{"record":{"id":"16902c9e3c3d2803","repo":"jeecgboot/JeecgBoot","slug":"sql-value","errorCode":null,"errorMessage":"请注意，值可能存在SQL注入风险!--->{value}","messagePattern":"请注意，值可能存在SQL注入风险!--->(.+?)","errorType":"validation","errorClass":"JeecgSqlInjectionException","httpStatus":null,"severity":"critical","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java","lineNumber":135,"sourceCode":"\t * @return\n\t */\n\tpublic static void filterContent(String value, String customXssString) {\n\t\tif (value == null || \"\".equals(value)) {\n\t\t\treturn;\n\t\t}\n\t\t// 一、校验sql注释 不允许有sql注释\n\t\tcheckSqlAnnotation(value);\n\t\t// 转为小写进行后续比较\n\t\tvalue = value.toLowerCase().trim();\n\t\t\n\t\t// 二、SQL注入检测存在绕过风险 (普通文本校验)\n\t\t//https://gitee.com/jeecg/jeecg-boot/issues/I4NZGE\n\t\tString[] xssArr = XSS_STR.split(\"\\\\|\");\n\t\tfor (int i = 0; i < xssArr.length; i++) {\n\t\t\tif (value.indexOf(xssArr[i]) > -1) {\n\t\t\t\tlog.error(SqlInjectionUtil.SQL_INJECTION_KEYWORD_TIP, xssArr[i]);\n\t\t\t\tlog.error(SqlInjectionUtil.SQL_INJECTION_TIP_VARIABLE, value);\n\t\t\t\tthrow new JeecgSqlInjectionException(SqlInjectionUtil.SQL_INJECTION_TIP + value);\n\t\t\t}\n\t\t}\n\t\t// 三、SQL注入检测存在绕过风险 (自定义传入普通文本校验)\n\t\tif (customXssString != null) {\n\t\t\tString[] xssArr2 = customXssString.split(\"\\\\|\");\n\t\t\tfor (int i = 0; i < xssArr2.length; i++) {\n\t\t\t\tif (value.indexOf(xssArr2[i]) > -1) {\n\t\t\t\t\tlog.error(SqlInjectionUtil.SQL_INJECTION_KEYWORD_TIP, xssArr2[i]);\n\t\t\t\t\tlog.error(SqlInjectionUtil.SQL_INJECTION_TIP_VARIABLE, value);\n\t\t\t\t\tthrow new JeecgSqlInjectionException(SqlInjectionUtil.SQL_INJECTION_TIP + value);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// 四、SQL注入检测存在绕过风险 (正则校验)\n\t\tfor (String regularOriginal : XSS_REGULAR_STR_ARRAY) {\n\t\t\tString regular = \".*\" + regularOriginal + \".*\";\n\t\t\tif (Pattern.matches(regular, value)) {","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java#L117-L153","documentation":"Thrown by SqlInjectionUtil.filterContent(String,String) during the default keyword-text check (step 二) when the lowercased input contains any token from XSS_STR (e.g. 'select ', 'and ', 'or ', ';', '--', 'drop ', 'union' patterns). Raises JeecgSqlInjectionException. This is the strict general-purpose SQL-injection filter used across query parameters.","triggerScenarios":"filterContent is called on a value that contains a blacklisted substring such as 'select', 'insert', 'delete', 'update', 'drop', ';', '--', 'or ' (with trailing space). Common when a sort field, query param, or table name contains these words.","commonSituations":"A legitimate column name or value that coincidentally contains a keyword (e.g. a field named 'update_time' with a trailing context, or text content like 'delete this'); user free-text passed into a dynamic SQL fragment; ordering/search field injection.","solutions":["Do not pass free-form user text through filterContent for dynamic SQL; use parameterized queries / MyBatis placeholders instead.","For field/table names use the dedicated validators getSqlInjectField / getSqlInjectTableName which enforce an allowlist regex rather than keyword blocking.","If the value is legitimately a keyword-containing string, sanitize or whitelist it before it reaches dynamic SQL, or avoid concatenating it into SQL entirely.","Review the value shown in the log (SQL_INJECTION_TIP_VARIABLE) to identify which input triggered it."],"exampleFix":"// before — concatenating user input into SQL\nString sql = \"select * from t where name = '\" + name + \"'\";\nSqlInjectionUtil.filterContent(name, null);\n\n// after — parameterized\nMap<String,Object> params = new HashMap<>();\nparams.put(\"name\", name);\nString sql = \"select * from t where name = #{name}\";","handlingStrategy":"validation","validationCode":"// Prefer structural validation over keyword filtering for identifiers\nif (!value.matches(\"^[a-zA-Z0-9_]+$\")) {\n    throw new IllegalArgumentException(\"参数仅允许字母数字下划线\");\n}","typeGuard":"null","tryCatchPattern":"try {\n    SqlInjectionUtil.filterContent(value, null);\n} catch (JeecgSqlInjectionException e) {\n    log.warn(\"SQL 注入检测拦截: {}\", e.getMessage());\n    throw new IllegalArgumentException(\"输入包含非法字符\");\n}","preventionTips":["Use parameterized queries / MyBatis #{} placeholders instead of string concatenation.","For identifiers use getSqlInjectField / getSqlInjectTableName allowlist validators.","Do not pass free-text user content into dynamic SQL fragments."],"tags":["security","sql-injection","cwe-89","validation","blacklist"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}