Attached test case that shows this issue.

Steps:

• Load welcomeICEfaces.jsf to see the issue. The first components are the standard JSF components.

This is an issue in the core framework. An easy way to appreciate this issue is to run the application with no other jars but the mojarra jar and see that the less than and greater than symbols on the page are correctly escaped. Then, the application can be run again adding only icefaces.jar, and those same symbols won't be escaped correctly on the page. No other icefaces components need to be on the page.

It seems like all the <option> elements are passed as plan text to one of the write() methods in DOMResponseWriter. The following text is passed as the string argument of the write() method for these h:* components:

        <option value="1.0" selected="true">hello</option>
        <option value="2.0">hello <world</option>
        <option value="3.0">8 > 3</option>
        <option value="4.0">9 = 9</option>

The less than and greater than symbols in the body are passed unescaped to this method. If we escaped that entire piece of text, we would also be escaping the tag delimiters, which wouldn't have the desired effect.

The only solution I have in mind is to add some code specifically for this case. If we detect a piece of text that starts with '<option' and ends with '</option>', we parse it, extracting the body of these tags (and the attribute values) and escaping them.

I don't know what calls this write() method in DOMResponseWriter and passes the rendered markup of standard h:* components. Perhaps the original text is escaped, but it's unescaped by us at some point. Detecting this could also fix the issue.

This issue can also be reproduced in the 4.0 trunk.

Due to the lack of a viable solution for this and the fact that the ice:selectOneMenu and ice:selectOneListbox components are readily available for use and do not suffer from this limitation, marking this as "Won't Fix".