diff --git a/pigx-common/pigx-common-bom/pom.xml b/pigx-common/pigx-common-bom/pom.xml
index 11dc85ede..134a547a6 100644
--- a/pigx-common/pigx-common-bom/pom.xml
+++ b/pigx-common/pigx-common-bom/pom.xml
@@ -20,6 +20,7 @@
 		<pigx.version>3.10.0</pigx.version>
 		<mybatis-plus.version>3.4.0</mybatis-plus.version>
 		<dynamic-ds.version>3.2.0</dynamic-ds.version>
+		<mica.version>2.0.8-GA</mica.version>
 		<druid.version>1.2.1</druid.version>
 		<mysql.connector.version>8.0.21</mysql.connector.version>
 		<swagger.core.version>1.5.22</swagger.core.version>
@@ -201,6 +202,12 @@
 				<artifactId>spring-security-oauth2</artifactId>
 				<version>${security.oauth.version}</version>
 			</dependency>
+			<!--xss 过滤组件-->
+			<dependency>
+				<groupId>net.dreamlu</groupId>
+				<artifactId>mica-xss</artifactId>
+				<version>${mica.version}</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/pigx-common/pigx-common-security/pom.xml b/pigx-common/pigx-common-security/pom.xml
index 2592a3b19..a559ce1b6 100644
--- a/pigx-common/pigx-common-security/pom.xml
+++ b/pigx-common/pigx-common-security/pom.xml
@@ -58,5 +58,10 @@
 			<groupId>org.springframework.data</groupId>
 			<artifactId>spring-data-redis</artifactId>
 		</dependency>
+		<!--xss 安全过滤-->
+		<dependency>
+			<groupId>net.dreamlu</groupId>
+			<artifactId>mica-xss</artifactId>
+		</dependency>
 	</dependencies>
 </project>
diff --git a/pigx-gateway/pom.xml b/pigx-gateway/pom.xml
index 928c526ad..144d80d62 100644
--- a/pigx-gateway/pom.xml
+++ b/pigx-gateway/pom.xml
@@ -63,11 +63,6 @@
 			<artifactId>captcha-spring-boot-starter</artifactId>
 			<version>${captcha.version}</version>
 		</dependency>
-		<!--hutool-->
-		<dependency>
-			<groupId>com.pig4cloud</groupId>
-			<artifactId>pigx-common-core</artifactId>
-		</dependency>
 		<!--缓存-->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
diff --git a/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java b/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java
index e4761b871..c09d62c03 100755
--- a/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java
+++ b/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java
@@ -12,6 +12,7 @@ import lombok.extern.slf4j.Slf4j;
 import me.chanjar.weixin.mp.api.WxMpService;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlMessage;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlOutMessage;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.web.bind.annotation.*;
 
@@ -39,6 +40,7 @@ public class WxPortalController {
 	 * @param echostr 随机字符串
 	 * @return
 	 */
+	@XssCleanIgnore
 	@GetMapping(produces = "text/plain;charset=utf-8")
 	public String authGet(@PathVariable("appId") String appId,
 			@RequestParam(name = "signature", required = false) String signature,
@@ -76,6 +78,7 @@ public class WxPortalController {
 	 * @param nonce 随机数
 	 * @return
 	 */
+	@XssCleanIgnore
 	@PostMapping(produces = "application/xml; charset=UTF-8")
 	public String post(@PathVariable("appId") String appId, @RequestBody String requestBody,
 			@RequestParam("signature") String signature, @RequestParam("timestamp") String timestamp,
diff --git a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java
index 353599e29..00f6e17fb 100644
--- a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java
+++ b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java
@@ -20,6 +20,7 @@ package com.pig4cloud.pigx.act.controller;
 import com.pig4cloud.pigx.act.service.EditorService;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
 import lombok.AllArgsConstructor;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**
@@ -44,6 +45,7 @@ public class EditorController {
 		return editorService.getEditorJson(modelId);
 	}
 
+	@XssCleanIgnore
 	@PutMapping("/model/{modelId}/save")
 	public void saveModel(@PathVariable(value = "modelId") String modelId, String name, String description,
 			@RequestParam("json_xml") String jsonXml, @RequestParam("svg_xml") String svgXml) {
diff --git a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java
index f1bd25bb2..5f69db49b 100755
--- a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java
+++ b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java
@@ -26,6 +26,7 @@ import com.pig4cloud.pigx.common.core.constant.enums.TaskStatusEnum;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
 import lombok.AllArgsConstructor;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**
@@ -70,6 +71,7 @@ public class LeaveBillController {
 	 * @return R
 	 */
 	@PostMapping
+	@XssCleanIgnore
 	public R save(@RequestBody LeaveBill leaveBill) {
 		leaveBill.setUsername(SecurityUtils.getUser().getUsername());
 		leaveBill.setState(TaskStatusEnum.UNSUBMIT.getStatus());
@@ -82,6 +84,7 @@ public class LeaveBillController {
 	 * @return R
 	 */
 	@PutMapping
+	@XssCleanIgnore
 	public R updateById(@RequestBody LeaveBill leaveBill) {
 		return R.ok(leaveBillService.updateById(leaveBill));
 	}
diff --git a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java
index 148544289..bbd3a48d4 100644
--- a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java
+++ b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java
@@ -24,6 +24,7 @@ import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
 import lombok.AllArgsConstructor;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
@@ -55,6 +56,7 @@ public class TaskController {
 	}
 
 	@PostMapping
+	@XssCleanIgnore
 	public R submitTask(@RequestBody LeaveBillDto leaveBillDto) {
 		return R.ok(actTaskService.submitTask(leaveBillDto));
 	}
diff --git a/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java b/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java
index c9d277f9d..f7ce26a72 100755
--- a/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java
+++ b/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java
@@ -32,6 +32,7 @@ import io.swagger.annotations.Api;
 import lombok.AllArgsConstructor;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
@@ -122,6 +123,7 @@ public class PayNotifyRecordController {
 	 */
 	@Inner(false)
 	@SneakyThrows
+	@XssCleanIgnore
 	@PostMapping("/ali/callbak")
 	public void aliCallbak(HttpServletRequest request, HttpServletResponse response) {
 		// 解析回调信息
@@ -137,6 +139,7 @@ public class PayNotifyRecordController {
 	@Inner(false)
 	@SneakyThrows
 	@ResponseBody
+	@XssCleanIgnore
 	@PostMapping("/wx/callbak")
 	public String wxCallbak(HttpServletRequest request) {
 		String xmlMsg = HttpKit.readData(request);