class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    //没被包装过的HttpServletRequest（特殊场景，需要自己过滤）
    HttpServletRequest orgRequest;
    //html过滤
    private final static HTMLFilter htmlFilter = new HTMLFilter();

    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        orgRequest = request;
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {<FILL_FUNCTION_BODY>}

    @Override
    public String getParameter(String name) {
        String value = super.getParameter(xssEncode(name));
        if (StringUtils.isNotBlank(value)) {
            value = xssEncode(value);
        }
        return value;
    }

    @Override
    public String[] getParameterValues(String name) {
        String[] parameters = super.getParameterValues(name);
        if (parameters == null || parameters.length == 0) {
            return null;
        }

        for (int i = 0; i < parameters.length; i++) {
            parameters[i] = xssEncode(parameters[i]);
        }
        return parameters;
    }

    @Override
    public Map<String, String[]> getParameterMap() {
        Map<String, String[]> map = new LinkedHashMap<>();
        Map<String, String[]> parameters = super.getParameterMap();
        for (String key : parameters.keySet()) {
            String[] values = parameters.get(key);
            for (int i = 0; i < values.length; i++) {
                values[i] = xssEncode(values[i]);
            }
            map.put(key, values);
        }
        return map;
    }

    @Override
    public String getHeader(String name) {
        String value = super.getHeader(xssEncode(name));
        if (StringUtils.isNotBlank(value)) {
            value = xssEncode(value);
        }
        return value;
    }

    private String xssEncode(String input) {
        return htmlFilter.filter(input);
    }

    /**
     * 获取最原始的request
     */
    public HttpServletRequest getOrgRequest() {
        return orgRequest;
    }

    /**
     * 获取最原始的request
     */
    public static HttpServletRequest getOrgRequest(HttpServletRequest request) {
        if (request instanceof XssHttpServletRequestWrapper) {
            return ((XssHttpServletRequestWrapper) request).getOrgRequest();
        }

        return request;
    }

}

        //非json类型，直接返回
        if (!MediaType.APPLICATION_JSON_VALUE.equalsIgnoreCase(super.getHeader(HttpHeaders.CONTENT_TYPE))) {
            return super.getInputStream();
        }

        //为空，直接返回
        String json = IOUtils.toString(super.getInputStream(), "utf-8");
        if (StringUtils.isBlank(json)) {
            return super.getInputStream();
        }


        //xss过滤
        final XssIgnoreConfig xssIgnoreConfig = SpringContextUtils.getBean(XssIgnoreConfig.class);
        final String requestURI = orgRequest.getRequestURI();
        if (xssIgnoreConfig == null || !xssIgnoreConfig.isContains(requestURI)) {
            json = xssEncode(json);
        }
        final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8"));
        return new ServletInputStream() {
            @Override
            public boolean isFinished() {
                return true;
            }

            @Override
            public boolean isReady() {
                return true;
            }

            @Override
            public void setReadListener(ReadListener readListener) {

            }

            @Override
            public int read() throws IOException {
                return bis.read();
            }
        };
    
<methods>public void <init>(javax.servlet.http.HttpServletRequest) ,public boolean authenticate(javax.servlet.http.HttpServletResponse) throws java.io.IOException, javax.servlet.ServletException,public java.lang.String changeSessionId() ,public java.lang.String getAuthType() ,public java.lang.String getContextPath() ,public javax.servlet.http.Cookie[] getCookies() ,public long getDateHeader(java.lang.String) ,public java.lang.String getHeader(java.lang.String) ,public Enumeration<java.lang.String> getHeaderNames() ,public Enumeration<java.lang.String> getHeaders(java.lang.String) ,public javax.servlet.http.HttpServletMapping getHttpServletMapping() ,public int getIntHeader(java.lang.String) ,public java.lang.String getMethod() ,public javax.servlet.http.Part getPart(java.lang.String) throws java.io.IOException, javax.servlet.ServletException,public Collection<javax.servlet.http.Part> getParts() throws java.io.IOException, javax.servlet.ServletException,public java.lang.String getPathInfo() ,public java.lang.String getPathTranslated() ,public java.lang.String getQueryString() ,public java.lang.String getRemoteUser() ,public java.lang.String getRequestURI() ,public java.lang.StringBuffer getRequestURL() ,public java.lang.String getRequestedSessionId() ,public java.lang.String getServletPath() ,public javax.servlet.http.HttpSession getSession() ,public javax.servlet.http.HttpSession getSession(boolean) ,public Map<java.lang.String,java.lang.String> getTrailerFields() ,public java.security.Principal getUserPrincipal() ,public boolean isRequestedSessionIdFromCookie() ,public boolean isRequestedSessionIdFromURL() ,public boolean isRequestedSessionIdFromUrl() ,public boolean isRequestedSessionIdValid() ,public boolean isTrailerFieldsReady() ,public boolean isUserInRole(java.lang.String) ,public void login(java.lang.String, java.lang.String) throws javax.servlet.ServletException,public void logout() throws javax.servlet.ServletException,public javax.servlet.http.PushBuilder newPushBuilder() ,public T upgrade(Class<T>) throws java.io.IOException, javax.servlet.ServletException<variables>