in src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java [310:322]
synchronized void updateActivePolicy() {
final AntiSamyPolicy originalActivePolicy = this.activePolicy;
this.activePolicy = withPolicyResource(AntiSamyPolicy::create);
// the originalActivePolicy can only be null during the first activation
if (activePolicy == null && originalActivePolicy == null) {
// the content-based policy file is not (yet) available, fall back to the embedded policy
this.activePolicy = AntiSamyPolicy.createEmbedded();
if (activePolicy == null) {
throw new IllegalStateException("Cannot load a policy handler.");
}
}
updatePolicyHandler(activePolicy.getPolicyHandler());
}