title: How to avoid Cross Site Scripting (XSS) attacks while using JSF and RichEditor
body: <p>I am using Rich Editor for user input text box on an all-JSF platform. I am trying to avoid XSS attacks on this text field.</p>
  
  <p>The requirement is that</p>
  
  <ul>
  <li>the user can enter any character in the text box,</li>
  <li>the rich editor should display non-encoded values or the editor
  should not display <code>&amp;lt;</code> for <code>&lt;</code>,</li>
  <li>Cross-Site-Scripting (XSS) should be avoided.</li>
  </ul>
  
  <p>So the problem is that since we have to display the values correctly, we put <code>escape=false</code> for outputtext, but it then becomes vulnerable to XSS attacks.</p>
  
  <p>I tried using jsoup for filtering the HTML tags but it seems that the input automatically gets encoded and jsoup cannot be used.</p>
  
  <p>So my questions are the following.</p>
  
  <ol>
  <li>Is there a better approach of avoiding XSS attacks for rich editor
  with <code>escape=false</code>?</li>
  <li>It looks like the text input is encoded when it reaches the save
  phase so I have not been able to filter with jsoup. How does JSF
  internally work in terms of encoding and decoding the text values.
  At which point can a script run?</li>
  <li>If it happens to be encoded internally just after getting the input
  do I need to worry about XSS attack?</li>
  <li>Also, there is a software Parse and it is being used to intercept a request. Is this a common tool for hacking and how this can be used to have a potential attack and how to avoid it in the present scenario. In specific, does it make any difference if a person intercepts the request as this software does for a normal request?</li>
  </ol>