{"record":{"id":"a212d18d4579e8f5","repo":"jeecgboot/JeecgBoot","slug":"sql","errorCode":null,"errorMessage":"请注意，SQL中不允许含注释，有安全风险！","messagePattern":"请注意，SQL中不允许含注释，有安全风险！","errorType":"validation","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java","lineNumber":360,"sourceCode":"\t\t\tif (Pattern.matches(regular, value)) {\n\t\t\t\tlog.error(SqlInjectionUtil.SQL_INJECTION_KEYWORD_TIP, regularOriginal);\n\t\t\t\tlog.error(SqlInjectionUtil.SQL_INJECTION_TIP_VARIABLE, value);\n\t\t\t\tthrow new JeecgSqlInjectionException(SqlInjectionUtil.SQL_INJECTION_TIP + value);\n\t\t\t}\n\t\t}\n\t\treturn;\n\t}\n\n\n\t/**\n\t * 校验是否有sql注释 \n\t * @return\n\t */\n\tpublic static void checkSqlAnnotation(String str){\n\t\tif(str.contains(SQL_ANNOTATION2)){\n\t\t\tString error = \"请注意，SQL中不允许含注释，有安全风险！\";\n\t\t\tlog.error(error);\n\t\t\tthrow new RuntimeException(error);\n\t\t}\n\n\t\t\n\t\tMatcher matcher = SQL_ANNOTATION.matcher(str);\n\t\tif(matcher.find()){\n\t\t\tString error = \"请注意，值可能存在SQL注入风险---> \\\\*.*\\\\\";\n\t\t\tlog.error(error);\n\t\t\tthrow new JeecgSqlInjectionException(error);\n\t\t}\n\t}\n\n\n\t/**\n\t * 返回查询表名\n\t * <p>\n\t * sql注入过滤处理，遇到注入关键字抛异常\n\t *\n\t * @param table","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java#L342-L378","documentation":"Thrown by SqlInjectionUtil.checkSqlAnnotation when the input contains the SQL line-comment marker '--'. This is a hard block: any '--' substring (even in legitimate text) raises a RuntimeException (not JeecgSqlInjectionException). checkSqlAnnotation is the first step of every filterContent variant, so this fires before keyword/regex checks.","triggerScenarios":"Any value passed to filterContent / specialFilterContentForDictSql / specialFilterContentForOnlineReport that contains '--' anywhere — including legitimate hyphenated text, negative ranges, or intended SQL comments.","commonSituations":"A legitimate value containing a double-hyphen (e.g. 'A--B', '2026-01-01--draft'); an Online report SQL template with comments; a dict code with dashes. Because the check is a raw contains('--'), it is prone to false positives.","solutions":["Remove any '--' from the value before it reaches filterContent, or avoid passing such values through dynamic SQL.","For Online report SQL, strip comments from templates rather than embedding them.","If the double-hyphen is legitimate data, store and bind it as a parameter so it never enters filterContent.","Note this throws RuntimeException, not JeecgSqlInjectionException — catch accordingly."],"exampleFix":"// before — value with '--' passed to filter\nString val = \"order--pending\";\nSqlInjectionUtil.filterContent(val, null); // throws RuntimeException\n\n// after — sanitize or bind\nString safe = val.replace(\"--\", \"\");\n// or use parameterized SQL so val never reaches filterContent","handlingStrategy":"validation","validationCode":"// Strip or reject SQL line-comment markers before filtering\nif (value.contains(\"--\")) {\n    // either reject, or sanitize if '--' is legitimate data\n    value = value.replace(\"--\", \"\");\n}","typeGuard":"null","tryCatchPattern":"try {\n    SqlInjectionUtil.filterContent(value, null);\n} catch (RuntimeException e) { // note: RuntimeException, not JeecgSqlInjectionException\n    log.warn(\"SQL 注释检测拦截: {}\", e.getMessage());\n    throw new IllegalArgumentException(\"输入包含非法字符\");\n}","preventionTips":["Note checkSqlAnnotation throws RuntimeException, not JeecgSqlInjectionException — catch the right type.","Avoid '--' in values passed to any filterContent variant; it is a raw contains() check.","Bind comment-prone text as parameters rather than filtering it."],"tags":["security","sql-injection","cwe-89","validation","sql-comment","false-positive"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}