Loading JSP pages from custom sources

Question

Would it be possible to execute a JSP page and capture its output outside of a web application? Mode specifically, in my case there still exists a usual web application, but it loads JSP pages not from its classpath, but from an arbitrary source. It seems like I cannot simply get RequestDispatcher and point it to a JSP file on disk.

Answer 1

I think you're better off with a templating engine like velocity. This provides a clean infrastructure for dynamic content that's clearly different from the jsp/servlet stuff that you are asking fore.

That said, I've seen applications that copy jsps into their deployed directory in order for the container to pick them up and translate them. Should you do this, please note that this limits your future options:

• you rely upon your application to be "exploded" - e.g. it can't run directly out of a WAR archive (this might limit your deployment options)
• making jsps editable at runtime might open up security holes if you don't disable scriptlets (also if you do disable, but it'll be somewhat harder...). Disabling scriptlets prohibits real Java code in the jsps, you're limited to tag libraries then.
• You'll need a Java compiler available at runtime, which you might not want to have in production systems - e.g. you cannot precompile your jsps before deployment. Also you pay the usual jsp-translation-penalty at runtime in your productive system.

web.xml configuration for disabling scripting:

<jsp-config>
    <jsp-property-group>
        <url-pattern>*.jsp</url-pattern>
        <scripting-invalid>true</scripting-invalid>
    </jsp-property-group>
</jsp-config>

I hope this web.xml snippet went through, the preview didn't show it correctly...

Update: Tried to make xml-snippet display correctly.