title: Using GSP views in plain Spring MVC without Grails
body: <p>I would like to use GSP views instead of JSP/JSTL views in a plain old Spring MVC application. I have added a groovy.servlet.TemplateServlet to web.xml like this:</p>
  
  <pre><code>&lt;servlet&gt;
      &lt;servlet-name&gt;GroovyTemplate&lt;/servlet-name&gt;
      &lt;servlet-class&gt;groovy.servlet.TemplateServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
              &lt;param-name&gt;template.engine&lt;/param-name&gt;
              &lt;param-value&gt;groovy.text.GStringTemplateEngine&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;GroovyTemplate&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.gsp&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>And setup a Spring InternalResourceViewResolver to load the GPS files. Upto this point it all works fine, but to expose the values in the Model to the template I had to do some tricks (subclassing TemplateServlet and adding them to the ServletBinding).</p>
  
  <p>Now my next obstacle is that JSTL by default escapes XML when using the c:out tag and Grails has the notion of codecs to automatically escape values used in a GSP. The template method described above does not escape by default, which requires the developers to be very careful to avoid XSS vulnerabilities.</p>
  
  <p>Is there another (better) way to use GSP including automatic escaping in a plain Spring MVC application without using Grails?</p>