title: How to use SafeHtml annotation on dto properties?
body: <p>I have a dto which is taken from another API (decompiled class) and in that dto one string field is tagged as SafeHtml to prevent users to inject HTML scripts.</p>
  
  <pre><code>@NotNull
  @SafeHtml(
      whitelistType = WhiteListType.NONE,
      groups = {Default.class}
  )
  @ApiModelProperty(
      value = "The label of customer",
      required = true
  )
  private String label;
  </code></pre>
  
  <p>But when i send request via postman or from frontend -e.g <code>&lt;script&gt;alert('blabla')&lt;/script&gt;</code>- it still accepts this input and executes.</p>
  
  <p>What seems wrong here? Other working examples are own dto class of the project but in this example this dto is a decompiled class from another api, so can it be the reason for it? (I don't think so because this dto's api is also accepting it) so what is wrong?</p>
  
  <p>Or is only specifying SafeHtml not enough and do I need to do something more?</p>
  
  <p>Edit: my controller is:</p>
  
  <pre><code>        @PostMapping("customer/save")
              @ApiOperation("Adds customer")
              public ResponseEntity&lt;CustomerDto&gt; saveCustomer(
                      @ApiParam("Customers to save") @RequestBody CustomerDti customerDto) {
  
      return ResponseEntity.ok(customerService.saveCustomer(customerDto);
  }
  </code></pre>
  
  <p>And note: if i put safehtml on my model class, it works but i do not want it. I want to reject the request immediately whenever it comes so i need to disable it on dto class.</p>