Large message size causing error with xssAPI.filterHTML | Community
Skip to main content
Jit_Shrestha
Jit_Shrestha
New Participant
October 16, 2015
Solved

Large message size causing error with xssAPI.filterHTML

  • October 16, 2015
  • 3 replies
  • 2276 views

Update: We are using AEM 6.1

After a batch import, we get the following error in /libs/cq/gui/components/endor/badge/badge.jsp which prevented the touch UI from completely loading the authoring page

java.lang.RuntimeException: Unable to scan input at org.apache.sling.xss.impl.HtmlToHtmlContentContext.filter(HtmlToHtmlContentContext.java:71) at org.apache.sling.xss.impl.XSSFilterImpl.filter(XSSFilterImpl.java:183) at org.apache.sling.xss.impl.XSSFilterImpl.filter(XSSFilterImpl.java:87) at org.apache.sling.xss.impl.XSSAPIImpl.filterHTML(XSSAPIImpl.java:332) at com.adobe.granite.xss.impl.XSSAPIImpl.filterHTML(XSSAPIImpl.java:101) at org.apache.jsp.apps.cq.gui.components.endor.badge.badge_jsp._jspService(badge_jsp.java:821) at org.apache.sling.scripting.jsp.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:725) ....

I was able to track it down to a particular line

<%=xssAPI.filterHTML(i18n.getVar(description)) %>

When I did a check for the length of the description, it was 1672444 characters. Doing a basic substring to say only 1000 characters caused the above error to go away and the touch UI to complete rendering the authoring page.  Is there a character limit in xssAPI that I am not aware of?

Thanks,

Jit

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Kunal_Gaba_

XSS API in AEM uses anti samy api for html encoding. The anti samy API is configured with an XML file also known as anti-samy rules. In AEM 6.1 the rules are configured in SLING-INF.content/config.xml file present in com.day.cq.cq-xssprotection-5.5.24.jar file.  And as per that configuration the maximum input size allowed is 200000 bytes which is lower than the input size you are passing and that's why you see this exception. 

<directives>

<directive name="omitXmlDeclaration" value="true"/> <directive name="omitDoctypeDeclaration" value="true"/> <directive name="maxInputSize" value="200000"/> <directive name="useXHTML" value="true"/> <directive name="formatOutput" value="true"/>

3 replies

Z
zaddm98685815
New Participant
August 3, 2018

Hello kunal23,

I am seeing the same issue in AEM 6.3.2. I am using one of the default text component. The text size is above the specified limit in xssprotection/config.xml file. What would be the best way to update this config. Does this config change with newer version of AEM? Is it safe to override this config by creating a file in code-base?

Thank you

Kunal_Gaba_
Kunal_Gaba_Accepted solution
New Participant
October 16, 2015

XSS API in AEM uses anti samy api for html encoding. The anti samy API is configured with an XML file also known as anti-samy rules. In AEM 6.1 the rules are configured in SLING-INF.content/config.xml file present in com.day.cq.cq-xssprotection-5.5.24.jar file.  And as per that configuration the maximum input size allowed is 200000 bytes which is lower than the input size you are passing and that's why you see this exception. 

<directives>

<directive name="omitXmlDeclaration" value="true"/> <directive name="omitDoctypeDeclaration" value="true"/> <directive name="maxInputSize" value="200000"/> <directive name="useXHTML" value="true"/> <directive name="formatOutput" value="true"/>
edubey
edubey
New Participant
October 16, 2015

It doesn't look like the library is restricting user with any character limit.

Here is a link to Actual Code

is there anything unusual in your string which might me causing this.

Can you try with some random string of 1672444 characters.

Terms & ConditionsAccessibility statement

Loading footer...