OGGI value not reading inside src tag of a iframe .

[djohn98390536]

I hv a requirement to read the OSGI value in sightly. It is working as expected in my local but not working when I deployed to the Dev server. Please find the below code to help to solve the issue.

<sly data-sly-use.config="com.demo.common.DemoModel" />
${config.configValue}  (This is working outside of src tag OSGI config value is reading)
<div class="iframe-div">
<iframe width="100%" height="300" src="${config.configValue}"></iframe>(Inside src tag not reading OSGI config value)
<div>
Thanks,

[Saravanan_Dharmaraj · Accepted solution]

@djohn98390536 Could you try the below by adding the context. 

src="${config.configValue @context='html'}"

Please check the similar post

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/htl-html-context-removes-a...

[djohn98390536]

thanks a lot it is working as expected.

[tusharbias]

HTL in AEM provides built-in security measures to protect against cross-site scripting (XSS) vulnerabilities. When outputting dynamic content in HTML, HTL automatically identifies the context in which the content will be displayed and escapes it appropriately to prevent potential security risks.

However, there are cases where you may need to override the default context handling to ensure proper security. Here are some options to customize the context handling in HTL:

1. Use @CONTEXT='html': This outputs HTML content and removes any markup that may pose XSS risks.

2. Use @CONTEXT='text': For simple HTML content, this option encodes all HTML tags to prevent any potential security issues.

3. Use @CONTEXT='uri': For handling URIs, this option ensures that the value does not contain any XSS risks. This might be the option you are looking for.

4. Use @CONTEXT='scriptToken': This handles JavaScript tokens and outputs nothing if the value doesn't correspond to a valid JavaScript token.

5. Use @CONTEXT='scriptString': Applies JavaScript string escaping for secure output.

6. Use @CONTEXT='scriptComment': For JavaScript block comments, this context ensures that the value cannot break out of the comment context.

7. Use @CONTEXT='scriptRegExp': For JavaScript regular expressions, this option applies proper escaping.

8. Use @CONTEXT='styleToken': Handles CSS tokens and ensures that the output adheres to valid CSS syntax.

9. Use @CONTEXT='styleComment': For CSS comments, this context prevents any attempts to break out of the comment context.

10. Use @CONTEXT='comment': Applies HTML comment escaping for secure output.

11. Use @CONTEXT='number': Outputs zero if the value is not a valid number.

12. Use @CONTEXT='unsafe': Caution! This option disables XSS protection completely and should only be used when you fully understand the potential risks. However, it is not recommended option. 

By selecting the appropriate context option based on the specific use case, you can ensure that HTL provides secure and sanitized output, protecting your application from XSS vulnerabilities. Refer https://github.com/adobe/htl-spec/blob/master/SPECIFICATION.md#121-display-context for complete list of context available. 

[djohn98390536]

@tusharbias thanks a lot