title: JSF SelectItems and escaping (xss)
body: <p>there is a selectOneMenu in my example with a f:selectItems-attribute. The select-items are resolved from my bean like this:</p>
  
  <pre><code>&lt;h:selectOneMenu value="#{bean.value}"&gt;
      &lt;f:selectItems value="#{bean.selectItems}" var="obj" itemValue="#{obj}" itemLabel="#{obj.name}"/&gt;
  &lt;/h:selectOneMenu&gt;
  </code></pre>
  
  <p>The method getSelectItems() in my bean looks like that:</p>
  
  <pre><code>    public List&lt;MyObject&gt; getSelectItems() {
          List&lt;MyObject&gt; list = new LinkedList&lt;MyObject&gt;();
  
          MyObject obj = new MyObject("Peter");
          list.add(obj);
  
          return list;
      }
  </code></pre>
  
  <p>The objects that are displayed are simple objects with a attribute "name".</p>
  
  <p>Nothing special up to this point. But now i change my method to that:</p>
  
  <pre><code> public List&lt;MyObject&gt; getSelectItems() {
          List&lt;MyObject&gt; list = new LinkedList&lt;MyObject&gt;();
  
          MyObject obj = new MyObject("&lt;script&gt;alert('xss is bad');&lt;/script&gt;");
          list.add(obj);
  
          return list;
      }
  </code></pre>
  
  <p>The javascript doesn´t get escaped by MenuRenderer-Class and my page shows me the alert-message.</p>
  
  <p>Is there any cause why the default value of the escape-attribute of SelectItem is "false"?
  How can i fix that problem? (I use Mojarra 2.1.7)</p>