Checkmark is flagging a cross site scripting issue in JSP.

This is the issue checkmark displaying:

The method “javascript:getdata() embeds untrusted data in generated output with BinaryExpr, at line 114 of main.jsp. This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page.

The code is below:

Code in JSP:

<a href="javascript:getData('${sta.Date}','${sta.EndDate}');">
  <fmt:formatDate value="${sta.EndDate}" pattern="MMM - yy " />
  <c:out value="${caa.selected.number} - ${caa.selected.number} " />
  <c:if test="${not empty sta.statement and  sta.statement!='' and sta.statement != ' '}">
    <c:out value=" - ${sta.statement}" />
  </c:if>
</a>

Code in Javascript file:

function getData(date, endDate) {
  var element1 = document.getElementsByName("selectedDate")[0];
  element1.value = date;
  var element2 = document.getElementsByName("selectedEndDate")[0];
  element2.value = endDate;
  formSubmit("showReport"); 
}

I want help in sanitizing the input so that check mark issue is resolved