JSP ${} expressions in JSF tag attributes

Question

Does anyone know why the expert group decided not to allow ${} style expressions within JSF tag attributes? I understand that a different syntax is needed to implement the 'late binding' #{} expressions used to link input controls to form beans, but not why the JSF tags actually prevent the use of immediately evaluated ${} expressions for accessing variables in the page scope in JSP 2.0.
I know there has been a lot of discussion about this and other threads mention a security loophole that would be opened up by allowing expressions like #{blah.${someProperty}}, but I'm not sure why this sort of thing would cause a problem. Is there any way to enable this behaviour, such as editing the JSF tag library descriptors to allow runtime expressions (horrible though that sounds)? Or perhaps another JSF implementation that supports both immediately evaluated and late-binding expressions? It seems a rather unnecessary restriction that is going to cause much confusion and mistyping for all...
Thanks in advance,
Keith.

Answer 1

Thanks Adam, I see the problem now. It's a fairly obscure loophole but serious nonetheless. Of course, this problem could also be avoided by not using request parameters within JSF tags as it doesn't affect the majority of legitimate uses for expressions.
I have to disagree with you about mixing ${} and #{} expressions though. The majority of developers will be used to writing ${} expressions in JSTL and JSP text and so will expect them to do work the same in JSF tags. Judging by the number of posts in this forum about being unable to use page scope variables in JSF tags this issue is already confusing a lot of people.
As a rule of thumb, "use ${} for expressions that are output to the page and #{} for binding controls to backing beans and invoking methods" (which perform clearly distinct functions) is a lot simpler and easier to learn IMHO than the current one, which is "use ${} for expressions that are output to the page except within a JSF tag, where you use #{} for the same thing and also to update form values and invoke action methods"! (OK, I'm exaggerating a little for effect, but you get the point... :-)
I agree that mixing both types of expression in the same attribute might be a little confusing, but this is an unlikely edge case that should probably be prevented in value binding or action attributes anyway. It's more of an issue for label values where mistyping one for the other is already very common and, although not especially difficult to debug, is just another pitfall awaiting the unwary JSP developer. I'm not sure that JSP expressions would be much more difficult to debug anyway as the value and method bindings will simply not work, which is pretty obvious as soon as you try and test the thing.
Is this something that the EG would be prepared to reconsider for the next release of JSF, or perhaps getting the security loophole addressed in the next JSP spec? In the meantime, is there any reason that developers shouldn't enable runtime expressions in the TLD file provided that they're willing to live with the consequences?
(Sorry to harp on about it, but I've already had several complaints about this after recommending JavaServer Faces for a major development project at ingenta.com.)
Many thanks,
Keith.