[SLING-6959] XssProtection changes html semantic caused by formatting

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Duplicate
• Affects Version/s: XSS Protection API 1.0.2, Scripting Sightly Engine 1.0.2
• Environment: AEM
• Assignee: Unassigned
• Reporter: Lukas Kummer
• Created: 14/Jun/17 16:04
• Updated: 16/Jun/17 10:12
• Resolved: 16/Jun/17 10:12

Description

When using sightly the following html:

<td class="infoline" > ${component.infoline @ context='html'} </td>

it will be compiled to:

String var_28 = ((" "+renderContext.toString(renderContext.call("xss", renderContext.resolveProperty(_global_component, "infoline"), "html")))+" ");

which calls
org.apache.sling.scripting.sightly.impl.engine.extension.XSSRuntimeExtension.call(RenderContext, Object...)

and later:

org.apache.sling.xss.impl.XSSAPIImpl.filterHTML(String)

When this method is called with this String:

Is it a <span style="color:#e60000">threat</span> or an <span style="color:#e60000">opportunity</span>?<br>
Is it a threat or an opportunity?

will be turned into

Is it a <span style="color: rgb(230,0,0);">threat</span>
 or an <span style="color: rgb(230,0,0);">opportunity</span>
?<br />

Is it a threat or an opportunity?

which leads to the problem, that there will be a space between the word opportunity and the question mark.

However, the formatting could be configured by changing the SLING-INF/content/config.xml
(from <directive name="formatOutput" value="true"/> to <directive name="formatOutput" value="false"/>)

But anyway the formatting shouldn't change the semantics, which why the formatting directive should be always false

Issue Links

• duplicates: SLING-5050 Disable AntiSamy's default formatOutput policy directive