Edit Question - KnowledgeHub

Title Body

I have a JSF2 XHTML page that defines view parameters, this allows one to have bookmarkable URLs. The XHTML page includes the parameters: <f:metadata> <f:viewParam name="searchName" value="#{nbsearchpage.searchName}" />  <f:event listener="#{nbsearchpage.searchPreRender}" type="javax.faces.event.PreRenderViewEvent" /> </f:metadata> On the same page, I have a text field and a button that allows the user to change the searchName: <h:form id="some-id"> <h:inputText value="#{nbsearchpage.searchName}" /> <h:commandButton value="search" action="#{nbsearchpage.search}" /> </h:form> and finally, the action method search() in the nbsearchpage bean returns to the same page, but including the parameters: ?faces-redirect=true&amp;includeViewParams=true which provides the user with a nice URL. When the user enters "IBM" in the search field, the URL is redirected to ?searchName=IBM It works perfectly good. But now the user can enter an EL expression in the searchName textfield, and the EL expression is evaluated. E.g. when the user enters "#{2+2}" in the textfield, the URL is redirected to ?searchName=4 and this is what I think we should not be doing, allowing the user to enter EL expression due to security reasons. I am using Glassfish 3.1.1. Any ideas how to prevent this automatic EL resolving? I think there is a fundamental flaw with the view parameter concept in JSF2 and with redirecting? I had the same problem with the view scope that does not survive redirects, and for this I had to create an own scope. (I could have used the flash scope).

Tags (comma-separated) Cancel