BEA 9.2 Portal issue: downloaded CSV file contains embedded html code

Question

We have J2EE application using BEA 9.2 Portal framework, and one of the page has feature to generate report( in pop up window) in CSV file format. As per the history from previous developer, BEA 8.1 didn't have this issue but, after mirgration to 9.2, they started having file download error( incomplete contents ..). To overcome this issue they commented out setting content length to HttpServletResponse as attached below, but this, now, causes html page source code of the parent page( where submit button is clicked to generate csv file report) being rendered along with actual report in the downloaded CSV file. Has anyone have this sort of issue? If so, can you please share your thoughts? or any thoughts in general?
BEA 9.2 with Portal framework, JDK 15, JSP, Beehive NetUI, Sun Microsystem Solaris server
Here is the source code that avoids setting content length and reasoning behind it..
private static void setResponseHeadersForCSVFile(HttpServletResponse response, String filename, int contentLength)
String mimeType = mimeTypes.getContentType(filename);
response.reset();
response.setContentType(mimeType);
// DON'T explicitly set the content length, since the length of the String or StringBuffer that contains
// the contents of the CSV file will be character encoded when it is actually written to the output stream, based
// upon the character encoding of this JVM App Server's settings. So let the JVM App Server framework apply the character
// encoding AND set the final and truly correct content length header at the time the contents of the String or StringBuffer are truly
// streamed back to the user.
//response.setContentLength(contentLength);
response.addHeader("Content-Disposition", "attachment; filename=\"" + filename + "\"; size=" + contentLength);
}

Answer 1

1) Yes, the old content.tld is available as part of a web library module as a taglib.tld file. The module is: wlp-services-web-lib.war, which can be found in your bea/weblogic92/portal/lib/modules directory.
2) The new API is accessible from the ContentManagerFactory class. This provides access to INodeManager, ITypeManager, ISearchManager, etc. The new API is contained within the com.bea.content.federated package. The 8.1.x API in the com.bea.content.manager package including RepositoryManager, NodeOps, SearchOps, etc. has been deprecated with 9.2.
3) Yes, via the new I*Manager implementations. The entitlement support is for application-scoped visitor roles. Make sure you're using the ISearchManager when performing search operations. This will ensure secure results are returned.