Spring EL injection and XSS concerns

[eeiswerth]

All,

Is the following susceptible to XSS attacks?

<spring:message code="some.message.with.args" arguments="${userInput}"/>

Assuming that ${userInput} comes directly from the user or from the query string.

For example, if my URL is as follows: www.mysite.com/q=<script>alert('xss')</script>

and I do this in my JSP :

<spring:message code="some.message.with.args" arguments="${param.q}"/>

Is this a XSS vulnerability (i.e., will the script tags be interpreted by the browser)? I believe the answer to be yes.

Furthermore, I am under the impression that to protect against this, one would do the following:

<spring:message code="some.message.with.args" arguments="${fn:escapeXml(param.q)}"/>

Does this sound correct?