rich:editor problem. How to displaying the input text with JSF h:outputText (escape problem)

[babazs]

HY!

What is the official solution to displaying a text that is typed in a rich:editor (because it generates html characters)

If I use <h:outputText value="#{richeditorvalue.text}" escape="true" />

It will show html characters instead of formatted text.

If I use <h:outputText value="#{richeditorvalue.text}"  escape="false" />

I will give a possibility to Cross Site Scripting.

Or, I should use escape=false with server validation?

So which is the good way?

[ilya_shaikovsky]

http://seamframework.org/Documentation/CrossSiteScripting

check section about <s:formattedText/>

[babazs]

thanks.

It would be a good solution, but Seam text + rich:editor had a lot of problem based in my experiences.

[nbelaevski]

If SeamText doesn't satisfy your requirements, then you should use escape=false with server validation.