XSS的检测存在绕过的可能性

OpenRasp版本：1.0rc2分支编译的最新代码
测试用例集：OpenRASP 官方测试用例集合（002-file-read.jsp）

构造的payload：`http://localhost:8081/vulns/002-file-read.jsp?file=%3Ciframe%20src%3d%22http%3a%2f%2fwww.baidu.com%22%3E`

结果：payload中的成功注入错误回显页面

原因：Response body返回的结果为
` <p>读取内容</p>
<pre>java.io.FileNotFoundException: \localhost\vulns\reports\<iframe src="http:\www.baidu.com"> (文件名、目录名或卷标语法不正确。)</pre>`
与payload（`<iframe src="http://www.baidu.com">`）相比缺少了一个“/”。从而绕过了检测逻辑。

Start with the official test case 002-file-read.jsp and reproduce the URL payload against the 1.0rc2-based build. Inspect how the response body handles the altered iframe value; done means the payload is no longer executable in the error page and the bypass has a regression test.

Written by the indexing model from the issue text.