Is there Java counterpart for Aspnet 4's <%: %> XSS prevention?

Question

I'm developer moving from C# to Java. Heard about new ASP net feature. <%: %>. It renders object with html encoding. Only these impolementing IHtmlString interface are not encoded (to prevent double encoding). See more in http://weblogs.asp.net/scottgu/archive/2010/04/06/new-lt-gt-syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2.aspx

Is such cute tool in Java side? I mean a way to output a string to webpage and (not)encode it based on it's type.

Answer 1

Not entirely sure this is what you need, but we're using c:out in our JSPs for a similar purpose. See here: http://java.sun.com/products/jsp/jstl/1.1/docs/tlddocs/c/out.html

Via escapeXml you can specify whether characters <,>,&,'," in the resulting string should be converted to their corresponding character entity codes. Default value is true.

Answer 2

To the best of my knowledge, there is nothing in java that does this. You can create your own taglib to implement such a thing though.