DocumentationExperience Cloud KCS

Rich Text content does not render after a Sling XSS policy XML parsing error in AEM 6.5 LTS

Last update: September 10, 2026

This article explains how you can restore Rich Text content that does not render in Adobe Experience Manager (AEM) 6.5 LTS because of XML parsing errors in a custom Sling XSS policy file. To fix this, identify the active policy file, replace the unsupported self-closing attribute elements, redeploy the updated XML file, verify the Sling XSS bundle, and validate Rich Text rendering.

Description description

Environment

  • Adobe Experience Manager 6.5 LTS
  • Sling XSS 2.4.6
  • Java 21
  • WCM Core Components 2.30.x
  • Self-managed or Adobe Managed Services deployment with approved OSGi and bundle-management access

Issue/Symptoms

  • Rich Text content does not render on affected pages.
  • The page loads, but Rich Text fields are blank.
  • The issue occurs intermittently depending on deployment or initialization order.
  • The logs show java.lang.NullPointerException: Cannot invoke “org.apache.sling.xss.impl.PolicyHandler.getHtmlSanitizer()” because “handler” is null.

Cause

Stricter XML parsing in Sling XSS 2.4.6 fails to load a custom XSS policy that contains self-closing attribute elements. The failed policy load creates a null policy handler, prevents the XSS filter from sanitizing HTML content, and leaves Rich Text fields blank.

Resolution resolution

Follow the steps below to resolve the issue:

  1. In the AEM OSGi configuration, locate the Sling XSS filter settings for org.apache.sling.xss.impl.XSSFilterImpl and confirm the active policy file path, such as /apps/cq/xssprotection/config.xml.
  2. Open the identified custom XSS policy XML file.
  3. Search the policy file for self-closing attribute elements, such as <attribute name="download"/>.
  4. Replace each self-closing attribute element with an explicitly closed element, such as <attribute name="download"></attribute>.
  5. Save and redeploy the updated XML policy file to all affected AEM instances.
  6. In the AEM bundle-management view, verify that the org.apache.sling.xss bundle is Active and matches version 2.4.6.
  7. If the updated policy file does not load after deployment, restart the org.apache.sling.xss bundle or the AEM instance by using the approved administrative procedure.
  8. Author or edit Rich Text content and confirm that it renders correctly on the page.
  9. Review the logs and confirm that the java.lang.NullPointerException: Cannot invoke “org.apache.sling.xss.impl.PolicyHandler.getHtmlSanitizer()” because “handler” is null error no longer appears.
recommendation-more-help
experience-cloud-kcs-help-kbarticles