Consider an app you develop that uses something like the OWASP CSRFGuard library. What can be done to protect against XSS if the app calls a third party black box app that has no way to store and return the token when control is transferred back to your app? I may have no control over sending cookies by the black box app. The URL on the return could include a static parameter that is only known to the server, but that doesn't sound like a solid approach. Any better solutions?
It sounds like you are worried about your web server code trusting a third party library that generates content within your HTTP response. This is a very valid concern.
If all that it generates is CSRF tokens, i.e. some strings, it makes sense to add XSS protection (whitelisting chars, escaping special characters ...). This should eliminate most of the likely XSS vectors that your black-box library introduces.