上传包可“绕过”Java过滤器的检查？

package me.gv7.controller;

import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;


@Controller
@RequestMapping("/test")
public class TestController {

    @RequestMapping(value = "get",method = RequestMethod.GET)
    public String doGet(Model model, String str,String bbb) {
        System.out.println("[+] " + str);
        model.addAttribute("res",str);
        return "get";
    }

    @RequestMapping(value = "post",method = RequestMethod.GET)
    public String post() {
        return "post";
    }

    @RequestMapping(value = "post",method = RequestMethod.POST)
    public String doPost(Model model,String str) {
        System.out.println("[+] " + str);
        model.addAttribute("res",str);
        return "post";
    }

    @RequestMapping(value = "upload",method = RequestMethod.GET)
    public String upload() {
        return "upload";
    }

    @RequestMapping(value = "upload",method = RequestMethod.POST)
    public String doUpload(Model model,String str) {/*@RequestParam("str") */
        System.out.println("[+] " + str);
        model.addAttribute("res",str);
        return "upload";
    }
}

package me.gv7.filter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);
        if (values==null)  {
            return null;
        }

        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i 
            encodedValues[i] = cleanXSS(values[i]);
        }
        return encodedValues;
    }

    public String getParameter(String parameter) {

        String value = super.getParameter(parameter);
        if (value == null) {
            return null;
        }
        return cleanXSS(value);
    }

    public String getHeader(String name) {
        String value = super.getHeader(name);
        if (value == null)
            return null;
        return cleanXSS(value);
    }

    private String cleanXSS(String value) {
        value = value.replaceAll(", "<").replaceAll(">", ">");
//        value = value.replaceAll("(", "(").replaceAll(")", ")");
        value = value.replaceAll("eval((.*))", "");
        value = value.replaceAll("alert((.*?))", "");
        value = value.replaceAll("confirm((.*?))", "");
        value = value.replaceAll("["']
展开收缩
*javascript:(.*)["']", """");
        value = value.replaceAll("(?i)script", "");
        return value;
    }
}

//org.apache.catalina.connector.Request
protected void parseParameters() {
	this.parametersParsed = true;
	Parameters parameters = this.coyoteRequest.getParameters();
	boolean success = false;

	try {
		parameters.setLimit(this.getConnector().getMaxParameterCount());
		...
		parameters.handleQueryParameters();
		if (this.usingInputStream || this.usingReader) {
			success = true;
		} else if (!this.getConnector().isParseBodyMethod(this.getMethod())) {
			success = true;
		} else {
			// 获取请求包ContentType头
			String contentType = this.getContentType();
			...
			// 如果请求ContentType为multipart/form-data，也就是上传POST
			if ("multipart/form-data".equals(contentType)) {
				//对上传包进行解析
				this.parseParts();
				success = true;
				return;
			} else if (!"application/x-www-form-urlencoded".equals(contentType)) {
				success = true;
				return;
			} else {
				int len = this.getContentLength();
				...
				parameters.processParameters(formData, 0, len);
				...
				success = true;
			}
		}
	} 
}

private void parseParts() {
        if (this.parts == null && this.partsParseException == null) {
            MultipartConfigElement mce = this.getWrapper().getMultipartConfigElement();
            if (mce == null) {
                /*
                 Tomcat7.0+ 已经内置了multipart支持，但是必须显示激活,默认关闭。在全局tomcat配置文件context.xml,或者为war的本地context.xml添加开启。
                */
                if (!this.getContext().getAllowCasualMultipartParsing()) {
                    this.parts = Collections.emptyList();
                    return;
                }
                ...
            }
            ...
        }
    }

  private void processParameters(byte[] bytes, int start, int len, Charset charset) {
...
      int decodeFailCount = 0;
      int pos = start;
      int end = start + len;

      label172:
      while(pos 
          int nameStart = pos;
          int nameEnd = -1;
          int valueStart = -1;
          int valueEnd = -1;
          boolean parsingName = true;
          boolean decodeName = false;
          boolean decodeValue = false;
          boolean parameterComplete = false;

          do {
              switch(bytes[pos]) {
              /*如果遇到%(37)和+(43),会对值进行进行URL解码*/
              case 37:
              case 43:
                  if (parsingName) {
                      decodeName = true;
                  } else {
                      decodeValue = true;
                  }

                  ++pos;
                  break;
              /*如果遇到的&(38)，标记该处为参数名和参数值结尾*/
              case 38:
                  if (parsingName) {
                      nameEnd = pos;
                  } else {
                      valueEnd = pos;
                  }

                  parameterComplete = true;
                  ++pos;
                  break;
              /*如果遇到=(61)，标记该处为参数名的结尾，参数值的开始处*/
              case 61:
                  if (parsingName) {
                      nameEnd = pos;
                      parsingName = false;
                      ++pos;
                      valueStart = pos;
                  } else {
                      ++pos;
                  }
                  break;
              default:
                  ++pos;
              }
          } while(!parameterComplete && pos 

          if (pos == end) {
              if (nameEnd == -1) {
                  nameEnd = pos;
              } else if (valueStart > -1 && valueEnd == -1) {
                  valueEnd = pos;
              }
          }
	...
  }