Groovy Script Console integration in AEM

Introduction

Groovy was developed by Jochen Theodorou, Guillaume Laforge, Cedric Champeau, and Paul King. Its typing discipline is strong, static and dynamic. It was licensed under the Apache 2.0 license. It first appeared in the year 2003. Its file extension is .groovy and was designed by James Strachan.

What is Groovy Script:

Apache Groovy is an Object-oriented programming language used for Java platform. It can be used as a scripting language for the Java platform.

Groovy vs Java

Groovy vs Java	Groovy	Java
Definition	It is compiled to JVM bytecode and is compatible with Java Platform.	It is developed on JDK and is run on JVM.
Usage	It is used when as both programming language and scripting language.	It is used as programming and object-oriented language.
Integration	It can be integrated along with any web applications and scripting applications.	It can also be integrated with any object-oriented application as it is compatible with any JVM based applications.
Platform	It supports any operating systems or platforms	It supports cross-platform operating systems
Syntax	The syntax is very similar to Java syntax.	It has a strong disciple in its syntax.
Community	It has been submitted to JCP for specification request.	It has a larger community called Java Community process i.es JCP being maintained by a large group of highly qualified technical experts across the industry.
License	It was licensed under Apache license 2.0	It was licensed under GNU General Public License.
Imports	All the packages will be imported by default.	It has to be mentioned clearly to import any package into the java class file.
Documentation	It provides single page documentation.	It has documentation in the form specification given by JCP.

Setup:

1. Download the Groovy Console package. Check the version compatible with your AEM instance. For AEM 6.5 I am using 14.0.0 version.
2. Install the downloaded package using the CRX package manager.
3. To verify the installation, open http://localhost:4502/apps/groovyconsole.html in browser to view the groovy console.

Note: From 13.0.0 release, paths were changed from /etc/ to /apps/ to access Groovy Console

GUI Console:

Create a system user in AEM using runmode config

Add/create a system user through runmode in AEM using ACS commons.

Create a runmode config file in your project.
/apps/aemquickstart/config/com.adobe.acs.commons.users.impl.EnsureServiceUser-customServiceUser.config

Add below snippet in the config file

principalName="custom-service-user" 
type="add" 
ensure-immediately="{Boolean}true"
aces="[type=allow;privileges=jcr:read\,jcr:modifyproperties;path=/content/we-retail;rep:glob=/jcr:content/*,type=allow;privileges=jcr:read;path=/content/aemquickstart;rep:glob=/jcr:content/*]

Above snippet will add read and modify properties privilege to /content/we-retail path and read permission to /content/aemquickstart.

Click here to check how to create a system user using system explorer

Refer ACS Commons documentation

Disable link checker in AEM

• Add x-cq-linkchecker="valid" parameter in the tag to make sure that links are always marked as valid by the Link Checker. 
• Optionally use x-cq-linkchecker="skip" in the . Link Checker will not even check for validity.  

Example:

 x-cq-linkchecker="skip">Link 

Note:  The Link Checker should not be enabled on publish instances.

Sitemap Scheulder with Factory Configuration using OSGi annotations

Creating Sitemap for an eCommerce website helps in indexing all the product pages by search engine crawlers. There are situations that sitemap should be created for multiple sites, we can achieve this by adding factory=true and bind methods in schedulers.

Let's see how to create sitemap from an product index file using factory.

1. Create a service config file
2. Create a scheduler
3. Create sitemap read and write service interface and implementation
4. Create models for parsing the index xml file

Create Product sitemap in AEM

Creating Sitemap for an eCommerce website helps in indexing all the product pages by search engine crawlers.

Let's see how to create sitemap from an product index file.

Create a service config file

Create a scheduler

Create sitemap read and write service interface and implementation

Create models for parsing the index xml file

Sample XML file hosted on a server, we will be configuring this XML hosted URL in Scheduler 
<aemquickstart
xmlns:xs="http://www.w3.org/2001/XMLSchema" version="2.0">
<channel>
<Item>
<title>
<![CDATA[ AEM Quickstart by Kishore ]]>
</title>
<ProductId>12345</ProductId>
<pubDate>02/28/2017 00:00:00.000000</pubDate>
</Item>
<Item>
<title>
<![CDATA[ Lorel Ipsum ]]>
</title>
<ProductId>56789</ProductId>
<pubDate>02/28/2019 00:00:00.000000</pubDate>
</Item>
<Item>
<title>
<![CDATA[ Create Sitemap in AEM ]]>
</title>
<ProductId>12987</ProductId>
<pubDate>03/28/2019 00:00:00.000000</pubDate>
</Item>
</channel>

</aemquickstart>

Access AEM servlet in postman

When you make a POST request to your local AEM author instance, the request will be filtered and restricted by "Apache Sling Referrer Filter" and "Adobe Granite CSRF Filter". Incoming POST requests without the CSRF-Token in the header will be blocked by "Apache Sling Referrer Filter" and "Adobe Granite CSRF Filter".

Steps to configure:

• Navigate to ConfigMgr
• Search for 'Apache Sling Referrer Filter'
• Remove POST method from the filter.
• Check "Allow Empty" checkbox and click on Save.

• Search for "Adobe Granite CSRF Filter"
• Remove POST method from the filter.
• click on Save.

Click here to download postman and install.

Open Postman app and do the following steps.

• Select method as POST
• Enter AEM servlet URL.
• Navigate to "Authorization" tab and enter username and password.
• Enter required "Headers"

• Enter request in the body tab and hit Send button.

XSS Protection for AEM Servlets:

Add XSS protection in AEM servlets using Apache Sling XSSAPI to avoid any scripts tag injected into request. This avoid any penetration issues.

import org.apache.sling.xss.XSSAPI; 

import org.apache.sling.api.SlingHttpServletRequest; 

XSSAPI xssapi = slingHttpServletRequestObj.adaptTo(XSSAPI.class); 

  String encodedAttr = xssapi.encodeForHTMLAttr(someUnsafeValue);

Default XSS configuration in AEM is available at /libs/cq/xssprotection/config.xml