JSF 2.0; escape=“false” alternative to prevent XSS?

Question

In my jsf webapplication i\'m using a messages.properties to output some text. This text could have html line breaks so format the outputtext.

That all works fine, i

Answer 1

It should be possible to just escape the user supplied parameter using the standard jstl functions in the http://java.sun.com/jsp/jstl/functions namespace:

<h:outputFormat value="#{bundle.myMessage}" escape="false">
    <f:param value="#{fn:escapeXml(param)}"/>
</h:outputFormat>

Answer 2

XSS can't happen if you're outputting some HTML from a safe source which is not input or editable by the user. You can safely use escape="false" in this case.