Component to inject and interpret String with HTML code into JSF page

Question

I'm using PrimeFaces with JSF 2.0 to build one application. I'm using PrimeFaces <p:editor> component to enable user to create rich text. But the output of this component is HTML source which look like this:

String text = "<p>This text <i>contains</i> some <b>HTML</b> code.</p>";

When I show this in a <h:outputText> as below:

<h:outputText value="#{bean.text}" />

Then it shows the HTML code as plain text:

This text contains some HTML code.

Is there any component which can interpret the HTML source so that e.g.  is actually shown as italics and  as bold?

This text contains some HTML code.

score 35 · Accepted Answer · edited May 23 '17 at 11:45

JSF by default escapes HTML from backing bean properties in order to prevent XSS attack holes. To disable this, just set the escape attribute of the <h:outputText> to false.

<h:outputText ... escape="false" />

This way the HTML won't be escaped and will thus be interpreted by the webbrowser.

Unrelated to the concrete problem, beware of XSS attacks as you're here basically redisplaying user-controlled input unescaped. You might want to sanitize it beforehand.

Component to inject and interpret String with HTML code into JSF page

1 Answers1

Linked

Related