Define the following in your web.xml
<filter>
<filter-name>antisamy-filter</filter-name>
<filter-class>org.owasp.AntiSamyFilter</filter-class>
<init-param>
<param-name>antisamy-policy-file</param-name>
<param-value>c:/directory/policy.xml</param-value>
</init-param>
</filter>