Index: forgon-core/src/main/java/com/forgon/xss/request/XSSServletRequest.java =================================================================== diff -u -r34632 -r34638 --- forgon-core/src/main/java/com/forgon/xss/request/XSSServletRequest.java (.../XSSServletRequest.java) (revision 34632) +++ forgon-core/src/main/java/com/forgon/xss/request/XSSServletRequest.java (.../XSSServletRequest.java) (revision 34638) @@ -100,10 +100,14 @@ if(StringUtils.isNotBlank(contentType)){ //用下文的代码可以解决传富文本(带html标签)的参数的问题,但不能解决反射型xss的问题 Entry uriFilterEntry = matchRequestURI(request); - if(uriFilterEntry != null && !StringUtils.equals(uriFilterEntry.getValue(), name)){ + if(uriFilterEntry == null){ String value = request.getParameter(name); return XSSFilterUtil.striptXss(value); } + if(!StringUtils.equals(uriFilterEntry.getValue(), name)){ + String value = request.getParameter(name); + return XSSFilterUtil.striptXss(value); + } return super.getParameter(name); } //用下文的代码可以解决反射型xss问题,但不能解决传富文本(带html标签)的参数的问题