JSTL: How do I account for HTML escape sequences on <C:OUT>?

Question

I have a Java Dynamic Web Project where one of the Servlets does the following:

    /**
     * Servlet implementation class DataAPIServlet
     */
    @WebServlet(name = "data", urlPatterns = { "/data" })
    public class DataAPIServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;
    private String format;   

    /**
     * @see HttpServlet#HttpServlet()
     */
    public DataAPIServlet() {
        super();
    }

    /**
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse 
    response)*/
    protected void doGet(HttpServletRequest request, HttpServletResponse 
    response) throws ServletException, IOException {
        format = request.getParameter("format").replaceAll("\"", "");

        // create data model and add to request object

        RequestDispatcher requestDispatcher = null;

        if (format.equals(null)) {
            requestDispatcher = jsonDispatcher(request);
            response.setContentType("text/json");
        } else {

            System.out.println("SERVING FORMATTED DATA : " + format);
            String returnString;
            switch (format.toLowerCase()) {


            case "xml":
                returnString = Films.getFilmsXML();
                request.setAttribute("data", returnString);
                requestDispatcher = xmlDispatcher(request);
                response.setContentType("text/xml;charset=UTF-8");
                response.setCharacterEncoding("UTF-8");
                break;
            case "csv":
                returnString =  Films.getFilmsCSV();
                request.setAttribute("data",returnString);
                requestDispatcher = csvDispatcher(request);
                response.setContentType("text");
                break;
            case "json":
                returnString =  Films.getFilmsJSON();
                request.setAttribute("data", returnString);
                requestDispatcher = jsonDispatcher(request);
                response.setContentType("text/json");
                response.setContentType("text/json;charset=UTF-8");
                response.setCharacterEncoding("UTF-8");
                break;
            }
        }

        // Forward the request to the view
        requestDispatcher.forward(request, response);
    }

    private RequestDispatcher xmlDispatcher(HttpServletRequest request){
        return request.getRequestDispatcher("xml.jsp");
    }

    private RequestDispatcher jsonDispatcher(HttpServletRequest request) {
        return request.getRequestDispatcher("json.jsp");
    }

    private RequestDispatcher csvDispatcher(HttpServletRequest request){
        return request.getRequestDispatcher("csv.jsp");
    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse 
     response)*/
    protected void doPost(HttpServletRequest request, HttpServletResponse 
    response) throws ServletException, IOException {
        doGet(request, response);
    }

}

One of the servlets spits out the data in xml/json/csv format based on the url query (for exmaple /data?format=json will return json data for all the films in databse).

Through debug I have found that my JAXB/GSON methods are properly creating a data set from my model however when viewed in the response to the browser something is going wrong which likely looks like the HTML escape sequences for special characters such as "<" on xml tags.

This narrows it down to something to do with the "" method in JSTL.

My XML is displayed by the following jsp:

<%@page contentType="application/xml" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<%@ page trimDirectiveWhitespaces="true"%>
<c:set var="data" value="${data}"></c:set>
<c:out value="${data}" />

I can tell the data being passed by the response to the JSP is correct by debug :

Unless the issue with what I'm doing would be resolved by some better mechanism for serving the xml/json/csv data than simply serving it to a jsp file? suggestions welcome.

Answer 1

In the tag of JSTL set escapeXML to false in order to maintain the original characters. Otherwise escapeXML true will do the opposite.

<c:out value='${foo(someParameter)}' escapeXml="false"/>