Hello all,
I'm working for a client that's using a proprietary Servlet/JSP-based framework that runs on Tomcat. They have their own custom JSP compiler and they're looking to move to a standard JSP compiler. One of the things their compiler supports is automatic escaping of XML in expressions. For example, ${foo} would be escaped so <body> -> &lt;body&gt;. JSP EL does not do this. It *doesn't* escape by default and instead requires you to wrap your expressions with <c:out/> if you want escaping.
I'd like to ask what developers think about adding a flag (similar to trimSpaces in conf/web.xml) that allows users to change the escaping behavior from false to true?
I think this is a good option to have as it allows security-conscious organizations to paranoid and escape all content by default.
Thanks,
Matt
Group items matching
in title, tags, annotations or url
1More
Essential five things you should know before moving to DLF apartments - 0 views
1 - 8 of 8
Showing 20▼ items per page