[
https://issues.apache.org/jira/browse/SLING-8266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16762976#comment-16762976
]
Dan Klco commented on SLING-8266:
---------------------------------
[~rombert] seems reasonable to me. the XSSAPI supports all of the methods
available via the encode Tag / Expression Language methods:
[https://sling.apache.org/apidocs/sling9/org/apache/sling/xss/XSSAPI.html]
[https://sling.apache.org/documentation/bundles/scripting/scripting-jsp.html]
I actually started working it and the problem I've run into is that the EL
functions don't have a good way to retrieve OSGi Services (e.g. to get the
XSSAPI). There are a couple of options I could think of, but none are very
clean:
* Get the service from the OSGi FrameworkUtil.getBundle().getServiceReference,
but it's obviously not clean
* Create a singleton component to expose the service via a static method.
More than happy to take another approach, but at least I can't think of a clean
approach without changing the EL signature..
> Stop embedding ESAPI
> --------------------
>
> Key: SLING-8266
> URL: https://issues.apache.org/jira/browse/SLING-8266
> Project: Sling
> Issue Type: Improvement
> Components: Scripting
> Reporter: Robert Munteanu
> Priority: Major
> Fix For: Scripting JSP Taglib 2.3.2
>
>
> Since we now have an XSS API in Sling we should use this instead of embedding
> the ESAPI jars, since:
> - bundle size will be reduced
> - possibility to embed an out-of-date version is removed
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
