@WebFilter(filterName = "XSSFilter", urlPatterns = {"/*"})
public class XSSFilter implements Filter {
...
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        chain.doFilter(new XSSRequestWrapper((HttpServletRequest)request), response);
    }
}

@Configuration
public class AppWebMvcSupport extends WebMvcConfigurationSupport {

    @Override
    public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
        converters.add(converter());
        addDefaultHttpMessageConverters(converters);
    }

    @Bean
    public MappingJackson2HttpMessageConverter converter() {
        MappingJackson2HttpMessageConverter ret = new MappingJackson2HttpMessageConverter();
        ret.setObjectMapper(new CustomObjectMapper());
        return ret;
    }
}

public class CustomObjectMapper extends ObjectMapper {

    public CustomObjectMapper() {
        SimpleModule module = new SimpleModule("xss serializer");
        System.out.println("+++ ");
        //module.addSerializer(new JsonXSSSerializer());
        module.addSerializer(String.class, new JsonXSSSerializer());
        registerModule(module);
        //setSerializationInclusion(JsonInclude.Include.NON_NULL);
    }
}
class JsonXSSSerializer extends JsonSerializer<String> {

    @Override
    public void serialize(String s, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException, JsonProcessingException {
        if(null != s) {
            String val = encodeHtml(s);
            jsonGenerator.writeString(val);
        }
    }

    private String encodeHtml(String s) {
        //clean xss
        System.out.println("!!! " + s);
        return s;
    }

}

module.addSerializer(new JsonXSSSerializer());

module.addSerializer(String.class, new JsonXSSSerializer());

com.fasterxml.jackson.*

org.codehaus.jackson.*