How XSS Protection works in AEMaaCS?

[vkarthick]

Lets say, I have  anti-samy-rules configuration in AEM on premise environment how do i migrate to AEMaaCS?

Does AEMaaCS will take care xss protection??

[EstebanBustamante · Accepted solution]

I haven't heard that AEMaaCS has changed the way it protects against XSS, by default there is a set of AntySamy rules that is based on the OWASP recommendation, this list is located under /libs/cq/xssprotection/config.xml

So, if you have customized this list via an overlay, you should have your new AnySamy config in /apps/cq/xssprotection/config.xml, as long as this is part of your codebase, this will be deployed and used by AEMaaCS. 

You can find more info here:

https://experienceleague.adobe.com/docs/experience-manager-65/developing/introduction/security.html?... 

https://blogs.perficient.com/2022/10/04/how-good-is-your-aem-security-xss/ 

[vkarthick]

@EstebanBustamante , After implementing it how to test it for confirmation ?

[EstebanBustamante]

I suppose you can test a couple of your custom rules. The customizations I have made in the past were related to allowing certain characters in specific tags' attributes. In my particular case, I was able to test by ensuring that those characters were not stripped out in the resulting HTML. Please be aware that these rules are evaluated by HTL (formerly Sightly). So, my test simply involved writing the characters in an HTML file and then checking if they appeared on the page.

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/xss-protection-in-aem/m-p/...

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/how-to-overlay-libs-cq-xss... 

[vkarthick]

@EstebanBustamante , Thank for your impactful insight!

[snbaemnf]

@EstebanBustamante Once we overlay, does this mean we need to keep it up to date with the libs file in case there are new updates to the OOTB file via automated sdk updates?