commit	acaefc493eca19e3efbfef86fb712bb0db6bb57f	[log] [tgz]
author	Radu Cotescu <170911+raducotescu@users.noreply.github.com>	Thu Jan 16 17:50:58 2020 +0100
committer	GitHub <noreply@github.com>	Thu Jan 16 17:50:58 2020 +0100
tree	6ec3a1684a063801b65231b0cfe8f0b07a562065
parent	b3c8e24f036d32abcbd405a4af8e63975f601746 [diff]

SLING-8866 - Add reporting info in the XSS Protection API bundle

* added a counter metric (sling:xss.invalid_hrefs) to track the number of invalid URLs detected by org.apache.sling.xss.XSSFilter#isValidHref
* enhanced the webconsole plugin to provide a detailed report of the blocked URLs
* allow a system administrator to download the active AntiSamy configuration
* expose JSON / XML endpoints to retrieve the current status of the XSS library / the active AntiSamy configuration

pom.xml[diff]
src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java[diff]
src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java[diff]
src/main/java/org/apache/sling/xss/impl/XSSProtectionAPIWebConsolePlugin.java[Deleted - diff]
src/main/java/org/apache/sling/xss/impl/status/FixedSizeMap.java[Added - diff]
src/main/java/org/apache/sling/xss/impl/status/XSSStatusService.java[Added - diff]
src/main/java/org/apache/sling/xss/impl/webconsole/XSSProtectionAPIWebConsolePlugin.java[Added - diff]
src/main/resources/webconsole/config.js[Added - diff]
src/main/resources/webconsole/prettify.css[Renamed from src/main/resources/res/ui/prettify.css - diff]
src/main/resources/webconsole/prettify.js[Renamed from src/main/resources/res/ui/prettify.js - diff]
src/main/resources/webconsole/xss.css[Added - diff]
src/main/resources/webconsole/xss.js[Added - diff]
src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java[diff]
src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java[diff]

14 files changed

tree: 6ec3a1684a063801b65231b0cfe8f0b07a562065

README.md

Apache Sling XSS Protection

This module is part of the Apache Sling project.

The Apache Sling XSS Bundle provides two services for escaping and filtering XSS-prone user submitted content:

org.apache.sling.xss.XSSAPI
org.apache.sling.xss.XSSFilter

Please check the JavaDoc of each service to find out what methods they provide.