title: Is the Primefaces p:editor safe to use?
body: <p>I mean, the primefaces p:editor uses html to structure the text, so I have to set the escape attribute of h:outputText to false, to show the output without html tags. </p>
  
  <p>I was trying to play around a bit with this component, and entered the following a javascript:</p>
  
  <pre><code>&lt;script&gt;
      $(document).ready(function(){
          $("div").text("haha");
      })
  &lt;/script&gt;
  </code></pre>
  
  <p>The output was the same (I got a simple text, no js execution) till I turned on the option 'Show Source' and entered the same. Now when I was trying to display the text, te javascript was executed and ruined the page.</p>
  
  <p>So my question would be:
  Is there a vulnerability in my approach, implementation, usage of this component; or the p:editor is so vulnerable? Should I use a simple textarea instead, or is there a way to turn remove this option from the editor?</p>