How to prevent Cross Site Scripting when input using "Full HTML" mode of CKEditor
See the documentation:


  Finally, it should be obvious that the Full HTML input format, which
  does not use the HTML Filter, is insecure and should be offered only
  to those users who can be trusted not to ruin your site. Most sites
  will be better off deleting this input format.


https://www.drupal.org/node/213156



"A solution that we can encode the output in theme preprocessing hook. But it seems require us to add a lot of codes because our system may have many entity types and fields."

Don't do this in preprocessing. You can configure your own safe text format containing as many text filters as you want. If the built in text filters don't provide the security you need then add a custom filter.



Core ships with Full HTML so that site owners are able to create basic pages in CKEditor using almost all HTML features, which they can do anyway when they have access to the template files.