CRSF token and spring

http://seamframework.org/Documentation/CrossSiteScripting

<h:outputText value="#{param.name}" escape="false"/>  <!-- DON'T DO THIS! XSS SECURITY HOLE! -->

but do this:

<h:outputText value="#{myBean.myTextContent}" escape="false"/>  <!-- Content contains &entity; and is already safe! -->

Advertisement