  public FilterRegistrationBean<XssFilter> croseSiteFilter(){
      FilterRegistrationBean<XssFilter> registrationBean 
        = new FilterRegistrationBean<>();
          
      registrationBean.setFilter(new XssFilter());
      registrationBean.addUrlPatterns("/*");
          
      return registrationBean;    
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.