JSPはXssの脆弱性を防ぐためにフィルタを使用します。

package filter;
 
import java.io.IOException;
 
import javax.servlet;
import javax.servlet.FilterChain;
import javax.servlet;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
 
public class XssFilter implements Filter {
 
 public void init(FilterConfig config) throws ServletException {
 }
 
 public void doFilter(ServletRequest request, ServletResponse response,
 FilterChain chain) throws IOException, ServletException 
 {
 XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
 (HttpServletRequest) request);
 chain.doFilter(xssRequest, response);
}
 
 public void destroy() {
 }
}

package filter;
import javax.servlet.http;
import javax.servlet.http.HttpServletRequestWrapper;
 
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
 HttpServletRequest orgRequest = null;
 
 public XssHttpServletRequestWrapper(HttpServletRequest request) {
 super(request);
 orgRequest = request;
 }
 
 /**
 * Override getParameter method to do xss filtering on both parameter name and parameter value. <br/>
 * If you need to get the original value, get it via super.getParameterValues(name) <br/>
 * getParameterNames, getParameterValues and getParameterMap may also need to be overridden
 */
 @Override
 public String getParameter(String name) {
 String value = super.getParameter(xssEncode(name));
 if (value ! = null) {
 value = xssEncode(value);
 }
 return value;
}
 
/**
 * Override the getHeader method to do xss filtering on both the parameter name and the parameter value. <br/>
 * If you need to get the original value, get it via super.getHeaders(name) <br/>
 * getHeaderNames may also need to override
*/
 @Override
 public String getHeader(String name) {
 
 String value = super.getHeader(xssEncode(name));
 if (value ! = null) {
 value = xssEncode(value);
 }
 return value;
}
 
/**
 * Replace half-corner characters that are prone to xss vulnerabilities directly with full-corner characters
 *
 * @param s
 * @return
*/
private static String xssEncode(String s) {
if (s == null || s.isEmpty()) {
return s;
}
 StringBuilder sb = new StringBuilder(s.length() + 16);
 for (int i = 0; i < s.length(); i++) {
 char c = s.charAt(i);
 switch (c) {
 case '>':
 sb.append('>');// full angle greater than the sign
 break;
 case '<':
 sb.append('<');//full-corner less than sign
 break;
 case '\'':
 sb.append(''');//full-corner single quotes
 break;
 case '\"':
 sb.append('"');//full-corner double quotes
 break;
 case '&':
 sb.append('&');//full-corner
 break;
 case '\\':
 sb.append('＼');//full-angle slash
 break;
 case '#':
 sb.append('#');//full-angle tic-tac-toe
 break;
 default:
 sb.append(c);
 break;
 }
}
 return sb.toString();
}
 
/**
* Get the most primitive request
*
* @return
*/
public HttpServletRequest getOrgRequest() {
return orgRequest;
}
/**
* Static method to get the most primitive request
*
* @return
*/
 public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
 if(req instanceof XssHttpServletRequestWrapper){
 return ((XssHttpServletRequestWrapper)req).getOrgRequest();
}
 
return req;
}
} 

<filter>
<filter-name>xssFilter</filter-name>
 <filter-class>filter.XssFilter</filter-class>
 </filter>
 <filter-mapping>
 <filter-name>xssFilter</filter-name>
 <url-pattern>/*</url-pattern>
</filter-mapping>