Java El and persistent XSS - xss

Question

First of all this is just a POC that seems to be working fine so far, basically I would like to know what you think of this kind of solution.
The problem:
I have this app with lot of EL code and now I'm supposed to prevent XSS errors my current solution so far (does not mean its the only thing I'm going to fix though) only involves preventing XSS in an EL context.
code below is in a jsp page:
This is your car color ${car.color}
car object is set as follows:
ModelAndView mv = new ModelAndView("page3");
String xss = "<script>window.alert('XSS!!');</script>";
Car c = new Car(xss);
mv.addObject("car", c);
return mv;
this way an alert message should popup, nothing new here...
my proposal (which is working ) is as follows
This is your car color${car.color.preventXSS}
this means like "adding" a preventXSS property to every String (I'm not modifying String class), I'm achieving this through a custom EL Resolver which is basically as follows
try {
value = context.getELResolver().getValue(context, base, property);
} catch (PropertyNotFoundException e) {
if ((base instanceof String) && property.equals(PREVENT_XSS)) {
context.setPropertyResolved(true);
value = ESAPI.encoder().encodeForHTML(base.toString());
}
}
where 'base' is in this case has the value <script>window.alert('XSS!!');<;/script>
and 'PREVENT_XSS' is the constant for 'preventXSS' which is the last property in our EL expression.
BTW I'm using OWASP esapi encoder for dealing with XSS, if needed this can be improved by adding other different encodings like encodeForHTMLAttribute and many other that OWASP's esapi supports.
note1: I know I can use an EL function to achieve the same but I wanted to just add 'property' preventXSS without having to include a jsp taglib directive in every page.
note2: I also know about the c:out jstl tag.

Answer 1

Yeah, the solution that you are proposing works, however one issue that I see is that the additional property can be confusing at maintenance time, due to the fact that is not following the EL standards. If you are using Spring MVC, you can take a look of the following approaches to prevent XSS:
Referece 1
Referece 2
Referece 3