[ https://issues.apache.org/jira/browse/SLING-3850?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14098239#comment-14098239 ]
Justin Edelson edited comment on SLING-3850 at 8/15/14 7:57 PM: ---------------------------------------------------------------- bq. and because it is not JS but just name value properties more like a properties file. [~fmeschbe] that syntactically is a valid JS :P So it seems there is some interested to know the full story so here it is :) Imagine this osgi property file is stored under /apps/system/config/org.apache.sling.Configuration.config and looks like {code} username="admin" password="admin" {code} Now I can put on my blog a page that looks like {code} <script src="http://localhost:8080 /apps/system/config/org.apache.sling.Configuration.config"></script> <script>alert(username+'\n'+password)</script> {code} Now guess which one is going to be the output if a Sling admin visit my blog :) ... was (Author: asanso): bq. and because it is not JS but just name value properties more like a properties file. [~fmeschbe] that syntactically is a valid JS :P So it seems there is some interested to know the full story so here it is :) Imagine this osgi property file is stored under /apps/system/config/org.apache.sling.Configuration.config and looks like {code} username = admin password = admin {code} Now I can put on my blog a page that looks like {code} <script src="http://localhost:8080 /apps/system/config/org.apache.sling.Configuration.config"></script> <script>alert(username+'\n'+password)</script> {code} Now guess which one is going to be the output if a Sling admin visit my blog :) ... > Add comments to the OSGi configuration files stored in the repository > generated by configuration writeback > ---------------------------------------------------------------------------------------------------------- > > Key: SLING-3850 > URL: https://issues.apache.org/jira/browse/SLING-3850 > Project: Sling > Issue Type: Improvement > Components: Installer > Reporter: Antonio Sanso > Assignee: Carsten Ziegeler > Priority: Minor > Fix For: JCR Installer 3.1.8 > > > It would be nice add coment to the OSGi configuration files stored in the > repository. > e.g. > {code} > #generated by .. > {code} > This will have as a wanted side effect to not have the file being a valid > javascript -- This message was sent by Atlassian JIRA (v6.2#6252)