Sanitize remove HTML/XML-Tags from a given string if not escaped. It can be configured in the tobago-config.xml.
If you want to write your own sanitizer, you have to implement
org.apache.myfaces.tobago.sanitizer.Sanitizer
.
Sanitzing can be deactivated for a component using the sanitize
attribute.
But be careful, because of XSS vulnerability.
<tc:out label="Sanitize off" escape="false" sanitize="never" value="#{outController.html}"/>Text in red, green and blue.
Probably you will find no colors here. In that case, the CSP in the browser protectes against inline style.
Further information about CSP in Tobago can be found in the
security section.