You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2017/11/07 10:25:34 UTC

[sling-org-apache-sling-xss] annotated tag org.apache.sling.xss-1.0.16 created (now ffc5e76)

This is an automated email from the ASF dual-hosted git repository.

rombert pushed a change to annotated tag org.apache.sling.xss-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git.


      at ffc5e76  (tag)
 tagging 938c641ae3f157cdcc8ff49fe1157e78fe790722 (commit)
      by Radu Cotescu
      on Tue Oct 18 12:25:43 2016 +0000

- Log -----------------------------------------------------------------
org.apache.sling.xss-1.0.16
-----------------------------------------------------------------------

This annotated tag includes the following new commits:

     new ce57411  SLING-4705 - Move the XSS Protection bundle from contrib to bundles
     new a1132dc  SLING-4525 - XSS protection path mangling issue
     new 7a68e9d  SLING-4557 - Add JSON and XML validation to the XSS Protection API
     new 20f10ec  Update svn:ignore
     new a860112  SLING-4584 - Performance: XSSAPI.getValidHref should not be based on HTML filtering
     new dc7f8be  Update to Sling Parent 23
     new 978acab  Remove superflous sling.java.version=6 as it's the default now
     new f889940  set parent version to 24 and add empty relativePath where missing
     new 54e898d  SLING-4403 - XSS Configuration should allow caption tags
     new b9c2df5  SLING-4584 - Performance: XSSAPI.getValidHref should not be based on HTML filtering
     new cb9c2a4  trivial: corrected JavaDoc for Java 1.8
     new f9008d3  trivial: updated README
     new b158317  [maven-release-plugin] prepare release org.apache.sling.xss-1.0.4
     new 8db0e9d  [maven-release-plugin] prepare for next development iteration
     new ee2a195  SLING-5050 - Disable AntiSamy's default formatOutput policy directive
     new d615480  Update the main reactor to parent 25
     new e511cf5  [maven-release-plugin] prepare release org.apache.sling.xss-1.0.6
     new 2ca29b7  [maven-release-plugin] prepare for next development iteration
     new d490141  Switch to parent pom 26
     new 58f95b8  SLING-5445 - XSSAPI#encodeForJSString is too restrictive
     new 9ad75d5  [maven-release-plugin] prepare release org.apache.sling.xss-1.0.8
     new 81b6a22  [maven-release-plugin] prepare for next development iteration
     new f9befd2  SLING-5761 - adding double validator
     new 90a82b3  SLING-5761 add Double XSS validator
     new 3dcd697  SLING-5946 - XSSAPI#encodeForJSString is not restrictive enough
     new 1e6db49  [maven-release-plugin] prepare release org.apache.sling.xss-1.0.10
     new fbce7ca  [maven-release-plugin] prepare for next development iteration
     new ff79a08  SLING-5954 - Disable non-essential features in XML parser
     new 0475ee4  [maven-release-plugin] prepare release org.apache.sling.xss-1.0.12
     new 75b8266  [maven-release-plugin] prepare for next development iteration
     new eaaefc6  SLING-4560 - XSSAPI#getValidHref is empty for valid Bengali or Hindi characters
     new d8f3be2  Add a Include-Resource statement for LICENSE and NOTICE so that the binary jar contains the proper META-INF/LICENSE and META-INF/NOTICE files from the root.
     new 630d022  SLING-4560 - XSSAPI#getValidHref is empty for valid Bengali or Hindi characters
     new 3d4c9b0  SLING-6010 - Correctly include LICENSE and NOTICE files in both source and binary jars
     new f8c28f3  [maven-release-plugin] prepare release org.apache.sling.xss-1.0.14
     new 7c53498  [maven-release-plugin] prepare for next development iteration
     new 732f2ee  SLING-6007 : XSSFilterImpl should move to new ResourceChangeListener API . Apply slightly modified patch from abdul hameed pathan
     new ff35965  SLING-6007 - XSSFilterImpl should move to new ResourceChangeListener API
     new 35b927f  SLING-5234 - Remove getAdministrativeResourceResolver() usage from org.apache.sling.xss
     new 8bebfb8  [maven-release-plugin] prepare release org.apache.sling.xss-1.0.16
     new 938c641  [maven-release-plugin] copy for tag org.apache.sling.xss-1.0.16

The 41 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


-- 
To stop receiving notification emails like this one, please contact
['"commits@sling.apache.org" <co...@sling.apache.org>'].

