[
https://issues.apache.org/jira/browse/SLING-13337?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13337:
------------------------------
Description:
use Johnzon instead of Glassfish's JSON implementation, as we use Johnzon in
the Sling Starter as well.
Also adding a validation explicitly targetting JSON comments (which Johnzon
supports) to avoid StackOverflows in the in-depth scanner before the data is
passed to the JSON parser.
Commit:
https://github.com/apache/sling-org-apache-sling-xss/commit/df4f127d8423bb1b21ce75e4a638ce510e9d29cc
was:
use Johnzon instead of Glassfish's JSON implementation, as we use Johnzon in
the Sling Starter as well.
Also adding a validation explicitly targetting JSON comments (which Johnzon
supports) to avoid StackOverflows in the in-depth scanner before the data is
passed to the JSON parser.
> Support JSON comments if Johnzon is used as JSON parser
> -------------------------------------------------------
>
> Key: SLING-13337
> URL: https://issues.apache.org/jira/browse/SLING-13337
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Major
> Fix For: XSS Protection API 2.4.12
>
>
> use Johnzon instead of Glassfish's JSON implementation, as we use Johnzon in
> the Sling Starter as well.
> Also adding a validation explicitly targetting JSON comments (which Johnzon
> supports) to avoid StackOverflows in the in-depth scanner before the data is
> passed to the JSON parser.
> Commit:
> https://github.com/apache/sling-org-apache-sling-xss/commit/df4f127d8423bb1b21ce75e4a638ce510e9d29cc
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
