Multiple escaping when passing variables

[mikeya]

It'd be nice to figure out a pattern that doesn't cause for multiple escaping. For example:

<c:set var='testEscapingVar' value='<script>alert(\"boo\");</script>"'/>
<c:set var='testEscapingVar' value='${testEscapingVar}'/>
<c:set var='testEscapingVar' value='${testEscapingVar}'/>

${testEscapingVar}

causes: <script>alert("boo");</script>"

any thoughts?

[pukkaone]

You can disable escaping for all of the variable references except for one:

<%@ taglib prefix="enhance" uri="http://pukkaone.github.com/jsp" %>

<enhance:out escapeXml="false">
  <c:set var='testEscapingVar' value='<script>alert(\"boo\");</script>"'/>
  <c:set var='testEscapingVar' value='${testEscapingVar}'/>
</enhance:out>
<c:set var='testEscapingVar' value='${testEscapingVar}'/>

${testEscapingVar}

[mikeya]

I understand, but what if we're passing around variables through jsps/jspfs, I'd really like to avoid tagging a bunch of places with <enhance:out escapeXml="false"></enhance:out>

[pukkaone]

The pattern I suggest is make a JSP a passive view in which it does not implement any presentation logic where it sets a variable. The JSP only reads variables.

[AlexByte]

Why do you need to escape manually if it automatically escapes?

[pukkaone]

With EscapeXmlELResolverListener registered, the values from all JSP variable references will be escaped. Sometimes you don't want the values escaped. The tag <enhance:out escapeXml="false"> disables escaping.

[AlexByte]

I know it. Its the question to the author of the issue.