[sling-org-apache-sling-xss] 06/06: [maven-release-plugin] copy for tag org.apache.sling.xss-1.0.16

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.xss-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git

commit 938c641ae3f157cdcc8ff49fe1157e78fe790722
Author: Radu Cotescu <ra...@apache.org>
AuthorDate: Tue Oct 18 12:25:43 2016 +0000

    [maven-release-plugin] copy for tag org.apache.sling.xss-1.0.16
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.xss-1.0.16@1765427 13f79535-47bb-0310-9956-ffa450edef68

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-xss] 01/06: [maven-release-plugin] prepare for next development iteration

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.xss-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git

commit 7c534989d413f1f6600fc93d1ba35cf4c5699638
Author: Radu Cotescu <ra...@apache.org>
AuthorDate: Thu Aug 25 15:49:54 2016 +0000

    [maven-release-plugin] prepare for next development iteration
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss@1757717 13f79535-47bb-0310-9956-ffa450edef68
---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index b3afb6e..88ee33c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,7 +32,7 @@
     <!-- ======================================================================= -->
     <artifactId>org.apache.sling.xss</artifactId>
     <packaging>bundle</packaging>
-    <version>1.0.14</version>
+    <version>1.0.15-SNAPSHOT</version>
 
     <name>Apache Sling XSS Protection Bundle</name>
     <description>
@@ -40,9 +40,9 @@
     </description>
 
     <scm>
-        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/tags/org.apache.sling.xss-1.0.14</connection>
-        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.xss-1.0.14</developerConnection>
-        <url>http://svn.apache.org/viewvc/sling/tags/org.apache.sling.xss-1.0.14</url>
+        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss</connection>
+        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss</developerConnection>
+        <url>http://svn.apache.org/viewvc/sling/trunk/bundles/extensions/xss</url>
     </scm>
 
 

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-xss] 05/06: [maven-release-plugin] prepare release org.apache.sling.xss-1.0.16

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.xss-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git

commit 8bebfb85c55f6c5128f53b6b9cb119de5c3d4e9a
Author: Radu Cotescu <ra...@apache.org>
AuthorDate: Tue Oct 18 12:25:30 2016 +0000

    [maven-release-plugin] prepare release org.apache.sling.xss-1.0.16
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss@1765426 13f79535-47bb-0310-9956-ffa450edef68
---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 0e62572..edc1bc6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,7 +32,7 @@
     <!-- ======================================================================= -->
     <artifactId>org.apache.sling.xss</artifactId>
     <packaging>bundle</packaging>
-    <version>1.0.15-SNAPSHOT</version>
+    <version>1.0.16</version>
 
     <name>Apache Sling XSS Protection Bundle</name>
     <description>
@@ -40,9 +40,9 @@
     </description>
 
     <scm>
-        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss</connection>
-        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss</developerConnection>
-        <url>http://svn.apache.org/viewvc/sling/trunk/bundles/extensions/xss</url>
+        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/tags/org.apache.sling.xss-1.0.16</connection>
+        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.xss-1.0.16</developerConnection>
+        <url>http://svn.apache.org/viewvc/sling/tags/org.apache.sling.xss-1.0.16</url>
     </scm>
 
 

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-xss] 04/06: SLING-5234 - Remove getAdministrativeResourceResolver() usage from org.apache.sling.xss

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.xss-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git

commit 35b927fb68146a0d4b22bb7e5dc6bcd1c0272464
Author: Radu Cotescu <ra...@apache.org>
AuthorDate: Mon Oct 17 16:58:30 2016 +0000

    SLING-5234 - Remove getAdministrativeResourceResolver() usage from org.apache.sling.xss
    
    * switched to using a newly defined service user (sling-xss) that has read-only access for
    {/libs,/apps}/sling/xss
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss@1765343 13f79535-47bb-0310-9956-ffa450edef68
---
 .../java/org/apache/sling/xss/impl/XSSFilterImpl.java     | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
index eb6da7d..098bbad 100644
--- a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
+++ b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
@@ -19,6 +19,7 @@ package org.apache.sling.xss.impl;
 import java.io.InputStream;
 import java.util.Arrays;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
@@ -71,6 +72,7 @@ public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, Externa
 
