title: @InitBinder with @RequestBody escaping XSS in Spring 3.2.4
body: <p>I am having a <code>@RequestBody</code> annotated argument in my method like this:</p>
  
  <pre><code>@RequestMapping(value = "/courses/{courseId}/{name}/comment", method = RequestMethod.POST)
  @ResponseStatus(HttpStatus.OK)
  public @ResponseBody CommentContainer addComment(@PathVariable Long courseId,
                            @ActiveAccount Account currentUser,
                            @Valid @RequestBody AddCommentForm form,
                            BindingResult formBinding,
                            HttpServletRequest request) throws RequestValidationException {
  
  .....
  }
  </code></pre>
  
  <p>Then I have a <code>@InitBinder</code> annotated method in the same controller:</p>
  
  <pre><code>@InitBinder
  public void initBinder(WebDataBinder dataBinder) {
      dataBinder.registerCustomEditor(AddCommentForm.class, new StringEscapeEditor());
  }
  </code></pre>
  
  <p>My <code>StringEscapeEditor</code> is not running. But my <code>initBinder</code> method is. So it does not mapping my form to the escape editor. This seems right after reading this thread (Where it seems like <code>@RequestMapping</code> is not supported by <code>@InitBinder</code>):</p>
  
  <p><a href="https://stackoverflow.com/questions/12486512/spring-mvc-initbinder-is-not-called-when-processing-ajax-request">spring mvc @InitBinder is not called when processing ajax request</a></p>
  
  <p>And i tested to map a <code>@PathVariable</code> string and then my editor is working.</p>
  
  <p>This is a big deal in my application since most of my bindings is done with <code>@RequestBody</code> and it would be great if i could apply some custom bindings to it.</p>
  
  <p>What is the most common way to solve this problem? and to escape my input data for script attacks.</p>