AEM Code Snippets

How to use a sling service in sightly page without using javascript?

When you try to access sling.getService() in Sightly you will see compilation error "sling cannot be resolved". 

So this can be achieved in sightly using below code snippet.

public class Search extends WCMUse {

    SearchService service

    @Override
    public void activate() throws Exception {
        service = getSlingScriptHelper().getService( SearchService.class );
    }

For AEM 6.2 we can get the service as below

<p data-sly-use.search="com.your.package.SearchServiceImpl">
   ${search.results}
</p>

========================================================================================================

XSS Protection for AEM Servlets:

Add XSS protection in AEM servlets using Apache Sling XSSAPI to avoid any scripts tag injected into request. This avoid any penetration issues.

import org.apache.sling.xss.XSSAPI; 

import org.apache.sling.api.SlingHttpServletRequest; 

XSSAPI xssapi = slingHttpServletRequestObj.adaptTo(XSSAPI.class); 

  String encodedAttr = xssapi.encodeForHTMLAttr(someUnsafeValue);

Default XSS configuration in AEM is available at /libs/cq/xssprotection/config.xml

---