{"record":{"id":"0af70e3e6412227e","repo":"jeecgboot/JeecgBoot","slug":"error-0af70e","errorCode":null,"errorMessage":"系统设置了安全规则，敏感表和敏感字段禁止查询，联系管理员授权!","messagePattern":"系统设置了安全规则，敏感表和敏感字段禁止查询，联系管理员授权!","errorType":"exception","errorClass":"JeecgSqlInjectionException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java","lineNumber":103,"sourceCode":"                }\n\n            }\n            // 判断是否调用了黑名单数据库\n            String dbName = table.getDbName();\n            if (oConvertUtils.isNotEmpty(dbName)) {\n                dbName = dbName.toLowerCase().trim();\n                if (xssTableSet.contains(dbName)) {\n                    flag = false;\n                    log.warn(\"sql黑名单校验，数据库【\" + dbName + \"】禁止查询\");\n                    break;\n                }\n            }\n        }\n\n        // 返回黑名单校验结果（不合法直接抛出异常）\n        if(!flag){\n            log.error(this.getError());\n            throw new JeecgSqlInjectionException(this.getError());\n        }\n        return flag;\n    }\n\n    /**\n     * 校验表名和字段名是否有效，或是是否会带些特殊的字符串进行sql注入\n     * issues/4983 SQL Injection in 3.5.1 #4983\n     * @return\n     */\n    private boolean checkTableAndFieldsName(List<QueryTable> list){\n        boolean flag = true;\n        for(QueryTable queryTable: list){\n            String tableName = queryTable.getName();\n            if(hasSpecialString(tableName)){\n                flag = false;\n                log.warn(\"sql黑名单校验，表名【\"+tableName+\"】包含特殊字符\");\n                break;\n            }","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java#L85-L121","documentation":"Thrown as JeecgSqlInjectionException by AbstractQueryBlackListHandler when a SQL query references a table or field that is on the configured security blacklist (ruleMap). The default blacklist blocks SELECT on sys_user.password and sys_user.salt. Additional rules can be configured via the XSS_STR_TABLE property (database-level blacklist) and the ruleMap static map. The exception propagates through JeecgBootExceptionHandler which has a dedicated @ExceptionHandler for JeecgSqlInjectionException.","triggerScenarios":"An online report, drag report, or custom SQL query that includes 'sys_user.password' or 'sys_user.salt' in its SELECT clause; a query against a database name listed in the XSS_STR_TABLE blacklist; a query using SELECT * on a table whose ruleMap entry is '*'.","commonSituations":"Online report designer (drag/online module) generates SQL that references a sensitive column; a developer writes a custom SQL query in an online form that accidentally selects password/salt fields; a database name is added to the XSS_STR_TABLE config and a legitimate query hits it; SQL parser identifies a field name that overlaps with a blacklisted one.","solutions":["Remove the sensitive column (e.g., password, salt) from the SELECT clause in your report or query.","If the access is legitimate, ask the administrator to adjust the ruleMap or XSS_STR_TABLE configuration.","Use a view or computed column that excludes sensitive fields instead of querying the base table directly.","Check JeecgBootExceptionHandler for how the error is returned to the client and handle it in the front-end."],"exampleFix":"// before — online report SQL selects sensitive fields\nSELECT username, password, salt FROM sys_user WHERE id = #{id}\n\n// after — exclude blacklisted fields\nSELECT username, realname, phone FROM sys_user WHERE id = #{id}","handlingStrategy":"try-catch","validationCode":"// Review the SQL before executing — check ruleMap and XSS_STR_TABLE\n// Ensure sensitive fields (password, salt) are not in the SELECT clause\nString sql = \"SELECT username, realname FROM sys_user\";\n// Avoid: SELECT * FROM sys_user (ruleMap may block password/salt fields)","typeGuard":null,"tryCatchPattern":"try {\n    // execute online report / custom query\n} catch (JeecgSqlInjectionException e) {\n    log.warn(\"SQL blacklist blocked query: {}\", e.getMessage());\n    return Result.error(\"查询包含敏感表或字段，请联系管理员授权\");\n}","preventionTips":["Never SELECT password, salt, or other fields listed in ruleMap from sensitive tables.","When building online reports, explicitly list safe columns instead of SELECT *.","Review the ruleMap and XSS_STR_TABLE configuration to understand which tables/fields are blocked."],"tags":["sql-injection","blacklist","security","sensitive-data","query"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}