Configuring Custom JSONDeserializer in Spring Boot 2.3 with MVC

I'm trying to add custom json deserializer for filtering certain text (like , for xss) in my application with @JsonComponent. All works fine until I add @EnableWebMvc to my main class. After adding mvc annotation deserialize method of json deserializer is not invoked. @EnableWebMvc is required since I upload some data in multipart request.

@JsonComponent
public class Deserializer extends JsonDeserializer<String> implements ContextualDeserializer {

        @Override
    public String deserialize(JsonParser parser, DeserializationContext ctxt)
            throws IOException {
        String value = parser.getValueAsString();
            return Jsoup.clean(value, Whitelist.basic()), true);
        }
    }


    @Override
    public JsonDeserializer<String> createContextual(DeserializationContext ctxt, BeanProperty property) throws JsonMappingException {
        return this;
    }
}

This works ->

@SpringBootApplication
public class App {

    public static void main(String[] args) {
        SpringApplication.run(App.class, args);
    }
}

This does not ->

@SpringBootApplication
@EnableWebMvc
public class App {

    public static void main(String[] args) {
        SpringApplication.run(App.class, args);
    }
}

So my question is does @EnableWebMvc stops custom deserializer from functioning and is whether custom deserializer itself is best practice for such requirement.

Also is there some other of doing this filtering like via spring security.