     public static final String DEFAULT_POLICY_PATH = "sling/xss/config.xml";
     private static final String EMBEDDED_POLICY_PATH = "SLING-INF/content/config.xml";
+    private static final String SLING_XSS_USER = "sling-xss";
     private static final int DEFAULT_POLICY_CACHE_SIZE = 128;
     private PolicyHandler defaultHandler;
     private Attribute hrefAttribute;
@@ -119,10 +121,13 @@ public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, Externa
 
     private synchronized void updateDefaultHandler() {
         this.defaultHandler = null;
-        ResourceResolver adminResolver = null;
+        ResourceResolver xssResourceResolver = null;
         try {
-            adminResolver = resourceResolverFactory.getAdministrativeResourceResolver(null);
-            Resource policyResource = adminResolver.getResource(DEFAULT_POLICY_PATH);
+            Map<String, Object> authenticationInfo = new HashMap<String, Object>() {{
+                put(ResourceResolverFactory.SUBSERVICE, SLING_XSS_USER);
+            }};
+            xssResourceResolver = resourceResolverFactory.getServiceResourceResolver(authenticationInfo);
+            Resource policyResource = xssResourceResolver.getResource(DEFAULT_POLICY_PATH);
             if (policyResource != null) {
                 try (InputStream policyStream = policyResource.adaptTo(InputStream.class)) {
                     setDefaultHandler(new PolicyHandler(policyStream));
@@ -159,8 +164,8 @@ public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, Externa
         } catch (LoginException e) {
             LOGGER.error("Unable to load the default policy file.", e);
         } finally {
-            if (adminResolver != null) {
-                adminResolver.close();
+            if (xssResourceResolver != null) {
+                xssResourceResolver.close();
             }
         }
     }

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-xss] 02/06: SLING-6007 : XSSFilterImpl should move to new ResourceChangeListener API . Apply slightly modified patch from abdul hameed pathan

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.xss-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git

commit 732f2ee049d6fed561c9b3550f14d16a3d7220ff
Author: Carsten Ziegeler <cz...@apache.org>
AuthorDate: Thu Sep 22 13:45:41 2016 +0000

    SLING-6007 : XSSFilterImpl should move to new ResourceChangeListener API . Apply slightly modified patch from abdul hameed pathan
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss@1761969 13f79535-47bb-0310-9956-ffa450edef68
---
 pom.xml                                            | 17 ++++-------
 .../org/apache/sling/xss/impl/XSSFilterImpl.java   | 33 ++++++++++++----------
 2 files changed, 24 insertions(+), 26 deletions(-)

diff --git a/pom.xml b/pom.xml
index 88ee33c..0e62572 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.apache.sling</groupId>
         <artifactId>sling</artifactId>
-        <version>26</version>
+        <version>28</version>
         <relativePath />
     </parent>
 
@@ -236,17 +236,13 @@
 
         <dependency>
             <groupId>javax.servlet</groupId>
-            <artifactId>servlet-api</artifactId>
+            <artifactId>javax.servlet-api</artifactId>
             <scope>provided</scope>
         </dependency>
 
         <dependency>
             <groupId>org.osgi</groupId>
-            <artifactId>org.osgi.core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.osgi</groupId>
-            <artifactId>org.osgi.compendium</artifactId>
+            <artifactId>osgi.core</artifactId>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
@@ -255,7 +251,7 @@
         <dependency>
             <groupId>org.apache.sling</groupId>
             <artifactId>org.apache.sling.api</artifactId>
-            <version>2.2.0</version>
+            <version>2.11.0</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -277,14 +273,13 @@
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-all</artifactId>
-            <version>1.8.4</version>
-            <type>jar</type>
+            <version>1.10.19</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.powermock</groupId>
             <artifactId>powermock-api-mockito</artifactId>
-            <version>1.5.5</version>
+            <version>1.6.5</version>
             <scope>test</scope>
         </dependency>
         <dependency>
diff --git a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
index 23926ec..cfb71d0 100644
--- a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
+++ b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
@@ -19,25 +19,26 @@ package org.apache.sling.xss.impl;
 import java.io.InputStream;
 import java.util.Arrays;
 import java.util.Collections;
+import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Pattern;
 
