<listener>
  <listener-class>ee.ergo.eup.common.security.XmlEscapingELResolverListener</listener-class>
</listener>

import java.beans.FeatureDescriptor;
import java.util.Iterator;
import javax.el.ELContext;
import javax.el.ELResolver;
import org.apache.commons.lang.StringEscapeUtils;

/**
 * {@link ELResolver} which escapes XML in String values.
 */
public class XmlEscapingELResolver extends ELResolver {

	private ThreadLocal<Boolean> excludeMe = new ThreadLocal<Boolean>() {
		@Override
		protected Boolean initialValue() {
			return Boolean.FALSE;
		}
	};

	@Override
	public Class<?> getCommonPropertyType(ELContext context, Object base) {
		return null;
	}

	@Override
	public Iterator<FeatureDescriptor> getFeatureDescriptors(ELContext context, Object base) {
		return null;
	}

	@Override
	public Class<?> getType(ELContext context, Object base, Object property) {
		return null;
	}

	@Override
	public Object getValue(ELContext context, Object base, Object property) {

		try {
			if (excludeMe.get()) {
				return null;
			}

			// This resolver is in the original resolver chain. To prevent
			// infinite recursion, set a flag to prevent this resolver from
			// invoking the original resolver chain again when its turn in the
			// chain comes around.
			excludeMe.set(Boolean.TRUE);
			Object value = context.getELResolver().getValue(context, base, property);

			if (value instanceof String) {
				value = StringEscapeUtils.escapeXml((String) value);
			}
			return value;

		} finally {
			excludeMe.remove();
		}
	}

	@Override
	public boolean isReadOnly(ELContext context, Object base, Object property) {
		return true;
	}

	@Override
	public void setValue(ELContext context, Object base, Object property, Object value) {
	}
}

import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;
import javax.servlet.jsp.JspFactory;

public class XmlEscapingELResolverListener implements ServletContextListener {

	public void contextInitialized(ServletContextEvent event) {
		JspFactory.getDefaultFactory().getJspApplicationContext(event.getServletContext())
				.addELResolver(new XmlEscapingELResolver());
	}

	public void contextDestroyed(ServletContextEvent event) {
	}

}