{"record":{"id":"e36bf3ba0a9a53ce","repo":"jeecgboot/JeecgBoot","slug":"unsafeparam","errorCode":null,"errorMessage":"连接地址有安全风险，包含不安全参数【{unsafeParam}】","messagePattern":"连接地址有安全风险，包含不安全参数【(.+?)】","errorType":"validation","errorClass":"JeecgBootException","httpStatus":null,"severity":"critical","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/JdbcSecurityUtil.java","lineNumber":113,"sourceCode":"            \"org.h2.Driver\",\n    };\n\n    /**\n     * 校验 JDBC URL 是否包含危险参数\n     *\n     * @param jdbcUrl JDBC 连接地址\n     * @throws JeecgBootException 包含危险参数时抛出\n     */\n    public static void validate(String jdbcUrl) {\n        if (oConvertUtils.isEmpty(jdbcUrl)) {\n            return;\n        }\n\n        String lowerUrl = jdbcUrl.toLowerCase();\n\n        for (String unsafeParam : UNSAFE_PARAMS) {\n            if (lowerUrl.contains(unsafeParam)) {\n                throw new JeecgBootException(\"连接地址有安全风险，包含不安全参数【\" + unsafeParam + \"】\");\n            }\n        }\n    }\n\n    /**\n     * 校验驱动类名是否在白名单中\n     *\n     * @param driverClassName JDBC 驱动类名\n     * @throws JeecgBootException 驱动不在白名单时抛出\n     */\n    public static void validateDriver(String driverClassName) {\n        if (oConvertUtils.isEmpty(driverClassName)) {\n            throw new JeecgBootException(\"数据库驱动类名不能为空\");\n        }\n        for (String allowed : ALLOWED_DRIVERS) {\n            if (allowed.equals(driverClassName)) {\n                return;\n            }","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/JdbcSecurityUtil.java#L95-L131","documentation":"Thrown by JdbcSecurityUtil.validate() when a JDBC connection URL contains a parameter from the UNSAFE_PARAMS blacklist. This protects against JDBC deserialization/RCE attacks (e.g., MySQL autoDeserialize, PostgreSQL socketFactory, H2 INIT/RUNSCRIPT). The check uses full-URL case-insensitive contains matching, covering all parameter separator formats (?, ;, (), address=). Called from DynamicDBUtil.addDynamicDataSource() and SysDataSourceController add/update endpoints.","triggerScenarios":"Creating a dynamic data source with a JDBC URL containing 'allowLoadLocalInfile', 'autoDeserialize', 'socketFactory', 'INIT=', 'RUNSCRIPT', 'queryInterceptors', or any of the ~17 blacklisted parameter substrings. Triggered when an admin configures a new data source through the system data source management UI or API.","commonSituations":"Admin configures a data source with a copy-pasted JDBC URL from another project that includes performance tuning parameters (e.g., 'autoDeserialize=true' for legacy MySQL); H2 database URL with 'INIT=RUNSCRIPT FROM ...' for schema initialization; PostgreSQL URL with socketFactory for SSL; malicious user with data-source permissions attempting RCE.","solutions":["Remove the blacklisted parameter from the JDBC URL — review each parameter in the URL and strip any that match the UNSAFE_PARAMS list.","If the parameter is genuinely needed for a legitimate use case, evaluate whether a safer alternative exists (e.g., use server-side SSL config instead of socketFactory).","For H2 INIT scripts, move schema initialization out of the connection URL into a Flyway/Liquibase migration.","Review the full UNSAFE_PARAMS array in JdbcSecurityUtil.java to see all blocked substrings."],"exampleFix":"// before — MySQL URL with dangerous params\njdbc:mysql://host:3306/db?autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor\n\n// after — safe URL without dangerous params\njdbc:mysql://host:3306/db?useSSL=true&serverTimezone=UTC","handlingStrategy":"validation","validationCode":"// Strip known-dangerous params before validation (for audit purposes)\n// Better: construct URLs without dangerous params from the start\nString jdbcUrl = \"jdbc:mysql://host:3306/db?useSSL=true&serverTimezone=UTC\";\n// Review UNSAFE_PARAMS in JdbcSecurityUtil.java to see all blocked substrings","typeGuard":null,"tryCatchPattern":"try {\n    JdbcSecurityUtil.validate(jdbcUrl);\n} catch (JeecgBootException e) {\n    log.error(\"JDBC URL rejected by security check: {}\", e.getMessage());\n    return Result.error(\"数据库连接地址包含不安全参数，请检查配置\");\n}","preventionTips":["Never include autoDeserialize, allowLoadLocalInfile, socketFactory, INIT=, RUNSCRIPT in JDBC URLs.","Use server-side SSL configuration instead of driver-level socketFactory parameters.","Move H2 schema initialization to Flyway/Liquibase instead of INIT= in the connection URL.","Audit all data source configurations for blacklisted parameters after upgrades."],"tags":["jdbc","rce","deserialization","security","datasource","critical"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}