title: How to validate and sanitize HTTP Get with Spring Boot?
body: <p>I keep getting this annoying error from Checkmarx code scanner,</p>
  
  <pre><code>Method getTotalValue at line 220 of src\java\com\example\PeopleController.java 
  gets user input for the personName element. This element’s value then flows through
  the code without being properly sanitized or validated and is eventually 
  displayed to the user. This may enable a Cross-Site-Scripting attack. 
  </code></pre>
  
  <p><strong>Here is my code. I think I did ALL the validation necessary. What else???</strong> </p>
  
  <pre><code>@Slf4j
  @Configuration
  @RestController
  @Validated 
  
  public class PeopleController {
  
      @Autowired
      private PeopleRepository peopleRepository; 
  
      @RequestMapping(value = "/api/getTotalValue/{personName}", method = RequestMethod.GET)
      @ResponseBody
      public Integer getTotalValue(@Size(max = 20, min = 1, message = "person is not found") 
      @PathVariable(value="personName", required=true) String personName) {
  
          PersonObject po = peopleRepository.findByPersonName(
                              Jsoup.clean(personName, Whitelist.basic()));
  
          try {
              return po.getTotalValue(); 
              } catch (Exception e) {
              e.printStackTrace();
              return 0;
          }
      }  
  
  
  @ExceptionHandler
      public String constraintViolationHandler(ConstraintViolationException ex) {
          return ex.getConstraintViolations().iterator().next()
                  .getMessage();
      } 
  
  } 
  </code></pre>
  
  <p>There must be some missing validation. How to validate HTTP GET properly with Spring Boot </p>