XSSAPI in AEM 6.2 | Community
Skip to main content
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

9 replies

Sachin_Arora_
Sachin_Arora_
New Participant
May 22, 2018 5:20 PM UTC

We are currently using ACS commons deprecated taglib. The only solution I can think is of creating a custom tag library(for the time being we are having JSPs) exposing all methods as ACS taglib but using Sling XSSAPI internally. It will require change in only global.jsp. Also HTL global object xssAPI is of deprecated XSSAPI as mentioned here : https://helpx.adobe.com/experience-manager/htl/using/global-objects.html

Translate
    Jt_Jayati
    Jt_JayatiAuthor
    Level 2
    Mar 16, 2017 2:41 PM UTC
            JSPs.
    Translate
      smacdonald2008
      smacdonald2008
      Level 10
      Mar 16, 2017 2:37 PM UTC

      What type of component are you building - are you using HTL (Sightly) or JSP. 

      Translate
      Jt_Jayati
      Jt_JayatiAuthor
      Level 2
      Mar 16, 2017 2:34 PM UTC
      Yes that's a solution to be done in global.jsp , or below one , as API itself provides thi function: XSSAPI xssapi = sling.getService(XSSAPI.class).getRequestSpecificAPI(slingRequest); but with both these solutions we get an error of "duplicate JSP variable", and so we need to assign it to some other variable like "slingXSSAPI", and here comes the overhead of changing all the occurences of this variable in good amount of files. This is do-able but if things are later-on updated in cq taglibraries's definedObjects then we need to revert to actual variable again for all occurences. So is it fine to keep using the deprecated import which cq taglib is using, or no matter what cq taglibrary is using we should never go ahead with deprecated code, what is recommneded?
      Translate
        sindhug14537977
        sindhug14537977
        Level 2
        Nov 30, 2018 7:44 PM UTC

        we upgraded our project from 6.3 to 6.4 and we have few components using JSP's yet.

        we are facing the same issue. please let me know if you found a solution to this.

        Thank You!

        Translate
          Jt_Jayati
          Jt_JayatiAuthor
          Level 2
          Mar 7, 2017 7:00 AM UTC
                  Thanks, but acs commons also uses the deprecated api com.adobe.granite.xss.XSSAPI internally :(
          Translate
            Daniel_H__A__Li
            Daniel_H__A__Li
            Level 2
            Mar 15, 2017 8:52 AM UTC

            Hi, Jayati.

            How about adapting the sling request to org.apache.sling.xss.XSSAPI?

            import org.apache.sling.xss.XSSAPI; import org.apache.sling.api.SlingHttpServletRequest; // (...) // request is an instance of SlingHttpServletRequest XSSAPI xssapi = request.adaptTo(XSSAPI.class); String encodedAttr = xssapi.encodeForHTMLAttr(someUnsafeValue);

            ?

            I believe I've seen something similar in XSSRuntimeExtension.obtainAPI().

            Regards,

            Daniel.

            Translate
              kautuk_sahni
              kautuk_sahni
              Employee
              Mar 7, 2017 6:44 AM UTC

              Hi

              Check this community article :-

              Link:- https://adobe-consulting-services.github.io/acs-aem-commons/features/xss-functions.html

              // This covers simple JSP EL functions for XSS protection using the XSSAPI service provided by AEM.

                  Add taglib declaration: <%@ taglib prefix="xss" uri="http://www.adobe.com/consulting/acs-aem-commons/xss" %>

              Example
              <%@include file="/libs/foundation/global.jsp"%><%
              %><%@ taglib prefix="xss" uri="http://www.adobe.com/consulting/acs-aem-commons/xss" %>
              ${xss:encodeForHTMLAttr(xssAPI, 'hi"')}

              I hope this would help you.

              ~kautuk

              Translate
              Kautuk Sahni
              diptinarang
              diptinarang
              Level 3
              Mar 6, 2017 8:17 AM UTC

              I am facing the same issue, any pointers from anyone?

              Translate
                Terms & ConditionsAccessibility statement

                Loading footer...