We are in the case of constant-strings. The javadocs are not changed during the runtime. I guess we won't add malicious code in our javadoc in order to do cross-site scripting :)