Minimal demo to reproduce some issues with myfaces partial update.
To reproduce just run
mvn clean package jetty:runand wait for the server to start up.
Open the url http://localhost:8080/index.xhtml.
It also works for user supplied inputs, open http://localhost:8080/input.xhtml and enter the contents of the illegal-xml-chars.txt file.
Workaround is available at https://github.com/cnsgithub/mojarra-ajax/blob/master/src/main/java/main/IllegalXmlCharactersFilter.java.
Pull request apache/myfaces#27 has been merged into all MyFaces branches. Stay tuned for new release versions.
Open the url http://localhost:8080/maxlength.xhtml and click the Hack button