XSSAPI in AEM 6.2

[Jt_Jayati]

In AEM 6.2 com.adobe.granite.xss.XSSAPI is deprecated and use of org.apache.sling.xss.XSSAPI is suggested, however cq:defineObjects in http://www.day.com/taglibs/cq/1.0 still uses the deprecated one.

Is there any new taglib version which i need to use in my global.jsp?

[diptinarang]

I am facing the same issue, any pointers from anyone?

[kautuk_sahni]

Hi

Check this community article :-

Link:- https://adobe-consulting-services.github.io/acs-aem-commons/features/xss-functions.html

// This covers simple JSP EL functions for XSS protection using the XSSAPI service provided by AEM.

    Add taglib declaration: <%@ taglib prefix="xss" uri="http://www.adobe.com/consulting/acs-aem-commons/xss" %>

Example
<%@include file="/libs/foundation/global.jsp"%><%
%><%@ taglib prefix="xss" uri="http://www.adobe.com/consulting/acs-aem-commons/xss" %>
${xss:encodeForHTMLAttr(xssAPI, 'hi"')}

I hope this would help you.

~kautuk

[Jt_Jayati]

        Thanks, but acs commons also uses the deprecated api com.adobe.granite.xss.XSSAPI internally :(

[Daniel_H__A__Li]

Hi, Jayati.

How about adapting the sling request to org.apache.sling.xss.XSSAPI?

import org.apache.sling.xss.XSSAPI; import org.apache.sling.api.SlingHttpServletRequest; // (...) // request is an instance of SlingHttpServletRequest XSSAPI xssapi = request.adaptTo(XSSAPI.class); String encodedAttr = xssapi.encodeForHTMLAttr(someUnsafeValue);

?

I believe I've seen something similar in XSSRuntimeExtension.obtainAPI().

Regards,

Daniel.

[Jt_Jayati]

Yes that's a solution to be done in global.jsp , or below one , as API itself provides thi function: XSSAPI xssapi = sling.getService(XSSAPI.class).getRequestSpecificAPI(slingRequest); but with both these solutions we get an error of "duplicate JSP variable", and so we need to assign it to some other variable like "slingXSSAPI", and here comes the overhead of changing all the occurences of this variable in good amount of files. This is do-able but if things are later-on updated in cq taglibraries's definedObjects then we need to revert to actual variable again for all occurences. So is it fine to keep using the deprecated import which cq taglib is using, or no matter what cq taglibrary is using we should never go ahead with deprecated code, what is recommneded?

[sindhug14537977]

we upgraded our project from 6.3 to 6.4 and we have few components using JSP's yet.

we are facing the same issue. please let me know if you found a solution to this.

Thank You!

[smacdonald2008]

What type of component are you building - are you using HTL (Sightly) or JSP. 

[Jt_Jayati]

        JSPs.

[Sachin_Arora_]

We are currently using ACS commons deprecated taglib. The only solution I can think is of creating a custom tag library(for the time being we are having JSPs) exposing all methods as ACS taglib but using Sling XSSAPI internally. It will require change in only global.jsp. Also HTL global object xssAPI is of deprecated XSSAPI as mentioned here : https://helpx.adobe.com/experience-manager/htl/using/global-objects.html