JSF SelectItems and escaping (xss)
there is a selectOneMenu in my example with a f:selectItems-attribute. The select-items are resolved from my bean like this: <h:selectOneMenu value="#{bean.value}"> <f:selectItems value="#{bean.selectItems}" var="obj" itemValue="#{obj}" itemLabel="#{obj.name}"/> </h:selectOneMenu> The method getSelectItems() in my bean looks like that: public List<MyObject> getSelectItems() { List<MyObject> list = new LinkedList<MyObject>(); MyObject obj = new MyObject("Peter"); list.add(obj); return list; } The objects that are displayed are simple objects with a attribute "name". Nothing special up to this