 import org.apache.felix.scr.annotations.Activate;
 import org.apache.felix.scr.annotations.Component;
+import org.apache.felix.scr.annotations.Properties;
 import org.apache.felix.scr.annotations.Property;
 import org.apache.felix.scr.annotations.Reference;
 import org.apache.felix.scr.annotations.Service;
-import org.apache.sling.api.SlingConstants;
 import org.apache.sling.api.resource.LoginException;
 import org.apache.sling.api.resource.Resource;
 import org.apache.sling.api.resource.ResourceResolver;
 import org.apache.sling.api.resource.ResourceResolverFactory;
+import org.apache.sling.api.resource.observation.ExternalResourceChangeListener;
+import org.apache.sling.api.resource.observation.ResourceChange;
+import org.apache.sling.api.resource.observation.ResourceChangeListener;
 import org.apache.sling.xss.ProtectionContext;
 import org.apache.sling.xss.XSSFilter;
-import org.osgi.service.event.Event;
-import org.osgi.service.event.EventConstants;
-import org.osgi.service.event.EventHandler;
 import org.owasp.validator.html.model.Attribute;
 import org.owasp.validator.html.model.Tag;
 import org.slf4j.Logger;
@@ -48,9 +49,12 @@ import org.slf4j.LoggerFactory;
  * <a href="http://code.google.com/p/owaspantisamy/">http://code.google.com/p/owaspantisamy/</a>.
  */
 @Component(immediate = true)
-@Service(value = {EventHandler.class, XSSFilter.class})
-@Property(name = EventConstants.EVENT_TOPIC, value = {"org/apache/sling/api/resource/Resource/*"})
-public class XSSFilterImpl implements XSSFilter, EventHandler {
+@Service(value = {ResourceChangeListener.class, XSSFilter.class})
+@Properties({
+	@Property(name = ResourceChangeListener.CHANGES, value = {"ADDED","CHANGED", "REMOVED"}),
+    @Property(name = ResourceChangeListener.PATHS, value = {"glob:/**/sling/xss/config.xml", "glob:/sling/xss/config.xml"})
+})
+public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, ExternalResourceChangeListener {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(XSSFilterImpl.class);
 
@@ -81,13 +85,13 @@ public class XSSFilterImpl implements XSSFilter, EventHandler {
     private ResourceResolverFactory resourceResolverFactory = null;
 
     @Override
-    public void handleEvent(final Event event) {
-        final String path = (String) event.getProperty(SlingConstants.PROPERTY_PATH);
-        if (path.endsWith("/" + DEFAULT_POLICY_PATH)) {
-            LOGGER.debug("Detected policy file change at {}. Updating default handler.", path);
-            updateDefaultHandler();
-        }
-    }
+	public void onChange(List<ResourceChange> resourceChanges) {
+		for(ResourceChange change : resourceChanges){
+			LOGGER.debug("Detected policy file change at {}. Updating default handler.", change.getPath());
+			updateDefaultHandler();
+		}
+
+	}
 
     @Override
     public boolean check(final ProtectionContext context, final String src) {
@@ -249,5 +253,4 @@ public class XSSFilterImpl implements XSSFilter, EventHandler {
         }
         return isValid;
     }
-
 }

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-xss] 03/06: SLING-6007 - XSSFilterImpl should move to new ResourceChangeListener API

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.xss-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git

commit ff35965a35913ba99ec15f6df817a59c92b39615
Author: Radu Cotescu <ra...@apache.org>
AuthorDate: Mon Oct 17 16:08:03 2016 +0000

    SLING-6007 - XSSFilterImpl should move to new ResourceChangeListener API
    
    * corrected ResourceChangeListener patterns
    * improved policy loading logic
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/extensions/xss@1765325 13f79535-47bb-0310-9956-ffa450edef68
---
 .../org/apache/sling/xss/impl/XSSFilterImpl.java   | 61 ++++++++++++----------
 1 file changed, 33 insertions(+), 28 deletions(-)

diff --git a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
index cfb71d0..eb6da7d 100644
--- a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
+++ b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
@@ -51,8 +51,8 @@ import org.slf4j.LoggerFactory;
 @Component(immediate = true)
 @Service(value = {ResourceChangeListener.class, XSSFilter.class})
 @Properties({
-	@Property(name = ResourceChangeListener.CHANGES, value = {"ADDED","CHANGED", "REMOVED"}),
-    @Property(name = ResourceChangeListener.PATHS, value = {"glob:/**/sling/xss/config.xml", "glob:/sling/xss/config.xml"})
+    @Property(name = ResourceChangeListener.CHANGES, value = {"ADDED", "CHANGED", "REMOVED"}),
+    @Property(name = ResourceChangeListener.PATHS, value = XSSFilterImpl.DEFAULT_POLICY_PATH)
 })
 public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, ExternalResourceChangeListener {
 
