code: public static String restrictHTML (String src, String[] regexes)
      {
          if (StringUtil.isBlank(src)) {
              return src;
          }
  
          ArrayList<String> list = new ArrayList<String>();
          list.add(src);
          for (String regexe : regexes) {
              Pattern p = Pattern.compile(regexe, Pattern.CASE_INSENSITIVE);
              for (int jj=0; jj < list.size(); jj += 2) {
                  String piece = list.get(jj);
                  Matcher m = p.matcher(piece);
                  if (m.find()) {
                      list.set(jj, piece.substring(0, m.start()));
                      list.add(jj + 1, piece.substring(m.start(), m.end()));
                      list.add(jj + 2, piece.substring(m.end()));
                  }
              }
          }
  
          // now, the even elements of list contain untrusted text, the
          // odd elements contain stuff that matched a regex
          StringBuilder buf = new StringBuilder();
          for (int jj=0, nn = list.size(); jj < nn; jj++) {
              String s = list.get(jj);
              if (jj % 2 == 0) {
                  s = s.replace("<", "&lt;");
                  s = s.replace(">", "&gt;");
              }
              buf.append(s);
          }
          return buf.toString();
      }
docs: Restrict HTML from the specified string except for the specified
  regular expressions.