This is an automated email from the ASF dual-hosted git repository. cziegeler pushed a commit to branch maia/workflow-1784200191777 in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit 9a4438f2691b3c15e99012b747871b5c71ceb19d Author: Carsten Ziegeler <[email protected]> AuthorDate: Thu Jul 16 13:09:51 2026 +0200 docs: document XSS escaping requirement for web console plugin Co-authored-by: Maia <maia@noreply> --- AGENTS.md | 2 +- README.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 618d399..ff58921 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -74,6 +74,7 @@ pom.xml - Public API (`org.apache.sling.xss`) is versioned via `@Version` in `package-info.java`; increment according to OSGi semantic versioning when changing interfaces. - ESAPI, Batik, and owasp-html-sanitizer are embedded via `bnd.bnd` private packages — do not add OSGi `Import-Package` for them. - Invalid href metrics are emitted via `XSSMetricsService` and `org.apache.sling.commons.metrics` when a `MetricsService` is available (optional dynamic DS reference). +- In the web console plugin, always HTML-escape request-derived values (for example `consoleRoot`) before interpolating into markup (`StringEscapeUtils.escapeHtml4`). - Formatting is enforced by Spotless (inherited from `sling-bundle-parent`). Run `mvn spotless:apply` before committing. - 4-space indentation, no wildcard imports in non-generated code. - License header required on every source file (enforced by Apache RAT). @@ -108,4 +109,3 @@ pom.xml <!-- sling-security-default:start --> The threat model for this project is https://github.com/apache/sling/blob/master/docs/threat-model.md . <!-- sling-security-default:end --> - diff --git a/README.md b/README.md index 1c044d4..d14d3fd 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,7 @@ See the JavaDoc of each service for the complete API surface. - Uses `owasp-java-html-sanitizer` for HTML sanitization. - Embeds ESAPI, Batik CSS, and HTML sanitizer packages as private bundle packages to avoid OSGi import conflicts. - Includes optional invalid-href metrics integration via Sling Commons Metrics. +- Web console rendering escapes request-derived values (for example `consoleRoot`) before interpolation to prevent XSS in the plugin UI. - Excludes legacy/conflicting transitive logging dependencies such as `commons-logging` and does not depend on Log4j 1.x. ## Build and test
