{"record":{"id":"19066b23c5fcd152","repo":"elunez/eladmin","slug":"error-19066b","errorCode":null,"errorMessage":"非法的应用名称，请勿包含[; | &]等特殊字符","messagePattern":"非法的应用名称，请勿包含\\[; \\| &\\]等特殊字符","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/maint/service/impl/AppServiceImpl.java","lineNumber":70,"sourceCode":"    @Override\n    public List<AppDto> queryAll(AppQueryCriteria criteria){\n        return appMapper.toDto(appRepository.findAll((root, criteriaQuery, criteriaBuilder) -> QueryHelp.getPredicate(root,criteria,criteriaBuilder)));\n    }\n\n    @Override\n    public AppDto findById(Long id) {\n        App app = appRepository.findById(id).orElseGet(App::new);\n        ValidationUtil.isNull(app.getId(),\"App\",\"id\",id);\n        return appMapper.toDto(app);\n    }\n\n    @Override\n    @Transactional(rollbackFor = Exception.class)\n    public void create(App resources) {\n        // 验证应用名称是否存在恶意攻击payload，https://github.com/elunez/eladmin/issues/873\n        String appName = resources.getName();\n        if (appName.contains(\";\") || appName.contains(\"|\") || appName.contains(\"&\")) {\n            throw new IllegalArgumentException(\"非法的应用名称，请勿包含[; | &]等特殊字符\");\n        }\n        verification(resources);\n        appRepository.save(resources);\n    }\n\n    @Override\n    @Transactional(rollbackFor = Exception.class)\n    public void update(App resources) {\n        // 验证应用名称是否存在恶意攻击payload，https://github.com/elunez/eladmin/issues/873\n        String appName = resources.getName();\n        if (appName.contains(\";\") || appName.contains(\"|\") || appName.contains(\"&\")) {\n            throw new IllegalArgumentException(\"非法的应用名称，请勿包含[; | &]等特殊字符\");\n        }\n        verification(resources);\n        App app = appRepository.findById(resources.getId()).orElseGet(App::new);\n        ValidationUtil.isNull(app.getId(),\"App\",\"id\",resources.getId());\n        app.copy(resources);\n        appRepository.save(app);","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/maint/service/impl/AppServiceImpl.java#L52-L88","documentation":"AppServiceImpl.create rejects an App name containing ';', '|' or '&' with IllegalArgumentException — a command-injection guard added for CVE-style issue elunez/eladmin#873, because the app name is later interpolated into shell commands during deployment. It fires on the create path before verification() and save().","triggerScenarios":"POST /api/app with name like 'nacos & rm -rf /', 'my|app', or 'a;b' — any name where one of the three shell metacharacters appears. Also innocuous names like 'Tom & Jerry' or 'F&B-Sys' trip it.","commonSituations":"Legitimate business names containing '&' (e.g. 'R&D System'); copy-pasted names with pipes; security testing injecting shell payloads; names from upstream systems not sanitized.","solutions":["Rename the app avoiding ';', '|', '&' (use '-', '_', or 'and'), then create it.","If '&' is a hard requirement, patch the guard to escape/encode the name for the shell instead of rejecting it — coordinate with the deploy-command construction in DeployServiceImpl.","Sanitize names in the frontend form (input validation + hint) before submission."],"exampleFix":"// before\napp.setName(\"R&D System\"); // '&' -> 非法的应用名称\n\n// after\napp.setName(\"R-D System\"); // or \"RnD System\"","handlingStrategy":"validation","validationCode":"// Sanitize/validate the name before create\nString name = resources.getName();\nif (name != null && name.matches(\".*[;|&].*\")) {\n    throw new IllegalArgumentException(\"App name must not contain ; | &\");\n}\nappService.create(resources);","typeGuard":"boolean isSafeAppName(String name) {\n    return name != null && !name.matches(\".*[;|&].*\");\n}","tryCatchPattern":"try {\n    appService.create(app);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"非法的应用名称\")) { showNameFormatError(); return; }\n    throw e;\n}","preventionTips":["Enforce the ; | & blacklist in the frontend form with an inline hint.","Integrate a sanitizer for names imported from external systems before hitting the API.","Remember this guard exists because the name is interpolated into deployment shell commands — do not 'fix' by bypassing it."],"tags":["security","command-injection","validation","eladmin","app-management"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}