@@ -69,7 +69,8 @@ public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, Externa
             "removeAttribute", ""
     );
 
-    private static final String DEFAULT_POLICY_PATH = "sling/xss/config.xml";
+    public static final String DEFAULT_POLICY_PATH = "sling/xss/config.xml";
+    private static final String EMBEDDED_POLICY_PATH = "SLING-INF/content/config.xml";
     private static final int DEFAULT_POLICY_CACHE_SIZE = 128;
     private PolicyHandler defaultHandler;
     private Attribute hrefAttribute;
@@ -85,13 +86,14 @@ public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, Externa
     private ResourceResolverFactory resourceResolverFactory = null;
 
     @Override
-	public void onChange(List<ResourceChange> resourceChanges) {
-		for(ResourceChange change : resourceChanges){
-			LOGGER.debug("Detected policy file change at {}. Updating default handler.", change.getPath());
-			updateDefaultHandler();
-		}
-
-	}
+    public void onChange(List<ResourceChange> resourceChanges) {
+        for (ResourceChange change : resourceChanges) {
+            if (change.getPath().endsWith(DEFAULT_POLICY_PATH)) {
+                LOGGER.info("Detected policy file change ({}) at {}. Updating default handler.", change.getType().name(), change.getPath());
+                updateDefaultHandler();
+            }
+        }
+    }
 
     @Override
     public boolean check(final ProtectionContext context, final String src) {
@@ -115,37 +117,40 @@ public class XSSFilterImpl implements XSSFilter, ResourceChangeListener, Externa
         updateDefaultHandler();
     }
 
-    private void updateDefaultHandler() {
+    private synchronized void updateDefaultHandler() {
+        this.defaultHandler = null;
         ResourceResolver adminResolver = null;
         try {
             adminResolver = resourceResolverFactory.getAdministrativeResourceResolver(null);
             Resource policyResource = adminResolver.getResource(DEFAULT_POLICY_PATH);
             if (policyResource != null) {
-                InputStream policyStream = policyResource.adaptTo(InputStream.class);
-                if (policyStream != null) {
-                    try {
-                        if (defaultHandler == null) {
-                            setDefaultHandler(new PolicyHandler(policyStream));
-                            policyStream.close();
+                try (InputStream policyStream = policyResource.adaptTo(InputStream.class)) {
+                    setDefaultHandler(new PolicyHandler(policyStream));
+                    LOGGER.info("Installed default policy from {}.", policyResource.getPath());
+                } catch (Exception e) {
+                    Throwable[] suppressed = e.getSuppressed();
+                    if (suppressed.length > 0) {
+                        for (Throwable t : suppressed) {
+                            LOGGER.error("Unable to load policy from " + policyResource.getPath(), t);
                         }
-                    } catch (Exception e) {
-                        LOGGER.error("Unable to load policy from " + policyResource.getPath(), e);
                     }
+                    LOGGER.error("Unable to load policy from " + policyResource.getPath(), e);
                 }
             } else {
                 // the content was not installed but the service is active; let's use the embedded file for the default handler
-                LOGGER.debug("Could not find a policy file at the default location {}. Attempting to use the default resource embedded in" +
+                LOGGER.warn("Could not find a policy file at the default location {}. Attempting to use the default resource embedded in" +
                         " the bundle.", DEFAULT_POLICY_PATH);
-                InputStream policyStream = this.getClass().getClassLoader().getResourceAsStream("SLING-INF/content/config.xml");
-                if (policyStream != null) {
-                    try {
-                        if (defaultHandler == null) {
-                            setDefaultHandler(new PolicyHandler(policyStream));
-                            policyStream.close();
+                try (InputStream policyStream = this.getClass().getClassLoader().getResourceAsStream(EMBEDDED_POLICY_PATH)) {
+                    setDefaultHandler(new PolicyHandler(policyStream));
+                    LOGGER.info("Installed default policy from the embedded {} file from the bundle.", EMBEDDED_POLICY_PATH);
+                } catch (Exception e) {
+                    Throwable[] suppressed = e.getSuppressed();
+                    if (suppressed.length > 0) {
+                        for (Throwable t : suppressed) {
+                            LOGGER.error("Unable to load policy from embedded policy file.", t);
                         }
-                    } catch (Exception e) {
-                        LOGGER.error("Unable to load policy from embedded policy file.", e);
                     }
+                    LOGGER.error("Unable to load policy from embedded policy file.", e);
                 }
             }
             if (defaultHandler == null) {

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.