def secure_decode_query_string(query_str: bytes) -> str:
    """
    Convert to UTF string and remove the ``<>%`` characters that could make
    a Cross Site Scripting attack.

    Args:
        query_str (ByteString): Basically request.query_string, which is the URL parameters as raw bytestring.

    Returns:
        str: Should be the same string utf-8 decoded if there is no attack.
    """
    return (
        query_str.decode("utf-8")
        .translate({ord(c): None for c in "<>"})
        .replace("%3C", "")
    )