, but nothing works.

this issue remains:

in the response header, the content-type is text/html

any ideas how to deal with this?

Lokesh_Vajrala · Accepted Answer

Hi @xiaoyuli  You can try this filter {   /type "deny"   /path "/etc/designs/xh1x"   /selectors "childrenlist"   /extension "json"   /method "GET"} There are these new elements /path, /selectors, /extension, and /suffix in filters, which can be used to further control the behaviour.  Thanks,Lokesh

Sign up

Login with SSO

Login to the community

Login with SSO