{"record":{"id":"7187ecb62a085e8d","repo":"jeecgboot/JeecgBoot","slug":"org-jeecg-ruleclass","errorCode":null,"errorMessage":"不允许加载非 org.jeecg 包路径下的填值规则类: {ruleClass}","messagePattern":"不允许加载非 org\\.jeecg 包路径下的填值规则类: (.+?)","errorType":"validation","errorClass":"SecurityException","httpStatus":null,"severity":"critical","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/FillRuleUtil.java","lineNumber":79,"sourceCode":"                            continue;\n                        }\n                    }\n\n                    String value = params.getString(key);\n                    // 2. 用于替换 系统变量的值 #{sys_user_code}\n                    if (value != null && value.contains(SymbolConstant.SYS_VAR_PREFIX)) {\n                        value = QueryGenerator.getSqlRuleValue(value);\n                        params.put(key, value);\n                    }\n                }\n\n                if (formData == null) {\n                    formData = new JSONObject();\n                }\n                // 包路径白名单校验，防止任意类加载漏洞\n                if (!ruleClass.startsWith(\"org.jeecg.\")) {\n                    log.error(\"检测到非法填值规则类加载尝试: {}\", ruleClass);\n                    throw new SecurityException(\"不允许加载非 org.jeecg 包路径下的填值规则类: \" + ruleClass);\n                }\n\n                // 通过反射执行配置的类里的方法（先加载类并校验接口，再实例化）\n                //update-begin---author:scott ---date:20260416  for：【PR#9538】Class.forName使用上下文类加载器，增强部署兼容性-----------\n                Class<?> clazz = Class.forName(ruleClass, true, Thread.currentThread().getContextClassLoader());\n                //update-end---author:scott ---date:20260416  for：【PR#9538】Class.forName使用上下文类加载器，增强部署兼容性-----------\n                if (!IFillRuleHandler.class.isAssignableFrom(clazz)) {\n                    throw new IllegalArgumentException(\"类 \" + ruleClass + \" 未实现 IFillRuleHandler 接口\");\n                }\n                IFillRuleHandler ruleHandler = (IFillRuleHandler) clazz.getDeclaredConstructor().newInstance();\n                return ruleHandler.execute(params, formData);\n            } catch (Exception e) {\n                e.printStackTrace();\n            }\n        }\n        return null;\n    }\n}","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/FillRuleUtil.java#L61-L97","documentation":"Thrown by FillRuleUtil.executeRule when the ruleClass field of a sys_fill_rule record does not start with 'org.jeecg.'. This is a class-loading whitelist guard (CWE-470) added to stop arbitrary class instantiation via the fill-rule reflection path. A SecurityException is thrown and the attempt is logged at ERROR level.","triggerScenarios":"A sys_fill_rule database row has its rule_class column set to a fully-qualified class name outside the org.jeecg package (e.g. com.example.MyRule, java.lang.Runtime). executeRule is invoked (online form auto-fill, dict, code-gen) and the whitelist check rejects the class before Class.forName.","commonSituations":"A developer placed a custom IFillRuleHandler in a non-org.jeecg package; a database import/migration populated rule_class with a wrong or tampered value; a third-party extension registered a fill rule with its own package prefix.","solutions":["Move the custom fill-rule handler class into an org.jeecg.* package (e.g. org.jeecg.modules.xxx.rule) and update rule_class in sys_fill_rule to match.","If a non-org.jeecg package is legitimately required, extend the whitelist in FillRuleUtil to include your base package — but treat this as a security review decision.","Audit sys_fill_rule rows for rule_class values that do not start with 'org.jeecg.' and correct or remove them.","If the value was tampered with, treat it as a security incident and review fill-rule administration access."],"exampleFix":"// before — rule_class = \"com.example.OrderNoRule\"\n\n// after — move class and update DB\npackage org.jeecg.modules.order.rule;\npublic class OrderNoRule implements IFillRuleHandler { ... }\n// UPDATE sys_fill_rule SET rule_class = 'org.jeecg.modules.order.rule.OrderNoRule' WHERE rule_code = 'order_no';","handlingStrategy":"validation","validationCode":"String ruleClass = entity.getString(\"ruleClass\");\nif (ruleClass == null || !ruleClass.startsWith(\"org.jeecg.\")) {\n    throw new SecurityException(\"非法填值规则类: \" + ruleClass);\n}","typeGuard":"null","tryCatchPattern":"try {\n    FillRuleUtil.executeRule(ruleCode, formData);\n} catch (SecurityException e) {\n    log.error(\"填值规则类加载被拒绝\", e);\n    return null;\n}","preventionTips":["Place all custom IFillRuleHandler implementations under org.jeecg.* packages.","Restrict admin access to sys_fill_rule configuration.","Audit rule_class values after data imports or migrations."],"tags":["security","class-loading","cwe-470","reflection","fill-rule","rce"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}