We can disable scripting elements in JSP pages through deployment descriptor configuration like below.
|
1
2
3
4
5
6
|
<jsp-config> <jsp-property-group> <url-pattern>*.jsp</url-pattern> <scripting-invalid>true</scripting-invalid> </jsp-property-group></jsp-config> |
Above url-pattern will disable scripting for all the JSP pages but if you want to disable it only for specific page, you can give the JSP file name itself.
