Spring Boot escape characters at Request Body for XSS protection

Question

I\'m trying to secure my spring boot application using a XSSFilter like this:

public class XSSFilter implements Filter {

    @Override
    public void init(         


        

Answer 1

1. Have a local String field in XSSRequestWrapper which holds the cleaned-up body (probably not suitable for large bodies).
2. Populate this field in the constructor by reading request.getInputStream() and cleaning up the body the same way as parameters.
3. Override getInputStream and getReader methods of HttpServletRequestWrapper, and construct an InputStream (string -> byte array -> ByteArrayInputStream) and Reader (StringReader) from the String field and return them respectively. Maybe cache the constructed InputStream and Reader objects for better performance for when the methods are called repeatedly.

You may also be interested in cleaning up JSON when it is being deserialized into Java object.