title: How to prevent XSS attacks with SpringMVC + Jackson Application?
body: <p>The <a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet" rel="nofollow noreferrer">Cross Site Scripting Cheat Sheet</a> has many rules for securing against XSS attacks. I would like to implement those suggestions in my web app which is using Spring MVC + Jackson + JPA  + Hibernate Bean Validation. As an example consider the following code that is similar to what I have in my app.</p>
  <pre><code>public class MessageJson {
      @NotEmpty // Bean Validation annotation  
      private String title; 
  
      @NotEmpty
      private String body; 
  
      // ... etc getters / setters
  }
  
  public class BolgPostController 
  { 
       
       @RequestMapping(value=&quot;messages&quot;,method=RequestMethod.POST) 
       public void createMessage(@Valid @RequestBody MessageJson message)
       {
             // **Question** How do I check that the message title and body don't contain 
             // nasty javascripts and other junk that should not be there? 
  
             // Call services to write data to the datababse
       }
  
       @RequestMapping(value=&quot;messages&quot;,method=RequestMethod.get) 
       public @ResponseBody List&lt;MessageJson&gt; createMessage()
       {
             // get data from the database 
  
             // **Question** How do I escape all the data in the list of MessageJson before 
              I send it back to the data. 
       }
  }
  </code></pre>
  <p>I can see the following ways to implement the cheat sheet rules:</p>
  <ul>
  <li><strong>Option A</strong> Implement them manually in each controller method.</li>
  <li><strong>Option B</strong> Configure some extension to Spring MVC that can do it for me automatically</li>
  <li><strong>Option C</strong> Configure Jackson so that it can do it for me since most of my input/output goes through Jackson</li>
  </ul>
  <p>I am looking for some example configurations of SpringMVC in any of those three options, with a preference for option B and C.</p>