HTML-escaped security bug fix [ issue #188 ]

[aswinijena100]

PR contains issues fix for User data should be HTML-escaped for web display .

[nikklassen]

I don't feel very comfortable with this solution, it relies too much on programmers remembering to clean their inputs. I would prefer using @Valid annotation, like this blog post, or a global filter like this blog post.

I prefer the @Valid annotation because this pattern can be used for lots of other types of validation too, which I mentioned in #409 as a way to clean up our controller code.

[nikklassen]

I would prefer to use a standard sanitizer here, like the one from jsoup, instead of writing our own.

[aswinijena100]

I have removed the custom logic to handle XSS attacked and implemented standard sanitizer (jsoup) by extending PropertyEditorSupport class. Please review and let us know.

[nikklassen]

This looks pretty good, but can you add the @InitBinder to a @ControllerAdvice so that it is automatically applied to all Controllers?

[aswinijena100]

This looks pretty good, but can you add the @InitBinder to a @ControllerAdvice so that it is automatically applied to all Controllers?

Yes, done the changes now to use @ControllerAdvice and added @Initibinder in it instead of adding in each controller classes.