in src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java [286:303]
synchronized void updatePolicy() {
this.policyHandler = null;
try (final ResourceResolver xssResourceResolver = resourceResolverFactory.getServiceResourceResolver(null)) {
Resource policyResource = xssResourceResolver.getResource(policyPath);
if (policyResource != null) {
setActivePolicy(policyResource);
}
} catch (final LoginException e) {
logger.error("Unable to load the default policy file.", e);
}
if (policyHandler == null) {
// the content was not installed but the service is active; let's use the embedded file for the default handler
setActiveEmbededPolicy();
}
if (policyHandler == null || activePolicy == null) {
throw new IllegalStateException("Cannot load a policy handler.");
}
}