XSS vulnerability in OFBiz forms

[lilian_iatco () yahoo com]

https://issues.apache.org/jira/browse/OFBIZ-6506

In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.

<display-entity entity-name="Table" description="${description}" >

I tried to use bsh, as following:
<display-entity entity-name="Table" description="${bsh: 
org.apache.commons.lang.StringEscapeUtils.escapeHtml(&quot;${description}&quot;)}">

But I get this error:

Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This 
object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a 
value in an immutable entity object. 
(This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot 
set a value in an immutable entity object.)