Our team is developing a project in Angular (FE) + Java/SpringBoot (BE) REST service. Angular app consists of defferent forms to fill, then the data is sent to BE.

We are on the stage of going live and have a list of rules to implement from our security team. One of the rules is:

 The application protects against template injection
 attacks by ensuring that any user input being included is sanitized or sandboxed.

We already added .xssProtection() to our Spring configuration.

Do we need to additionally escape HTML characters in all messages like in example below? What are best practises in Spring to sanitize the input? Or adding the .xssProtection() to Spring Security config is actually enough?

@Bean
public HttpMessageConverter<Object> jsonConverter() {
    StringDeserializer sanitizedStringSerializer = new StringDeserializer() {
        @Override
        public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException {
            String deserializedValue = super.deserialize(p, ctxt);
            return StringEscapeUtils.escapeHtml4(deserializedValue);
        }
    };

    ObjectMapper objectMapper = Jackson2ObjectMapperBuilder
            .json()
            .deserializerByType(String.class, sanitizedStringSerializer)
            .build();
    return new MappingJackson2HttpMessageConverter(objectMapper);
}