8

From the dbms I get stuff like <font color="red"> abc</font>. When it reaches the ${someManagedBean.someValue} in my xhtml file the output is sanitized. That is great for 99,999% of all cases.

Question: Is there some way to disable this auto escaping?

Bonus Question: Can I only allow html and disallow javascript?

Franz Kafka
  • 10,623
  • 20
  • 93
  • 149

3 Answers3

14
<h:outputText value="#{someManagedBean.someValue}" escape="false" />
James DW
  • 1,815
  • 16
  • 21
9

https://docs.oracle.com/javaee/7/javaserver-faces-2-2/vdldocs-facelets/h/outputText.html

escape=false

Not sure about preventing JS only though. You might have to parse the HTML yourself to get rid of <script> and contents.

EDIT - Removed link (http://www.jsftoolbox.com/documentation/help/12-TagReference/html/h_outputText.html) because it was stale. Replaced with Oracle link.

Paul Grime
  • 14,970
  • 4
  • 36
  • 58
0

outputFormat tag can help you. Please check http://www.mkyong.com/jsf2/jsf-2-outputformat-example/

ControlPower
  • 610
  • 4
  • 7