SecurityInnovation/TMContentReview — Issue #19: All Untrusted Data in HTML Contexts Is Escaped in JSF
Author: SergeTruth
Created: 2011-11-07 22:13:56+00:00
State: open

You need to describe what the HTML context is. This guidance will cause developers to just blindly HTML encode data which is rendered out to any HTML page without considering the output context.

Probably need references to the OWASP XSS Cheatsheet and OWASP DOM based XSS cheatsheet.