{"record":{"id":"7bb0f0b802227329","repo":"flipped-aurora/gin-vue-admin","slug":"v-7bb0f0","errorCode":null,"errorMessage":"非法的排序字段: %v","messagePattern":"非法的排序字段: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/service/system/sys_api.go","lineNumber":222,"sourceCode":"\t}\n\n\terr = db.Count(&total).Error\n\n\tif err != nil {\n\t\treturn apiList, total, err\n\t}\n\n\tdb = db.Limit(limit).Offset(offset)\n\tOrderStr := \"id desc\"\n\tif order != \"\" {\n\t\torderMap := make(map[string]bool, 5)\n\t\torderMap[\"id\"] = true\n\t\torderMap[\"path\"] = true\n\t\torderMap[\"api_group\"] = true\n\t\torderMap[\"description\"] = true\n\t\torderMap[\"method\"] = true\n\t\tif !orderMap[order] {\n\t\t\terr = fmt.Errorf(\"非法的排序字段: %v\", order)\n\t\t\treturn apiList, total, err\n\t\t}\n\t\tOrderStr = order\n\t\tif desc {\n\t\t\tOrderStr = order + \" desc\"\n\t\t}\n\t}\n\terr = db.Order(OrderStr).Find(&apiList).Error\n\treturn apiList, total, err\n}\n\n//@author: [piexlmax](https://github.com/piexlmax)\n//@function: GetAllApis\n//@description: 获取所有的api\n//@return:  apis []model.SysApi, err error\n\nfunc (apiService *ApiService) GetAllApis(ctx context.Context, authorityID uint) (apis []system.SysApi, err error) {\n\tparentAuthorityID, err := AuthorityServiceApp.GetParentAuthorityID(ctx, authorityID)","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/flipped-aurora/gin-vue-admin/blob/3136500ef380842b0eb6c4daa87c3f8a47fcf9e0/server/service/system/sys_api.go#L204-L240","documentation":"GetAPIInfoList builds the ORDER BY clause for the API list endpoint from a client-supplied order key, but only whitelisted columns (id, path, api_group, description, method, plus created_at/updated_at per the full map) are accepted. Any other value returns this error to prevent SQL injection through the order clause.","triggerScenarios":"GET /api/api/getApiList with order set to anything outside the whitelist — e.g. order=\"1\" (frontend sends a numeric key by mistake), order=\"name\", or injected SQL fragments like \"id; drop table\".","commonSituations":"Frontend table sorter passes a column key that doesn't match the DB column names (camelCase vs snake_case); custom clients pass arbitrary values; upgraded frontend using renamed columns against an older backend.","solutions":["Pass one of the allowed order values: \"id\", \"path\", \"api_group\", \"description\", \"method\" (or created_at/updated_at if present in the map).","Fix the frontend table column sort key to use the DB column name (api_group, not apiGroup).","If sorting by another column is needed, add it to the orderMap whitelist in GetAPIInfoList and rebuild.","Ensure desc is a boolean so the \" desc\" suffix is appended only intentionally."],"exampleFix":"// before\nGET /api/api/getApiList?page=1&pageSize=10&order=apiGroup\n// after\nGET /api/api/getApiList?page=1&pageSize=10&order=api_group&desc=true","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"id\": true, \"path\": true, \"api_group\": true, \"description\": true, \"method\": true, \"created_at\": true, \"updated_at\": true}\nif !allowed[order] {\n    order = \"id\"\n}","typeGuard":null,"tryCatchPattern":"list, total, err := apiService.GetAPIInfoList(info)\nif err != nil && strings.Contains(err.Error(), \"非法的排序字段\") {\n    info.Order = \"id\"\n    list, total, err = apiService.GetAPIInfoList(info)\n}","preventionTips":["Send DB column names (snake_case) in the order parameter","Constrain frontend table sorters to the backend whitelist","Default to order=id when the sort key is unknown","Never interpolate raw user input into ORDER BY clauses"],"tags":["validation","sql-injection-prevention","pagination"],"backgroundTag":"invalid-sort-field","analyzedSha":"3136500ef380842b0eb6c4daa87c3f8a47fcf9e0","analyzedAt":"2026-08-31T13:50:02.721Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}