Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
Bedrock Mission!

Learn more

View all

Sign in to view all badges

SOLVED

xss protection in AEM

Avatar

Level 5

Is AEM completely xss secure. I know using HTL makes sure that you're protected from xss. But what about ajax calls? Responses returned from Servlets?

In other words, are there areas or flows where it's up to the site developer to implement xss protection mechanisms?

Thanks.

1 Accepted Solution

Avatar

Correct answer by
Employee Advisor

When you implement servlets, you have to ensure that your code emits safe output (you can use the slingXSSApi [1] for this). HTL scripts are safe unless you explicitly use the unsafe context.

[1] XSSAPI (Apache Sling 11 API)

View solution in original post

0 Replies

Avatar

Level 5

Thanks Hamid. The documentation doesn't answer question raised in the original post. i.e. If a servlet is expected to return HTML content, should we (the site developer) be using AntiSamy API to filter out problematic content? Or is that already addressed somewhere in AEM request / response chain?

Avatar

Employee Advisor

I would request you to check OOTB servlets and write the custom code accordingly. As long as you are using OOTB API's , the code will be XSS protected.

Also, If you go to [1], you can see all the XSS rules defined . If you are using anything custom, you can overlay this file under /apps and make the neccassary changes.

[1] /libs/cq/xssprotection/config.xml

Avatar

Level 2

you can also use XSSAPI class to implement your own custom rules for security. For Details

XSSAPI ("The Adobe AEM Quickstart and Web Application.")

Avatar

Community Advisor

HTL is XSS protected until you don't use an unsafe context.

If you are rendering DOM based on form parameter then you have to be careful.

Make sure you encode all the request parameter values before use in the form

There are some practical example

5 Practical Scenarios for XSS Attacks | Pentest-Tools.com Blog

Avatar

Correct answer by
Employee Advisor

When you implement servlets, you have to ensure that your code emits safe output (you can use the slingXSSApi [1] for this). HTL scripts are safe unless you explicitly use the unsafe context.

[1] XSSAPI (Apache Sling 11 API)

Avatar

Level 5

Thanks. This is what I was looking for thank you