[SLING-11326] Deprecate processing of embedded style sheets

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: XSS Protection API 2.2.20
• Component/s: XSS Protection API
• Assignee: Robert Munteanu
• Reporter: Robert Munteanu
• Created: 20/May/22 09:38
• Updated: 24/May/22 09:03
• Resolved: 20/May/22 10:24

Description

When validating HTML, external stylesheets embedded in style tags are
loaded and inlined. For example, validating

—
<h1>Hello, world</h1>
<style type="text/css">
h1

{ color: red }

@import "https://example.com/my-awesome-input.css"
</style>
—

Will access https://example.com/my-awesome-input.css, inline it in the
style tag, and validate it.

This functionality is disabled in the default configuration we ship
with Sling. I think this can have a stability and performance impact
when enabled and therefore I propose that we stop supporting it in the
future.

See also https://lists.apache.org/thread/l1yfmc6jkd9gx5bmx509dy25dc6o434m