title: How to prevent code injection with EL expression
body: <p>While I am using the JSF and I am trying to find the ValueExpression with below code:</p>
  
  <pre><code>public static final ValueExpression createValueExpression(
              final FacesContext context, final ELContext elContext,
              final String ev, final Class classType) {
          return context.getApplication().getExpressionFactory()
              .createValueExpression(elContext, ev, classType);
      }
  </code></pre>
  
  <p>But When I am running these code on HP fortify says that Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.
  It seems there is a risk of code injection with EL expression evaluation.
  But I know there is the code vulnerability so I want to know How Can I prevent the EL injection?</p>
  
  <p>Could anyone help on the same?</p>