[SITES-40889] [Core Components] Add support in Fragment component for CFVT by alexandru-stancioiu · Pull Request #3015 · adobe/aem-core-wcm-components

alexandru-stancioiu · 2026-03-09T15:23:28Z

Q	A
Fixed Issues?	`Fixes #1, Fixes #2`
Patch: Bug Fix?
Minor: New Feature?
Major: Breaking Change?
Tests Added + Pass?	Yes
Documentation Provided	Yes (code comments and or markdown)
Any Dependency Changes?
License	Apache License, Version 2.0

… CFVT

Made-with: Cursor

codecov · 2026-03-09T15:38:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

LSantha · 2026-03-11T11:36:54Z

...ing/it/it.core/src/main/java/com/adobe/cq/wcm/core/components/it/support/MockVCFServlet.java

+            String templateId = request.getParameter("templateId");
+            String variation = request.getParameter("variation");
+            response.setContentType("text/html;charset=UTF-8");
+            response.getWriter().write(buildVcfHtml(fragmentId, templateId, variation));


In general, to fix cross-site scripting in servlets, all user-controlled data that is written into HTML should be encoded using a well-established, context-appropriate escaping library (for example, OWASP Java Encoder or Apache Commons Text) rather than handcrafted string replacement. This ensures correct and complete escaping for the specific HTML context and makes static analysis tools recognize the data as properly sanitized.

For this file, the best fix is to replace the custom escapeHtml implementation with one that delegates to a standard encoding routine from a known library, without changing the public behavior of the servlet. We should also keep the method signature so the rest of the code remains unchanged. A practical choice, without modifying other imports, is to add an import for org.apache.commons.text.StringEscapeUtils and implement escapeHtml by calling StringEscapeUtils.escapeHtml4(input). That encoder correctly escapes characters necessary for safe inclusion in HTML, including both single and double quotes, and is widely recognized. The changes are limited to:

Adding an import at the top of MockVCFServlet.java for org.apache.commons.text.StringEscapeUtils.

Replacing the body of escapeHtml (lines 131–138) with a call to StringEscapeUtils.escapeHtml4(input) while preserving the null check and method signature.

No other methods or call sites need to change, since appendRow and buildVcfHtml already use escapeHtml consistently.

@alexandru-stancioiu , this may need to be fixed because it's likely getting deployed to AEM CS instances.

This is a mock servlet used for ITs

yeah, since it is a mock servlet used for ITs, it won't get deployed to AEMaaCS

...ing/it/it.core/src/main/java/com/adobe/cq/wcm/core/components/it/support/MockVCFServlet.java

LSantha · 2026-03-11T11:43:02Z

@alexandru-stancioiu , it would be nice to add an example if possible for this cool new feature in the examples subproject so that it would show up here https://www.aemcomponents.dev/content/core-components-examples/library/core-content/content-fragment.html . Then people can see it already shortly after the new release.
@vladbailescu , wdyt?

…ialog The dynamically-populated Coral Select for VCF templates has no server-side items, so Coral loses the stored JCR value on dialog load. Read the stored vcfTemplate from the component resource via an async fetch and use it as fallback when populating the dropdown. Added Karma/Jasmine tests for VCF template retention scenarios. Made-with: Cursor

Add a VCF display mode example to the Content Fragment examples page, showing the component configured with displayMode=vcf and a template. The visual preview requires AEM as a Cloud Service. Made-with: Cursor

sonarqubecloud · 2026-03-13T07:00:32Z

Quality Gate passed

Issues
21 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

alexandru-stancioiu · 2026-03-13T07:03:16Z

Unfortunately we cannot make the visual preview on the aemcomponents.dev website work because we cannot serve any template client-side, it works only on AEMaaCS.
MockVCFServlet doesn't help either because it handles author-side dialog requests only.

Alexandru Marian Stancioiu added 3 commits March 9, 2026 17:15

[SITES-40889] [Core Components] Add support in Fragment component for…

e3786a7

… CFVT

Revert unintended copyright year changes (2025 -> 2026)

08c13ae

Made-with: Cursor

fix sq issues

260fbdc

Alexandru Marian Stancioiu added 4 commits March 9, 2026 17:39

fix tests

fc4992d

add test

aadcf33

sonar suppression

4bb479d

fix tests

e754d54

github-advanced-security bot found potential problems Mar 9, 2026

View reviewed changes

copilot review

0dff0e0

alexandru-stancioiu force-pushed the sites_40889 branch 3 times, most recently from 13cfd81 to 86df6e9 Compare March 13, 2026 06:55

Alexandru Marian Stancioiu and others added 2 commits March 13, 2026 08:55

add Content Fragment Visualization example to examples library

e064e95

Add a VCF display mode example to the Content Fragment examples page, showing the component configured with displayMode=vcf and a template. The visual preview requires AEM as a Cloud Service. Made-with: Cursor

Merge branch 'main' into sites_40889

50a01a2

@@ -24,6 +24,7 @@
             import org.apache.sling.api.servlets.SlingAllMethodsServlet;
             import org.apache.sling.servlets.annotations.SlingServletPaths;
             import org.osgi.service.component.annotations.Component;
+            import org.apache.commons.text.StringEscapeUtils;
             /**
              * Local-development mock for the Content Fragment Visualization API.
@@ -132,10 +133,7 @@
                     if (input == null) {
                         return "";
                     }
-                    return input.replace("&", "&amp;")
-                                 .replace("<", "&lt;")
-                                 .replace(">", "&gt;")
-                                 .replace("\"", "&quot;");
+                    return StringEscapeUtils.escapeHtml4(input);
                 }
                 private static String escapeJson(String input) {

@@ -202,6 +202,11 @@
                         <artifactId>org.apache.sling.servlets.annotations</artifactId>
                         <version>1.2.6</version>
                     </dependency>
-                </dependencies>
+                    <dependency>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-text</artifactId>
+                    <version>1.15.0</version>
+                </dependency>
+            </dependencies>
             </project>

Package	Version	Security advisories
org.apache.commons:commons-text (maven)	1.15.0	None

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SITES-40889] [Core Components] Add support in Fragment component for CFVT#3015

[SITES-40889] [Core Components] Add support in Fragment component for CFVT#3015
alexandru-stancioiu wants to merge 11 commits intomainfrom
sites_40889

alexandru-stancioiu commented Mar 9, 2026

Uh oh!

codecov bot commented Mar 9, 2026 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

LSantha Mar 11, 2026

Uh oh!

vladbailescu Mar 12, 2026

Uh oh!

alexandru-stancioiu Mar 13, 2026

Uh oh!

Uh oh!

LSantha commented Mar 11, 2026

Uh oh!

sonarqubecloud bot commented Mar 13, 2026

Uh oh!

alexandru-stancioiu commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

alexandru-stancioiu commented Mar 9, 2026

Uh oh!

codecov bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Check warning

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

LSantha Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

vladbailescu Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

alexandru-stancioiu Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

LSantha commented Mar 11, 2026

Uh oh!

sonarqubecloud bot commented Mar 13, 2026

Quality Gate passed

Uh oh!

alexandru-stancioiu commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Mar 9, 2026 •

edited

Loading