如何将字符串作为HTML代码从Java文件读取到JSP页面？

Question

I am creating a simple web application program (uses JSP) wherein users can add, update, and delete an employee record. In adding a new record, user is not allowed to enter null values of last and given names. An error message will be displayed if user attempts to add record with a null value. Error messages are generated from String in a Java file (action). However, the String contains HTML tags. They are not read as an HTML code, but as HTML entities.

Here is the method from my action Java file, which generates the error message:

final static String SUCCESS_MSG = "New record has been added successfully.";
final static String ERROR_MSG = "Not valid. ";

public String addEmployee() throws Exception
{
    logger.info("addEmployee method called");
    if (!this.employee.getLastname().isEmpty()
            && !this.employee.getFirstname().isEmpty())
    {
        this.employeeManager.addEmployee(this.employee);

        addActionMessage(SUCCESS_MSG);
        return SUCCESS;
    }
    else
    {
        addActionError(ERROR_MSG + (this.employee.getFirstname().isEmpty() ? "<b>First name</b>" :
                this.employee.getLastname().isEmpty() ? "<b>Last name</b>" :
                        "<b>First</b> and <b>last names</b>") + " is null.");
        return ERROR;
    }
}

Here is from my JSP file, where the messages will be displayed:

<s:if test="hasActionMessages()">
  <div class="alert alert-success" role="alert">
   <span class="glyphicon glyphicon-ok"></span>
  <s:actionmessage />
 </div>
</s:if>

<s:if test="hasActionErrors()">
 <div class="alert alert-danger" role="alert">
  <span class="glyphicon glyphicon-remove"></span>
   <s:actionerror />
 </div>
</s:if>

And here is the output: view image here .

I checked the HTML source code. Less and greater than in the HTML tags were converted to HTML entities.

<ul class="errorMessage">
 <li><span>Not valid. &lt;b&gt;First name&lt;/b&gt;</span>
 </li>
</ul>

Answer 1

This is actually the desired behaviour. Inserted text is inherently untrustworthy as it my contain user supplied markup/javascript that will break your layout, or worse, insert cross-site scripting and other undesirable behaviour.

You shouldn't be embedding html into your code like that. It would be better to have the message stored in a separate property file and have the case specific value inserted at runtime. For example, the property file would have:

invalid.name=Not valid. {0}

The name would be inserted at runtime.