xss protection in AEM

[jakej40603950]

Is AEM completely xss secure. I know using HTL makes sure that you're protected from xss. But what about ajax calls? Responses returned from Servlets?

In other words, are there areas or flows where it's up to the site developer to implement xss protection mechanisms?

Thanks.

[hamidk92094312]

Please read relevant documentation: Security

[jakej40603950]

Thanks Hamid. The documentation doesn't answer question raised in the original post. i.e. If a servlet is expected to return HTML content, should we (the site developer) be using AntiSamy API to filter out problematic content? Or is that already addressed somewhere in AEM request / response chain?

[Jaideep_Brar]

I would request you to check OOTB servlets and write the custom code accordingly. As long as you are using OOTB API's , the code will be XSS protected.

Also, If you go to [1], you can see all the XSS rules defined . If you are using anything custom, you can overlay this file under /apps and make the neccassary changes.

[1] /libs/cq/xssprotection/config.xml

[DPrakashRaj]

you can also use XSSAPI class to implement your own custom rules for security. For Details

XSSAPI ("The Adobe AEM Quickstart and Web Application.")

[arunpatidar]

HTL is XSS protected until you don't use an unsafe context.

If you are rendering DOM based on form parameter then you have to be careful.

Make sure you encode all the request parameter values before use in the form

There are some practical example

5 Practical Scenarios for XSS Attacks | Pentest-Tools.com Blog

[Jörg_Hoh · Accepted solution]

When you implement servlets, you have to ensure that your code emits safe output (you can use the slingXSSApi [1] for this). HTL scripts are safe unless you explicitly use the unsafe context.

[1] XSSAPI (Apache Sling 11 API)

[jakej40603950]

Thanks. This is what I was looking for thank you