I'm answering my own question now that I have figured it. From my calling jsp I set the following:
String height = xssAPI.encodeForHTMLAttr( properties.get("height", ""));
String width = xssAPI.encodeForHTMLAttr( properties.get("width", ""));
.....
then further in the jsp I have:
<script>
cheight=<%= height %>;
cwidth=<%= width %>;
.....
so that when in my calling external js function I can then call:
.....
$picImg.attr("height", cheight+"px");
$picImg.attr("width", cwidth+"px");
.....
The user can then set the height and width via the touch ui generated in the jsp but then rendered by the js function.