tags:

views:

195

answers:

1

Hello,

I have one method in my managed bean which returns javascript as a string. When the method is invoked from head tag, it works fine. But when it is invoked from body, the browser instead of rendering the javascript writes it as it is. What can be the problem?

In my JSF page when i do #{IndexBean.EastRegionGadgets} in head it works fine but it doesn't in body. It outputs the HTML as it is. Here is the code:

package BusinessFacade;

import java.util.ArrayList;
import javax.annotation.PostConstruct;
import javax.faces.bean.ManagedBean;
import javax.faces.bean.RequestScoped;
import javax.faces.component.html.HtmlOutputText;


enum REGION{
    NORTH,EAST,WEST;
}

class Gadget{
    private String gadgetCode = "";
    private REGION gadgetRegion = REGION.WEST;

    public Gadget(String gadgetCode, REGION gadgetRegion){
        this.gadgetCode = gadgetCode;
        this.gadgetRegion = gadgetRegion;
    }

    public String getGadgetCode() {
        return gadgetCode;
    }

    public void setGadgetCode(String gadgetCode) {
        this.gadgetCode = gadgetCode;
    }

    public REGION getGadgetRegion() {
        return gadgetRegion;
    }

    public void setGadgetRegion(REGION gadgetRegion) {
        this.gadgetRegion = gadgetRegion;
    }

}

@ManagedBean(name="IndexBean")
@RequestScoped
public class IndexBean {
    ArrayList<Gadget> _list;
    public IndexBean() {

    }

    @PostConstruct
    public void initialize(){
        _list = new ArrayList<Gadget>();
        Gadget objGadget = new Gadget("<script type='text/javascript' src='http://cdn.widgetserver.com/syndication/subscriber/InsertWidget.js'&gt;&lt;/script&gt;&lt;script&gt;if (WIDGETBOX) WIDGETBOX.renderWidget('78d12c15-dc87-42f2-a78a-3f62a91a119a');</script><noscript>Get the <a href='http://www.widgetbox.com/widget/crystal-clock'&gt;Crystal Clock</a> widget and many other <a href='http://www.widgetbox.com/'&gt;great free widgets</a> at <a href='http://www.widgetbox.com'&gt;Widgetbox&lt;/a&gt;! Not seeing a widget? (<a href='http://docs.widgetbox.com/using-widgets/installing-widgets/why-cant-i-see-my-widget/'&gt;More info</a>)</noscript>",REGION.WEST);
        _list.add(objGadget);

        objGadget = new Gadget("<script type='text/javascript' src='http://cdn.widgetserver.com/syndication/subscriber/InsertWidget.js'&gt;&lt;/script&gt;&lt;script&gt;if (WIDGETBOX) WIDGETBOX.renderWidget('1ccc3dee-8266-4b84-8191-13a4bf584d0c');</script><noscript>Get the <a href='http://www.widgetbox.com/widget/custom-clock'&gt;Shiny Clock</a> widget and many other <a href='http://www.widgetbox.com/'&gt;great free widgets</a> at <a href='http://www.widgetbox.com'&gt;Widgetbox&lt;/a&gt;! Not seeing a widget? (<a href='http://docs.widgetbox.com/using-widgets/installing-widgets/why-cant-i-see-my-widget/'&gt;More info</a>)</noscript>",REGION.EAST);
        _list.add(objGadget);



    }

    public String getWestRegionGadgets(){
        HtmlOutputText objHtmlOutputText = new HtmlOutputText();
        String strGadgets = "";
        for(Gadget objGadget:_list ){
            if(objGadget.getGadgetRegion() == REGION.WEST){
                strGadgets += objGadget.getGadgetCode();
            }
        }
        return strGadgets;

    }

    public String getEastRegionGadgets(){

        String strGadgets = "";
        for(Gadget objGadget:_list ){
            if(objGadget.getGadgetRegion() == REGION.EAST){
                strGadgets += objGadget.getGadgetCode();
            }
        }
        return strGadgets;

    }


}
+3  A: 

In my JSF page when i do #{IndexBean.EastRegionGadgets} in head it works fine but it doesn't in body. It outputs the HTML as it is.

I suppose you're using <h:outputText> in body to output the HTML. As per the documentation it by default escapes HTML. You need to set its escape attribute to false.

<h:outputText value="#{bean.html}" escape="false" />
BalusC
No actually i was not using anything. I just wrote #{bean.html} in body and wrote everything in HTML. However, the same line worked fine in head tag!
Ankit Rathod
Ah yes, you're using Facelets.
BalusC
Yes i am using Facelets. Do i need to compulsorily use this outputText to output html? from managed bean?
Ankit Rathod
Yes, it by default escapes inline EL in body as well. All just to prevent XSS.
BalusC