title: Make ${} operator XSS safe in Struts 2 (same as tapestry)
body: <p>As mentioned in <a href="http://www.disasterarea.co.uk/blog/xss-vulnerabilities-in-web-frameworks-2/" rel="nofollow">http://www.disasterarea.co.uk/blog/xss-vulnerabilities-in-web-frameworks-2/</a></p>
  
  <blockquote>
    <p>The ${} is not xss safe in struts 2 while it is safe in tapestry 5.</p>
  </blockquote>
  
  <p>I am not a Tapestry guy, but I want to know if above is correct.</p>
  
  <p>As far as I know the <code>${}</code> is part of JSLT and it does not depend on any web frameworks. So if above sentence is correct and the <code>${}</code> is XSS safe in tapestry, how can we make it safe in struts 2.</p>
  
  <p>Updated:</p>
  
  <p>To test it I run struts2-showcase app, opened <code>modelDriven\modelDrivenResult.jsp</code> and add below line:</p>
  
  <pre><code>Am I safe  ${name} 
  </code></pre>
  
  <p>Now when you run the show case and enter <code>&lt;script&gt; alert('xxxx') &lt;/script&gt;</code> as gangester name you can see the alert!</p>