title: Prevent XSS in Spring MVC controller
body: <p>Hi in my project Veracode reported a XSS issue CWE ID 80. Here in my request handler method:</p>
  
  <pre><code>@RequestMapping(value = "/Update.mvc")
  public @ResponseBody String execute(@ModelAttribute UpdateForm updateForm, BindingResult result,
         HttpServletRequest request, HttpServletResponse response) throws ActionException {
      return executeAjax(updateForm, request, response, result);
  }
  </code></pre>
  
  <p>So executeAjax comes from an abstract class and has different implementations?
  In these implementations user input from the form is get and is manipulated in order to construct the String which is returned.</p>
  
  <p>So my question is :
  Is the Veracode assumption is that in the implementation can have XSS? Or something general?
  - How can prevent this? I always use transforms the input data and it is not returned as the user enters it?
  - So how to prevent it?
  - Do I have to escape all the headers/request paramters from the HttpServiceRequest? </p>
  
  <p><strong>Edit:</strong>
  Do I have to use filters like:
  <a href="https://github.com/ESAPI/esapi-java-legacy/blob/2ff45b140a7e7b527a93bcdbc6bd7a1b3c188aca/src/main/java/org/owasp/esapi/filters/SecurityWrapperRequest.java" rel="nofollow noreferrer">SecurityWrapperRequest</a></p>