Make ${} operator XSS safe in Struts 2 (same as tapestry)

1. Struts2 <s:property value="name" /> is automatically escaped by default;
2. JSTL <c:out value="${name}" /> is automatically escaped by default;
3. JSP EL ${name} is NOT escaped.

You can explicitly escape it with ${fn:escapeXml(name)} , or set the escape to be performed by default creating a custom ELResolver as described in this great article:

• ELResolver Escapes JSP EL Values To Prevent Cross-Site Scripting

Short answer: make it safe either on entry into the app, or on the way to the view layer.

Tapestry's ${} is safe because it's not using JSP/JSP EL. Not escaping stuff is one of the things you lose by using JSP EL's ${} over things like <c:out> and so on.