cziegeler opened a new pull request, #68: URL: https://github.com/apache/sling-org-apache-sling-xss/pull/68
Documents the requirement to HTML-escape request-derived values in the web console plugin to prevent XSS vulnerabilities. - Added a note to `AGENTS.md` instructing agents to always escape request-derived values (e.g. `consoleRoot`) using `StringEscapeUtils.escapeHtml4` before interpolating into markup - Added a corresponding note to `README.md` describing that web console rendering escapes request-derived values before interpolation to prevent XSS in the plugin UI - Removed trailing blank line at end of `AGENTS.md` Co-authored-by: Maia <maia@noreply> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
