{"record":{"id":"54f9cfbf97f37a6b","repo":"jeecgboot/JeecgBoot","slug":"sql-54f9cf","errorCode":null,"errorMessage":"请注意，值可能存在SQL注入风险---> \\*.*\\","messagePattern":"请注意，值可能存在SQL注入风险---> \\\\\\*\\.\\*\\\\","errorType":"validation","errorClass":"JeecgSqlInjectionException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java","lineNumber":368,"sourceCode":"\n\n\t/**\n\t * 校验是否有sql注释 \n\t * @return\n\t */\n\tpublic static void checkSqlAnnotation(String str){\n\t\tif(str.contains(SQL_ANNOTATION2)){\n\t\t\tString error = \"请注意，SQL中不允许含注释，有安全风险！\";\n\t\t\tlog.error(error);\n\t\t\tthrow new RuntimeException(error);\n\t\t}\n\n\t\t\n\t\tMatcher matcher = SQL_ANNOTATION.matcher(str);\n\t\tif(matcher.find()){\n\t\t\tString error = \"请注意，值可能存在SQL注入风险---> \\\\*.*\\\\\";\n\t\t\tlog.error(error);\n\t\t\tthrow new JeecgSqlInjectionException(error);\n\t\t}\n\t}\n\n\n\t/**\n\t * 返回查询表名\n\t * <p>\n\t * sql注入过滤处理，遇到注入关键字抛异常\n\t *\n\t * @param table\n\t */\n\tprivate static Pattern tableNamePattern = Pattern.compile(\"^[a-zA-Z][a-zA-Z0-9_\\\\$]{0,63}$\");\n\tpublic static String getSqlInjectTableName(String table) {\n\t\tif(oConvertUtils.isEmpty(table)){\n\t\t\treturn table;\n\t\t}\n\n\t\t// 代码逻辑说明: 表单设计器列表翻译存在表名带条件，导致翻译出问题----","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java#L350-L386","documentation":"Thrown by SqlInjectionUtil.checkSqlAnnotation when the input matches the block-comment regex /*...*/ (SQL_ANNOTATION). Raises JeecgSqlInjectionException. This blocks C-style block comments which can be used to bypass keyword filters or to truncate SQL.","triggerScenarios":"A value passed to any filterContent variant contains a '/* ... */' sequence. This includes crafted injection payloads using inline comments (e.g. 'uni/**/on') or text that legitimately contains '/*' followed later by '*/'.","commonSituations":"Injection bypass attempt using comment-splitting; a path or text value containing '/*' (glob patterns, regex); Online report SQL with block comments; filesystem path like '/usr/*' that happens to pair with a later '*/'.","solutions":["Strip or reject '/*' and '*/' sequences from values before they reach filterContent if they are legitimate non-SQL text.","Use parameterized queries so comment-like text is bound as data, not parsed as SQL.","For report SQL, author static SQL without block comments.","Recognize the regex matches across the whole string ([\\s\\S]*), so even distant '/*'...'*/' pairs trigger it."],"exampleFix":"// before\nString val = \"path/*glob*/x\";\nSqlInjectionUtil.filterContent(val, null); // throws\n\n// after — bind as parameter, or strip comment markers\nString safe = val.replaceAll(\"/\\\\*.*?\\\\*/\", \"\");","handlingStrategy":"validation","validationCode":"// Strip block-comment sequences if they are legitimate non-SQL text\nString safe = value.replaceAll(\"/\\\\*[\\\\s\\\\S]*?\\\\*/\", \"\");\nif (safe.contains(\"/*\") || safe.contains(\"*/\")) {\n    throw new IllegalArgumentException(\"输入包含非法注释字符\");\n}","typeGuard":"null","tryCatchPattern":"try {\n    SqlInjectionUtil.filterContent(value, null);\n} catch (JeecgSqlInjectionException e) {\n    log.warn(\"SQL 块注释检测拦截: {}\", e.getMessage());\n    throw new IllegalArgumentException(\"输入包含非法字符\");\n}","preventionTips":["Remember the block-comment regex spans the whole string ([\\s\\S]*), so distant /* ... */ pairs match.","Avoid passing glob/regex/path strings containing /* through filterContent.","Author report SQL without block comments; bind values as parameters."],"tags":["security","sql-injection","cwe-89","validation","sql-comment","regex"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}