How to use annotations for XSS defense

<!--JSR-303/JSR-380Annotations for verification -->
<dependency>
    <groupId></groupId>
    <artifactId>spring-boot-starter-validation</artifactId>
    <version>2.6.7</version>
</dependency>

implementation ':spring-boot-starter-validation:2.6.7'

package ;
import ;
import ;
import ;
import ;
import ;
import ;
@Target(value = {, , , })
@Retention()
@Constraint(validatedBy = )
public @interface Xss {
    String message() default "Illegal input, potential XSS detected";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

package ;
import ;
import ;
import ;
import ;
import ;
/**
  * xss annotation verification
  */
public class XssValidator implements ConstraintValidator<Xss, String> {
    /**
      * Use the relaxed whitelist that comes with jsoup
      */
    private static final Whitelist WHITE_LIST = ();
    /**
      * Define the output settings and turn off prettyPrint (prettyPrint=false), the purpose is to avoid formatting the code during the cleaning process.
      * This keeps the consistency of input and output content.
      */
    private static final  OUTPUT_SETTINGS = new ().prettyPrint(false);
    /**
      * Verify that the input value is valid, that is, whether it contains a potential XSS attack script.
      *
      * @param value Enter value, XSS attack script cleaning is required.
      * @param context object that provides information about the verification environment, such as customization of error messages when verification fails.
      * @return If the cleaned value is the same as the original value, it returns true, which means the input value is valid; otherwise, it returns false, which means the input value is invalid.
      */
    @Override
    public boolean isValid(String value, ConstraintValidatorContext context) {
        // Here we first parse the value and encode the single < and > characters in it        String oldBody = (value).body().html();
        // Use the Jsoup library to clean up the input values ​​to remove potential XSS attack scripts.        // Use predefined whitelisting and output settings to ensure that only secure HTML elements and attributes are retained.        String newBody = (value, "", WHITE_LIST, OUTPUT_SETTINGS);
        // Compare whether the cleaned value is the same as the parsed value. The difference indicates that the xss script is filtered        // The value and newBody are not used here, because jsoup will encode a single < and > character in the value. If there is a single < in the value, the value and newBody will be different.        return (newBody);
    }
}

package ;
import ;
import ;
import ;
import ;
import ;
/**
  * Xss local defense post request
  */
@RestController
@RequestMapping("/xss/local")
public class XssLocalPostController {
    /**
      * Use annotations to intercept xss in POST requests, and add @Xss or @Validated annotations to the attributes that need to be intercepted by the entity class.
      *
      * @param userLocalLoginPojo Entity Class
      * @return Entity Class
      */
    @PostMapping("/test")
    public UserLocalLoginPojo test(@Valid @RequestBody UserLocalLoginPojo userLocalLoginPojo) {
        return userLocalLoginPojo;
    }
}

package ;
import ;
@Data
public class UserLocalLoginPojo {
    @Xss
    private String userAccount;
}

{
    "userAccount": "<iframe οnlοad='alert(0)'>demoData</iframe>"
}

package ;
import ;
import .*;
/**
  * Xss local defense get request
  */
@RestController
@RequestMapping("/xss/local")
@Validated
public class XssLocalGetController {
    /**
      * Use annotations to intercept xss in the get request, add @Xss before the method parameters, and note that the @Validated annotation should be added to the class.
      *
      * @param userAccount Request parameters
      * @return Request Parameters
      */
    @GetMapping("/test")
    public String test(@Xss String userAccount) {
        return userAccount;
    }
}