in src/main/java/org/apache/sling/xss/impl/webconsole/XSSProtectionAPIWebConsolePlugin.java [100:146]
protected void doGet(HttpServletRequest request, HttpServletResponse response) {
String pluginResource = request.getPathInfo();
String consoleRoot =
request.getRequestURI().substring(0, request.getRequestURI().indexOf(pluginResource));
if (CSS_RESOURCES.contains(pluginResource)) {
streamResource(response, FilenameUtils.getName(pluginResource), "text/css");
} else if (JS_RESOURCES.contains(pluginResource)) {
streamResource(response, FilenameUtils.getName(pluginResource), "application/javascript");
} else if (URI_CONFIG_XHR.equalsIgnoreCase(pluginResource) && xssFilter != null) {
writeAntiSamyConfiguration(consoleRoot, response);
} else if (URI_CONFIG_XML.equalsIgnoreCase(pluginResource) && xssFilter != null) {
streamAntiSamyConfiguration(response);
} else if (URI_BLOCKED_XHR.equalsIgnoreCase(pluginResource)) {
generateInvalidUrlsJSONReport(response);
} else {
try {
PrintWriter printWriter = response.getWriter();
printWriter.printf(LINK_TAG, consoleRoot + RES_URI_XSS_CSS);
printWriter.printf(SCRIPT_TAG, consoleRoot + RES_URI_XSS_JS);
printWriter.println("<div id='xss-tabs'>");
printWriter.println("<ul>");
printWriter.println("<li id='blocked-tab'><a href='#blocked'><span>Status</span></a></li>");
if (xssFilter != null) {
printWriter.println(String.format(
"<li id='config-tab'><a href='%s'><span>Active Configuration</span></a></li>",
consoleRoot + URI_CONFIG_XHR));
}
printWriter.println("</ul>");
printWriter.println("<div id='blocked'>");
printWriter.println("<div class='table'>");
printWriter.println("<div class='ui-widget-header ui-corner-top buttonGroup'>Blocked URLs</div>");
printWriter.println("<table class='nicetable tablesorter' id='invalid-urls'>");
printWriter.println("<thead>");
printWriter.println("<tr>");
printWriter.println("<th class='header'>URL</th>");
printWriter.println("<th class='header'>Times Blocked</th>");
printWriter.println("</tr>");
printWriter.println("</thead>");
printWriter.println("<tbody id='invalid-urls-rows'>");
printWriter.println("</tbody>");
printWriter.println("</table>");
printWriter.println("</div></div></div>");
} catch (IOException e) {
LOGGER.error("Unable to generate scaffold for the webconsole plugin output.", e);
}
}
}