You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by cz...@apache.org on 2026/07/16 11:09:34 UTC
(sling-org-apache-sling-xss) branch maia/workflow-1784200191777 created (now 9a4438f)
This is an automated email from the ASF dual-hosted git repository.
cziegeler pushed a change to branch maia/workflow-1784200191777
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
at 9a4438f docs: document XSS escaping requirement for web console plugin
This branch includes the following new commits:
new 9a4438f docs: document XSS escaping requirement for web console plugin
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(sling-org-apache-sling-xss) 01/01: docs: document XSS escaping requirement for web console plugin
Posted by cz...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
cziegeler pushed a commit to branch maia/workflow-1784200191777
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit 9a4438f2691b3c15e99012b747871b5c71ceb19d
Author: Carsten Ziegeler <cz...@apache.org>
AuthorDate: Thu Jul 16 13:09:51 2026 +0200
docs: document XSS escaping requirement for web console plugin
Co-authored-by: Maia <ma...@noreply>
---
AGENTS.md | 2 +-
README.md | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/AGENTS.md b/AGENTS.md
index 618d399..ff58921 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,6 +74,7 @@ pom.xml
- Public API (`org.apache.sling.xss`) is versioned via `@Version` in `package-info.java`; increment according to OSGi semantic versioning when changing interfaces.
- ESAPI, Batik, and owasp-html-sanitizer are embedded via `bnd.bnd` private packages — do not add OSGi `Import-Package` for them.
- Invalid href metrics are emitted via `XSSMetricsService` and `org.apache.sling.commons.metrics` when a `MetricsService` is available (optional dynamic DS reference).
+- In the web console plugin, always HTML-escape request-derived values (for example `consoleRoot`) before interpolating into markup (`StringEscapeUtils.escapeHtml4`).
- Formatting is enforced by Spotless (inherited from `sling-bundle-parent`). Run `mvn spotless:apply` before committing.
- 4-space indentation, no wildcard imports in non-generated code.
- License header required on every source file (enforced by Apache RAT).
@@ -108,4 +109,3 @@ pom.xml
<!-- sling-security-default:start -->
The threat model for this project is https://github.com/apache/sling/blob/master/docs/threat-model.md .
<!-- sling-security-default:end -->
-
diff --git a/README.md b/README.md
index 1c044d4..d14d3fd 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,7 @@ See the JavaDoc of each service for the complete API surface.
- Uses `owasp-java-html-sanitizer` for HTML sanitization.
- Embeds ESAPI, Batik CSS, and HTML sanitizer packages as private bundle packages to avoid OSGi import conflicts.
- Includes optional invalid-href metrics integration via Sling Commons Metrics.
+- Web console rendering escapes request-derived values (for example `consoleRoot`) before interpolation to prevent XSS in the plugin UI.
- Excludes legacy/conflicting transitive logging dependencies such as `commons-logging` and does not depend on Log4j 1.x.
## Build and test