AEM 6.5 Sonar Do not use Sling servlet paths to register servlet | Community
Skip to main content
S
Sai1278
Level 3
September 22, 2024
Solved

AEM 6.5 Sonar Do not use Sling servlet paths to register servlet

  • September 22, 2024
  • 2 replies
  • 1289 views

Hi Adobe Team,

I am facing an issue with the servlet class below. It works as expected, but in SonarQube, I'm receiving the warning like "Do not use Sling servlet paths to register servlet"
1,2,3 servlet's

@Component(service = Servlet.class, property = {
        Constants.SERVICE_DESCRIPTION + "= information and create data",
        "sling.servlet.paths=" + "/bin/userdata", "sling.servlet.methods=" + HttpConstants.METHOD_GET })

@Component(service = { Servlet.class }, property = { "sling.servlet.paths=/bin/api/removedata",
      "sling.servlet.selectors={sampledata, removedata}", "sling.servlet.methods=GET" })
@ServiceDescription("API to remove data")
@Component(service = { Servlet.class }, property = { "sling.servlet.paths=/bin/api/uploaddata",
        "sling.servlet.methods=POST" })

Could you please provide some guidelines on how to fix this issue?


Thanks,
Sai

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by B_Sravan

Hi @sai1278,

The SonarQube warning you're encountering about avoiding Sling servlet paths (sling.servlet.paths) to register servlets stems from best practices in Adobe Experience Manager (AEM). The recommendation is to use sling.servlet.resourceTypes instead of hardcoded paths, as hardcoding paths can introduce security risks and complicate servlet management.

As you're dealing with data operations (which might not involve page rendering), you might wonder how to apply resourceTypes when you're not handling a page load or resource rendering.

Here's an approach to solve this:

Creating Service Nodes

You can create service nodes specifically for your data operations, for example:

  • /content/projectname/services/user-data
  • /content/projectname/services/remove
  • /content/projectname/services/upload-data

Each of these nodes should have a sling:resourceType property, which you can then reference in your servlet registration.

This way, you can still call your servlets based on resourceType rather than using hardcoded paths, adhering to best practices.

@8220494(service = Servlet.class) @SlingServletResourceTypes( resourceTypes = "projectname/services/user-data", // Define the resource type methods = "GET" // Define the HTTP method ) public class UserDataServlet extends SlingAllMethodsServlet {

 

This method not only follows best practices but also enhances security and maintainability.

To align with modern development practices, consider using the latest annotations to register your servlet. More details can be found here:
Registering a Servlet using Java Annotations.

- Sravan

2 replies

B_Sravan
Community Advisor
B_SravanCommunity AdvisorAccepted solution
Community Advisor
September 22, 2024

Hi @sai1278,

The SonarQube warning you're encountering about avoiding Sling servlet paths (sling.servlet.paths) to register servlets stems from best practices in Adobe Experience Manager (AEM). The recommendation is to use sling.servlet.resourceTypes instead of hardcoded paths, as hardcoding paths can introduce security risks and complicate servlet management.

As you're dealing with data operations (which might not involve page rendering), you might wonder how to apply resourceTypes when you're not handling a page load or resource rendering.

Here's an approach to solve this:

Creating Service Nodes

You can create service nodes specifically for your data operations, for example:

  • /content/projectname/services/user-data
  • /content/projectname/services/remove
  • /content/projectname/services/upload-data

Each of these nodes should have a sling:resourceType property, which you can then reference in your servlet registration.

This way, you can still call your servlets based on resourceType rather than using hardcoded paths, adhering to best practices.

@8220494(service = Servlet.class) @SlingServletResourceTypes( resourceTypes = "projectname/services/user-data", // Define the resource type methods = "GET" // Define the HTTP method ) public class UserDataServlet extends SlingAllMethodsServlet {

 

This method not only follows best practices but also enhances security and maintainability.

To align with modern development practices, consider using the latest annotations to register your servlet. More details can be found here:
Registering a Servlet using Java Annotations.

- Sravan

    SureshDhulipudi
    Community Advisor
    SureshDhulipudiCommunity Advisor
    Community Advisor
    September 23, 2024
    @Component(service = Servlet.class, property = {
            Constants.SERVICE_DESCRIPTION + "= information and create data",
            "sling.servlet.paths=" + "/bin/userdata", "sling.servlet.methods=" + HttpConstants.METHOD_GET })

     

     

    ==

    @8220494(service = Servlet.class, property = {
    Constants.SERVICE_DESCRIPTION + "= information and create data",
    "sling.servlet.paths=" + "/bin/userdata", "sling.servlet.methods=" + HttpConstants.METHOD_GET })

    change to resourceType like below:

    @8220494(service = Servlet.class, property = {
    Constants.SERVICE_DESCRIPTION + "= information and create data",
    "sling.servlet.resourceTypes=" + "sling/servlet/default",
    "sling.servlet.selectors=" + "userdata",
    "sling.servlet.extension=" + "json",
    "sling.servlet.methods=" + HttpConstants.METHOD_GET
    }) 

     

    to invoke the servlet in your sightly or javascript or Ajax call, you have to use below : your project path and resourceType and Extn example below:

     

    url: /content/<your-project>/<projectname>.userdata.json

     

    this will invoke the resourceType servlet.

     

    If you have to invoke POST method servlet - you have to use or update CSRF filter configuration (Adobe Granite CSRF filter) 

      Terms & ConditionsAccessibility statement

      Loading footer...