How can we disable java code or scripting in JSP page?

We can disable scripting elements in JSP pages through deployment descriptor configuration like below.

<jsp-config>

    <jsp-property-group>

        <url-pattern>*.jsp</url-pattern>

        <scripting-invalid>true</scripting-invalid>

    </jsp-property-group>

</jsp-config>

 

Above url-pattern will disable scripting for all the JSP pages but if you want to disable it only for specific page, you can give the JSP file name itself.