We are using an MVC arch and using JSP for view. Our codebase is a bit old and not many people focused on using escapeXML or c:out tags in JSPs which is causing a lot of XSS vulnerabilities now. We are including tags whenever we encounter one but We have more than 1000 JSP pages and it is taking a lot of effort and time to first find XSS issues and then escape them.

Is there a way to do this by default?

I was thinking of having an output filter which escapes http attributes and JSP objects. Is it a good approach? Any possible issues that may arise?