I have a JSF2 XHTML page that defines view parameters, this allows one to have bookmarkable URLs. The XHTML page includes the parameters:

<f:metadata>
  <f:viewParam name="searchName" value="#{nbsearchpage.searchName}" />
  <!-- More view parameters omitted here for brevity -->
  <f:event listener="#{nbsearchpage.searchPreRender}" type="javax.faces.event.PreRenderViewEvent" />
</f:metadata>

On the same page, I have a text field and a button that allows the user to change the searchName:

<h:form id="some-id">
  <h:inputText value="#{nbsearchpage.searchName}" />
  <h:commandButton value="search" action="#{nbsearchpage.search}" />
</h:form>

and finally, the action method search() in the nbsearchpage bean returns to the same page, but including the parameters:

?faces-redirect=true&amp;includeViewParams=true

which provides the user with a nice URL. When the user enters "IBM" in the search field, the URL is redirected to 

?searchName=IBM

It works perfectly good. But now the user can enter an EL expression in the searchName textfield, and the EL expression is evaluated. E.g. when the user enters "#{2+2}" in the textfield, the URL is redirected to 

?searchName=4

and this is what I think we should not be doing, allowing the user to enter EL expression due to security reasons. I am using Glassfish 3.1.1.

Any ideas how to prevent this automatic EL resolving? I think there is a fundamental flaw with the view parameter concept in JSF2 and with redirecting? I had the same problem with the view scope that does not survive redirects, and for this I had to create an own scope. (I could have used the flash scope).

http-redirect jsf-2 el viewparams
Edit
Report