Behaviour detected in versions 6.0.24 and 6.0.26 of Tomcat. Behaviour not present in version 6.0.20 and previous. In a jsp document (jspx), version 2.1 or 2.0, when in an attribute value you specify an EL expression with immediate evaluation (${...}) preceded by a # character, the EL expression is treated as a literal. See this example: <?xml version="1.0" encoding="UTF-8" ?> <jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.0"> <jsp:output omit-xml-declaration="false" doctype-root-element="html" doctype-public="-//W3C//DTD XHTML 1.0 Strict//EN" doctype-system="http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd" /> <jsp:directive.page contentType="text/html; charset=UTF-8" session="false" /> <html xmlns="http://www.w3.org/1999/xhtml" lang="it"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <title>Title</title> </head> <body> <input type="text" value="#${1+1}"/> </body> </html> </jsp:root> The rendered input field contains the text "#${1+1}" (without quotes), while i expected the text "#2" (without quotes): the # character treated as a literal and ${1+1} treated as an eval-expression.
This has been fixed in trunk and proposed for 6.0.x. Note that the root cause was a bug in the definition of literals in the EL spec. I have raised a bug against the EL spec for this.
This has been fixed in 6.0.x and will be included in 6.0.27 onwards.
*** Bug 49495 has been marked as a duplicate of this bug. ***