XSSAPI in AEM 6.2 | Community
Skip to main content
Jt_Jayati
Jt_Jayati
Level 2
March 3, 2017

XSSAPI in AEM 6.2

  • March 3, 2017
  • 7 replies
  • 16418 views

In AEM 6.2 com.adobe.granite.xss.XSSAPI is deprecated and use of org.apache.sling.xss.XSSAPI is suggested, however cq:defineObjects in http://www.day.com/taglibs/cq/1.0 still uses the deprecated one.

Is there any new taglib version which i need to use in my global.jsp?

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

    7 replies

    diptinarang
    diptinarang
    Level 3
    March 6, 2017

    I am facing the same issue, any pointers from anyone?

      kautuk_sahni
      Community Manager
      kautuk_sahniCommunity Manager
      Community Manager
      March 7, 2017

      Hi

      Check this community article :-

      Link:- https://adobe-consulting-services.github.io/acs-aem-commons/features/xss-functions.html

      // This covers simple JSP EL functions for XSS protection using the XSSAPI service provided by AEM.

          Add taglib declaration: <%@ taglib prefix="xss" uri="http://www.adobe.com/consulting/acs-aem-commons/xss" %>

      Example
      <%@include file="/libs/foundation/global.jsp"%><%
      %><%@ taglib prefix="xss" uri="http://www.adobe.com/consulting/acs-aem-commons/xss" %>
      ${xss:encodeForHTMLAttr(xssAPI, 'hi"')}

      I hope this would help you.

      ~kautuk

      Kautuk Sahni
      Jt_Jayati
      Jt_JayatiAuthor
      Level 2
      March 7, 2017
              Thanks, but acs commons also uses the deprecated api com.adobe.granite.xss.XSSAPI internally :(
        Daniel_H__A__Li
        Daniel_H__A__Li
        Level 2
        March 15, 2017

        Hi, Jayati.

        How about adapting the sling request to org.apache.sling.xss.XSSAPI?

        import org.apache.sling.xss.XSSAPI; import org.apache.sling.api.SlingHttpServletRequest; // (...) // request is an instance of SlingHttpServletRequest XSSAPI xssapi = request.adaptTo(XSSAPI.class); String encodedAttr = xssapi.encodeForHTMLAttr(someUnsafeValue);

        ?

        I believe I've seen something similar in XSSRuntimeExtension.obtainAPI().

        Regards,

        Daniel.

          Jt_Jayati
          Jt_JayatiAuthor
          Level 2
          March 16, 2017
          Yes that's a solution to be done in global.jsp , or below one , as API itself provides thi function: XSSAPI xssapi = sling.getService(XSSAPI.class).getRequestSpecificAPI(slingRequest); but with both these solutions we get an error of "duplicate JSP variable", and so we need to assign it to some other variable like "slingXSSAPI", and here comes the overhead of changing all the occurences of this variable in good amount of files. This is do-able but if things are later-on updated in cq taglibraries's definedObjects then we need to revert to actual variable again for all occurences. So is it fine to keep using the deprecated import which cq taglib is using, or no matter what cq taglibrary is using we should never go ahead with deprecated code, what is recommneded?
            sindhug14537977
            sindhug14537977
            Level 2
            November 30, 2018

            we upgraded our project from 6.3 to 6.4 and we have few components using JSP's yet.

            we are facing the same issue. please let me know if you found a solution to this.

            Thank You!

              smacdonald2008
              smacdonald2008
              Level 10
              March 16, 2017

              What type of component are you building - are you using HTL (Sightly) or JSP. 

              Jt_Jayati
              Jt_JayatiAuthor
              Level 2
              March 16, 2017
                      JSPs.
                Sachin_Arora_
                Community Advisor
                Sachin_Arora_Community Advisor
                Community Advisor
                May 22, 2018

                We are currently using ACS commons deprecated taglib. The only solution I can think is of creating a custom tag library(for the time being we are having JSPs) exposing all methods as ACS taglib but using Sling XSSAPI internally. It will require change in only global.jsp. Also HTL global object xssAPI is of deprecated XSSAPI as mentioned here : https://helpx.adobe.com/experience-manager/htl/using/global-objects.html

                  Terms & ConditionsAccessibility statement

                  Loading footer...