Input-sanitization bypass via escaped delimiter tokenization

Improper input validation in Eclipse Expressly 3.0.3 and earlier allows remote attackers to bypass EL-expression sanitization. The ELParserTokenManager consumes a backslash after a literal dollar sign, leaving the following hash sign unescaped so an escaped deferred-expression delimiter is tokenized and evaluated. Exploitation requires a hosting application to place attacker-controlled text in an EL-evaluated context and rely on escaping or stripping controls; the bypass evaluates attacker-supplied expressions and can lead to code execution in affected applications.