You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Carsten Ziegeler (Jira)" <ji...@apache.org> on 2020/09/10 12:14:00 UTC
[jira] [Commented] (SLING-9721) Make XSSApi more generable usable
and avoid dependency to ResourceResolver
[ https://issues.apache.org/jira/browse/SLING-9721?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17193577#comment-17193577 ]
Carsten Ziegeler commented on SLING-9721:
-----------------------------------------
I think we should go with an OSGi configuration - even if the value of the OSGi configuration property would be an XML file.
So my suggestion is:
* we change the xssapi bundle to be configurable through an OSGi property.
* we move out all resource listing etc to a separate bundle - that bundle can then dynamically update the OSGi configuration based on the file in the repository
We should also create another issue for the feature model to support a xssapi config extension containing the XML. (together with SLING-9725) the xss api config can then be authored as an XML file, included in a feature model extension. At runtime the value of the extension will be fed into the OSGi configuration of the service, similar to what we do with repoinit.
> Make XSSApi more generable usable and avoid dependency to ResourceResolver
> --------------------------------------------------------------------------
>
> Key: SLING-9721
> URL: https://issues.apache.org/jira/browse/SLING-9721
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Carsten Ziegeler
> Priority: Major
>
> Currently the xssapi requires a resource resolver factory as there might be the option to read the configuration from the repository.
> Unfortunately this prevents from using the xssapi in situations where the resource resolver is not available (yet).
> Having a dynamic configuration for this service is probably not really required, so we could move that support out to an optional bundle.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)