CQ External component 'adaptive' inclusion mode

[sneakybeaky]

Hi,

In CQ 5.5 the external component allowed inclusion of 3rd party content rendered in the same CQ page using 'adaptive' inclusion mode - as described here. However, it looks like this has been removed in CQ 5.6.1 - the same component just has the iframe mode as described here.

However, the underlying Java class that pulled in the external content for adaptive mode is still in the cq-wcm-foundation jar - com.day.cq.wcm.foundation.impl.Rewriter.

So my question is :

1. Why was adaptive inclusion mode removed from the External component ?

2. Should we not replicate the behaviour ourselves ? It seems like a good alternative to iFrames for 3rd party web site inclusion.

Jon.

[Sham_HC · Accepted solution]

Adaptive mode basically puts a "do what you like" tool in the hands of an average author who can use it to add unfiltered, unencoded markup to an otherwise controlled environment - this makes a site susceptible to XSS, phishing, clickjacking and more attacks. even if the author is considered internal, a compromised 3rd party system embedded via external component can add the same risks. These issues were discussed at length between EM and PM, and the security concerns led to the final decision to disable adaptive mode.