{"record":{"id":"00295d4dbe3fb20a","repo":"jeecgboot/JeecgBoot","slug":"sql-field","errorCode":null,"errorMessage":"字段不合法，存在SQL注入风险!--->{field}","messagePattern":"字段不合法，存在SQL注入风险!--->(.+?)","errorType":"validation","errorClass":"JeecgSqlInjectionException","httpStatus":null,"severity":"critical","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java","lineNumber":442,"sourceCode":"\t\t\treturn field;\n\t\t}\n\t\t\n\t\tfield = field.trim();\n\n\t\tif (field.contains(SymbolConstant.COMMA)) {\n\t\t\treturn getSqlInjectField(field.split(SymbolConstant.COMMA));\n\t\t}\n\n\t\t/**\n\t\t * 校验表字段是否有效\n\t\t *\n\t\t * 字段定义只能是是字母 数字 下划线的组合（不允许有空格、转义字符串等）\n\t\t */\n\t\tboolean isValidField = fieldPattern.matcher(field).matches();\n\t\tif (!isValidField) {\n\t\t\tString errorMsg = \"字段不合法，存在SQL注入风险!--->\" + field;\n\t\t\tlog.error(errorMsg);\n\t\t\tthrow new JeecgSqlInjectionException(errorMsg);\n\t\t}\n\n\t\t//进一步验证是否存在SQL注入风险\n\t\tfilterContentMulti(field);\n\t\treturn field;\n\t}\n\n\t/**\n\t * 获取多个字段\n\t * 返回: 逗号拼接\n\t *\n\t * @param fields\n\t * @return\n\t */\n\tpublic static String getSqlInjectField(String... fields) {\n\t\tfor (String s : fields) {\n\t\t\tgetSqlInjectField(s);\n\t\t}","sourceCodeStart":424,"sourceCodeEnd":460,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java#L424-L460","documentation":"Thrown by SqlInjectionUtil.getSqlInjectField when a field/column name fails the fieldPattern regex (letters, digits, underscore only — no spaces, quotes, or escape sequences). It guards column lists used in dynamic SELECT/ORDER BY/WHERE construction. After the regex, filterContentMulti() runs an additional keyword blacklist pass. The error exists because column names are concatenated into SQL rather than parameterized.","triggerScenarios":"Submitting a grid/query request whose 'column' or 'field' parameter contains 'user_name AS u', 'id,1=1', 'name`', a function call like 'COUNT(*)', an aliased field with a space, or a column with a quote/parenthesis. Common in online-report sort fields, list-view field selectors, and code-gen column definitions.","commonSituations":"Frontend sending a display alias instead of the physical column, users pasting a full SQL fragment into a single-column field, multi-column sort params concatenated before validation, or an attempt at UNION/subquery injection through an order-by column.","solutions":["Ensure the field value is a single bare column identifier matching ^[A-Za-z][A-Za-z0-9_]*$ before calling getSqlInjectField.","If you need multiple columns, split on comma first and call getSqlInjectField(String[]) so each is validated independently.","Never allow aliases, functions, or expressions through this API; map display labels to physical columns via a whitelist map.","Add a server-side enum/whitelist of permitted sort columns per entity and reject anything not in it."],"exampleFix":"// before\nString field = \"create_time DESC\";\nSqlInjectionUtil.getSqlInjectField(field); // throws\n\n// after\nString col = field.split(\" \")[0];\nString dir = field.endsWith(\"DESC\") ? \"DESC\" : \"ASC\";\nSqlInjectionUtil.getSqlInjectField(col);","handlingStrategy":"validation","validationCode":"private static final Pattern FIELD = Pattern.compile(\"^[A-Za-z][A-Za-z0-9_]*$\");\npublic List<String> safeColumns(String csv){\n    return Arrays.stream(csv.split(\",\"))\n        .map(String::trim)\n        .filter(c -> FIELD.matcher(c).matches())\n        .collect(Collectors.toList());\n}","typeGuard":"public static boolean isValidField(String f){\n    return f != null && f.matches(\"^[A-Za-z][A-Za-z0-9_]*$\");\n}","tryCatchPattern":"try {\n    SqlInjectionUtil.getSqlInjectField(fields);\n} catch (JeecgSqlInjectionException e) {\n    return Collections.emptyList(); // or badRequest\n}","preventionTips":["Map UI sort/field labels to a whitelist of physical columns.","Never pass aliases or expressions into field validators.","Split multi-column CSV params before validation."],"tags":["sql-injection","security","validation","jeecg-boot","database"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}