Ofbiz: How to escape characters in ofbiz widget

[administractor]

I need to display in browser, a value that comes from url parameters. To avoid XSS attacks this value should to be escaped.

The value is set in PScreens.xml as following :

<screen name="Product">
<section>
 <actions>
  <set field="productId" from-field="parameters.productId"/>
 </actions>
<widgets>
 ...
</widgets>

And is included in PForms.xml :

<field name="productId" tooltip="${uiLabelMap.ProductId} [${productId}]"><text /></field>

Initially I tried to escape the value from PForms.xml:

tooltip="${uiLabelMap.ProductId} [${productId}]"

but I did not found any solution.

Can you suggest a solution to escape the value from PScreens.xml?

<set field="productId" from-field="parameters.productId"/>

Thank You.

[administractor]

Does anyone have any suggestions?

[administractor]

here is a bug in ofbiz, so we are waiting it to be fixed:
https://issues.apache.org/jira/brows...6506?filter=-2

related issues:
http://stackoverflow.com/questions/3...n-ofbiz-widget
http://stackoverflow.com/questions/3...y-xss-in-ofbiz