Terry's Blog

XSSFilter: public class XSSFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { } @Override public void destroy() { } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response); } } The HttpServletRequest Wrapper: import java.util.regex.Pattern; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; public class XSSRequestWrapper extends HttpServletRequestWrapper { public XSSRequestWrapper(HttpServletRequest servletRequest) { super(servletRequest); } @Override public String[] getParameterValues(String parameter) { String[] values = super.getParameterValues(parameter); if (values == null) { return null; } ...

You should HTML escape any input before outputting it back to the user. OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet Consider using   StringEscapeUtils.escapeHtml()   from   Apache Commons Lang Or use   HtmlUtils.htmlEscape()   from   Spring XSS attack prevention XSS prevention in Java JSoup whitelist sanitizer How to encode and store string to prevent XSS