Home/ Questions/Q 8397773
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T20:52:42+00:00

I’m using spring MVC (spring 3.1.0). I would like to html encode every string

  • 0

I’m using spring MVC (spring 3.1.0).
I would like to html encode every string output from my system due to XSS.
But there are outputs (like links) that I don’t want to encode in that manner – in order to do that I’ve decided to use ContextualSerializer and create a class that implements it.
The method createContextual checks for existence of a custom annotation (@NoHTMLEscap) and determine the JsonSerializer to return.

Here is my annotation:

@Target({ElementType.FIELD, ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@JacksonAnnotation
public @interface NoHTMLEscap {
}

I tried it and it works just great – on POJOs, but here is a case that fails:

@Controller
@RequestMapping(value = "/something")
public class MyController {

    ...

    @RequestMapping(value = "/{id}", method = RequestMethod.GET)
    @ResponseBody
    @ResponseStatus(value = HttpStatus.OK)
    public String getName(@PathVariable String id) {
         return "Here is your answer";
    }
}

Spring sends to jackson the returned value and since this method returns String and not POJO – there is no way to check the existence of my annotation – so I cannot actually use my annotation there…

Is there a way to get this information to Jackson’s serializer?
I’m not sure but I thought that maybe I need to use a spring specific converter which will never escape strings (not really sure if this will solve correctly my issue and how this can be implemented)?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I don’t think jackson can provide a straightforward actual solution for your use-case but I can suggest a different solution.
    If you can afford to have a wrapper object around these Strings, let’s say LinkWrapper, you can add another serializer of LinkWrapper which will just delegate to your current serializer. In your LinkWrapper object you will annotate the String with your annotation and so your delegated serializer will serialize it unencoded.
    Also your output won’t be that of an object since your custom serializer only delegates to that of a string serializer.
    If you need a code sample just say but I think it’s a really simple case of composition.

    • 0