Why do we use RTEFilterServletFactory in core components? | Community
Skip to main content
Level 2
Feb 18, 2020 8:26 PM UTC
Solved

Why do we use RTEFilterServletFactory in core components?

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
akhoury
akhouryAccepted solution
Employee
Feb 19, 2020 12:37 AM UTC

Hi,

This configuration makes sure RTE editor content gets filtered to avoid XSS attacks.

 

This feature is pending official addition to the Adobe docs:

  • com.adobe.cq.ui.wcm.commons.internal.servlets.rte.RTEFilterServlet is the new generic servlet introduced that returns the content filtered (through the XSS API).
  • This servlet is not bound to a particular component resource type, and can actually be configured to be bound to any new Text component by adding a new configuration amendment
    Here's an example of such configuration amendment:
    com.adobe.cq.ui.wcm.commons.internal.servlets.rte.RTEFilterServletFactory.amended-foundation
    resource.types=[
    "wcm/foundation/components/text",
    "wcm/foundation/components/textimage"]

 

For the Core Text components: https://github.com/Adobe-Marketing-Cloud/aem-core-wcm-components/blob/master/config/src/content/jcr_root/apps/core/wcm/config/com.adobe.cq.ui.wcm.commons.internal.servlets.rte.RTEFilterServletFactory.amended-core-components.config

1 reply

akhoury
akhouryAccepted solution
Employee
Feb 19, 2020 12:37 AM UTC

Hi,

This configuration makes sure RTE editor content gets filtered to avoid XSS attacks.

 

This feature is pending official addition to the Adobe docs:

  • com.adobe.cq.ui.wcm.commons.internal.servlets.rte.RTEFilterServlet is the new generic servlet introduced that returns the content filtered (through the XSS API).
  • This servlet is not bound to a particular component resource type, and can actually be configured to be bound to any new Text component by adding a new configuration amendment
    Here's an example of such configuration amendment:
    com.adobe.cq.ui.wcm.commons.internal.servlets.rte.RTEFilterServletFactory.amended-foundation
    resource.types=[
    "wcm/foundation/components/text",
    "wcm/foundation/components/textimage"]

 

For the Core Text components: https://github.com/Adobe-Marketing-Cloud/aem-core-wcm-components/blob/master/config/src/content/jcr_root/apps/core/wcm/config/com.adobe.cq.ui.wcm.commons.internal.servlets.rte.RTEFilterServletFactory.amended-core-components.config

Translate