You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2022/05/20 10:16:57 UTC
[sling-org-apache-sling-xss] branch issue/SLING-11326 created (now 26b1b4d)
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a change to branch issue/SLING-11326
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
at 26b1b4d SLING-11326 - Deprecate processing of embedded style sheets
This branch includes the following new commits:
new 26b1b4d SLING-11326 - Deprecate processing of embedded style sheets
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[sling-org-apache-sling-xss] 01/01: SLING-11326 - Deprecate processing of embedded style sheets
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch issue/SLING-11326
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit 26b1b4de73668f3c7f9989d76f392bb8aa182b91
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Fri May 20 11:48:59 2022 +0200
SLING-11326 - Deprecate processing of embedded style sheets
Log a warning message if embedded stylesheet processing is enabled.
---
src/main/java/org/apache/sling/xss/impl/PolicyHandler.java | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/main/java/org/apache/sling/xss/impl/PolicyHandler.java b/src/main/java/org/apache/sling/xss/impl/PolicyHandler.java
index 2e737c2..5568983 100644
--- a/src/main/java/org/apache/sling/xss/impl/PolicyHandler.java
+++ b/src/main/java/org/apache/sling/xss/impl/PolicyHandler.java
@@ -23,12 +23,17 @@ import java.io.InputStream;
import org.apache.commons.io.IOUtils;
import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.Policy;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/**
* Class that provides the capability of securing input provided as plain text for HTML output.
*/
public class PolicyHandler {
+
+ private final Logger logger = LoggerFactory.getLogger(getClass());
+
private final Policy policy;
private Policy fallbackPolicy;
private AntiSamy antiSamy;
@@ -50,6 +55,9 @@ public class PolicyHandler {
ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());
currentThread.setContextClassLoader(this.getClass().getClassLoader());
this.policy = Policy.getInstance(bais);
+ if ( "true".equals(this.policy.getDirective(Policy.EMBED_STYLESHEETS)) ) {
+ logger.warn("The AntiSamy directive {} is set to true. This directive is deprecated and will not be supported in future Sling XSS bundle releases", Policy.EMBED_STYLESHEETS);
+ }
bais.reset();
this.fallbackPolicy = new FallbackSlingPolicy(bais);
this.antiSamy = new AntiSamy(this.policy);