PermittedTaglibsTLV checks the XML view of a page to determine which tag libraries are permitted to be used. It does this by examining the xmlns declarations on the <jsp:root> element. This work for pages using standard JSP format because all taglib directives are translated to declarations on that root element. However, for JSP documents (.jspx XML files), the declarations are left as xmlns declarations on nested elements and so are not detected.
A simple JSP Document produces the following XML View: <?xml version="1.0" encoding="UTF-8" ?> <jsp:root version="2.0" xmlns:jsp="http://java.sun.com/JSP/Page" jsp:id="0"> <jsp:directive.page jsp:id="1" pageEncoding="UTF-8" contentType="text/xml;charset=UTF-8"/> <o:doc xmlns:d="urn:dump" xmlns:o="urn:out" jsp:id="2"> <x:hello xmlns:x="urn:jsptagdir:/WEB-INF/tags/test" jsp:id="3"/> </o:doc> </jsp:root> In this view, the 'd' and 'x' prefixes refer to tag libraries but the 'o' prefix is part of the output text. Without access TagLibraryInfo I do not see a way determine that 'urn:dump' refers to a taglib but that 'urn:out' does not.
Test case added in http://svn.apache.org/r1642801 Documented that this TLV does not detect tags in JSP2.0 Documents. Closing as WONTFIX