Preventing XSS attacks in a Spring MVC application controller
Don't use RegEx to prevent XSS attacks!
Why?

Regex is not a tool that can be used to correctly parse HTML.

There are much better ways to prevent XSS attacks.


An example, using your code, modified to use Spring HtmlUtils.
Please note that I changed names s to input and ret to isHtml, as these names indicate what the variable is intended for, rather than just what kind it is.
import org.springframework.web.util.HtmlUtils;

public class HtmlUtils {
    /**
     * Verify if a string contains any HTML characters by comparing its
     * HTML-escaped version with the original.
     * @param String input  the input String
     * @return boolean  True if the String contains HTML characters
     */
    public static boolean isHtml(String input) {
        boolean isHtml = false;
        if (input != null) {
            if (!input.equals(HtmlUtils.htmlEscape(input))) {
                isHtml = true;
            }
        }
        return isHtml;
    }
}

I'm sure there are other things to say about your code, but this is very important.
There is much more to truly preventing XSS attacks, depending on how critical your use case is. This page has a tremendous amount of useful information you may want to consider: XSS (Cross Site Scripting) Prevention Cheat Sheet