How do I return HTML from managed bean in JSF?

Question

I have one method in my managed bean which returns javascript as a string. When the method is invoked from head tag, it works fine. But when it is invoked from body, the browser instead of rendering the javascript writes it as it is. What can be the problem?

In my JSF page when i do #{IndexBean.EastRegionGadgets} in head it works fine but it doesn't in body. It outputs the HTML as it is. Here is the code:

package BusinessFacade;

import java.util.ArrayList;
import javax.annotation.PostConstruct;
import javax.faces.bean.ManagedBean;
import javax.faces.bean.RequestScoped;
import javax.faces.component.html.HtmlOutputText;


enum REGION{
    NORTH,EAST,WEST;
}

class Gadget{
    private String gadgetCode = "";
    private REGION gadgetRegion = REGION.WEST;

    public Gadget(String gadgetCode, REGION gadgetRegion){
        this.gadgetCode = gadgetCode;
        this.gadgetRegion = gadgetRegion;
    }

    public String getGadgetCode() {
        return gadgetCode;
    }

    public void setGadgetCode(String gadgetCode) {
        this.gadgetCode = gadgetCode;
    }

    public REGION getGadgetRegion() {
        return gadgetRegion;
    }

    public void setGadgetRegion(REGION gadgetRegion) {
        this.gadgetRegion = gadgetRegion;
    }

}

@ManagedBean(name="IndexBean")
@RequestScoped
public class IndexBean {
    ArrayList<Gadget> _list;
    public IndexBean() {

    }

    @PostConstruct
    public void initialize(){
        _list = new ArrayList<Gadget>();
        Gadget objGadget = new Gadget("<script type='text/javascript' src='http://cdn.widgetserver.com/syndication/subscriber/InsertWidget.js'></script><script>if (WIDGETBOX) WIDGETBOX.renderWidget('78d12c15-dc87-42f2-a78a-3f62a91a119a');</script><noscript>Get the <a href='http://www.widgetbox.com/widget/crystal-clock'>Crystal Clock</a> widget and many other <a href='http://www.widgetbox.com/'>great free widgets</a> at <a href='http://www.widgetbox.com'>Widgetbox</a>! Not seeing a widget? (<a href='http://docs.widgetbox.com/using-widgets/installing-widgets/why-cant-i-see-my-widget/'>More info</a>)</noscript>",REGION.WEST);
        _list.add(objGadget);

        objGadget = new Gadget("<script type='text/javascript' src='http://cdn.widgetserver.com/syndication/subscriber/InsertWidget.js'></script><script>if (WIDGETBOX) WIDGETBOX.renderWidget('1ccc3dee-8266-4b84-8191-13a4bf584d0c');</script><noscript>Get the <a href='http://www.widgetbox.com/widget/custom-clock'>Shiny Clock</a> widget and many other <a href='http://www.widgetbox.com/'>great free widgets</a> at <a href='http://www.widgetbox.com'>Widgetbox</a>! Not seeing a widget? (<a href='http://docs.widgetbox.com/using-widgets/installing-widgets/why-cant-i-see-my-widget/'>More info</a>)</noscript>",REGION.EAST);
        _list.add(objGadget);



    }

    public String getWestRegionGadgets(){
        HtmlOutputText objHtmlOutputText = new HtmlOutputText();
        String strGadgets = "";
        for(Gadget objGadget:_list ){
            if(objGadget.getGadgetRegion() == REGION.WEST){
                strGadgets += objGadget.getGadgetCode();
            }
        }
        return strGadgets;

    }

    public String getEastRegionGadgets(){

        String strGadgets = "";
        for(Gadget objGadget:_list ){
            if(objGadget.getGadgetRegion() == REGION.EAST){
                strGadgets += objGadget.getGadgetCode();
            }
        }
        return strGadgets;

    }


}

BalusC · Accepted Answer · 2011-12-28T19:45:18.233

21

In my JSF page when i do #{IndexBean.EastRegionGadgets} in head it works fine but it doesn't in body. It outputs the HTML as it is.

I suppose you're using <h:outputText> in body to output the HTML. As per the documentation it by default escapes HTML. You need to set its escape attribute to false.

<h:outputText value="#{bean.html}" escape="false" />

edited Dec 28 '11 at 19:45

answered Feb 28 '10 at 18:14

BalusC

1,082,665
372
3,610
3,555

No actually i was not using anything. I just wrote #{bean.html} in body and wrote everything in HTML. However, the same line worked fine in head tag! – TCM Mar 01 '10 at 02:09
Ah yes, you're using Facelets. – BalusC Mar 01 '10 at 02:16
Yes i am using Facelets. Do i need to compulsorily use this outputText to output html? from managed bean? – TCM Mar 01 '10 at 02:35
Yes, it by default escapes inline EL in body as well. All just to prevent XSS. – BalusC Mar 01 '10 at 11:21
The project I had to fix now, was using , for which the docs state it does NOT by default escape html. It did escape html. The above worked - thanks BalusC! – demaniak Apr 24 '13 at 09:15

How do I return HTML from managed bean in JSF?

1 Answers1

Linked