{"record":{"id":"e7c5f3fcb15b9f5f","repo":"jeecgboot/JeecgBoot","slug":"error-e7c5f3","errorCode":null,"errorMessage":"白名单校验未通过！","messagePattern":"白名单校验未通过！","errorType":"validation","errorClass":"JeecgSqlInjectionException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/config/firewall/SqlInjection/impl/DictTableWhiteListHandlerImpl.java","lineNumber":271,"sourceCode":"        if (tableName.contains(\" \")) {\n            tableName = tableName.substring(0, tableName.indexOf(\" \")).trim();\n        }\n\n        //【issues/4393】 sys_user , (sys_user), sys_user%20, %60sys_user%60\n        String reg = \"\\\\s+|\\\\(|\\\\)|`\";\n        return tableName.replaceAll(reg, \"\");\n    }\n\n    private void throwException() throws JeecgSqlInjectionException {\n        this.throwException(this.getErrorMsg());\n    }\n\n    private void throwException(String message) throws JeecgSqlInjectionException {\n        if (oConvertUtils.isEmpty(message)) {\n            message = this.getErrorMsg();\n        }\n        log.error(message);\n        throw new JeecgSqlInjectionException(message);\n    }\n\n    @Override\n    public String getErrorMsg() {\n        return \"白名单校验未通过！\";\n    }\n\n}\n","sourceCodeStart":253,"sourceCodeEnd":280,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/config/firewall/SqlInjection/impl/DictTableWhiteListHandlerImpl.java#L253-L280","documentation":"DictTableWhiteListHandlerImpl is JeecgBoot's SQL-injection firewall for dictionary/online-form queries. In production mode (not dev), if a table or any queried field is absent from sys_table_white_list (cached in whiteTablesRuleMap), it throws JeecgSqlInjectionException '白名单校验未通过！'. In dev mode the table/fields are auto-added instead.","triggerScenarios":"A dict config or online form issues a query whose table name or fields are not whitelisted; the whiteTablesRuleMap cache is empty (init() failed to load from DB); prod deployment shipped without migrating the whitelist table.","commonSituations":"New dict table not registered; field renamed/added; prod deploy missing sys_table_white_list rows; cache stale after a DB restore.","solutions":["Identify the table/field from the query and add them to sys_table_white_list (or via the whitelist admin UI).","In dev, let the handler auto-add, then migrate those rows to prod.","Confirm init() actually loads the map (check the '表字典白名单初始化完成' debug log).","Verify table/field names in the offending dict config match the whitelist case (lowercased)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before issuing a dict/online query, confirm the table+fields are whitelisted\nSet<String> allowFields = sysTableWhiteListService.getAllConfigMap().get(tableName.toLowerCase());\nif (allowFields == null) { /* register it (dev) or reject early (prod) */ }","typeGuard":null,"tryCatchPattern":"try {\n    // dict query\n} catch (JeecgSqlInjectionException e) {\n    if (\"白名单校验未通过！\".equals(e.getMessage())) {\n        log.error(\"白名单拦截: 表/字段未配置，请补充 sys_table_white_list\");\n    }\n    throw e;\n}","preventionTips":["Migrate sys_table_white_list with every release that adds dict tables.","Use dev mode to auto-seed the whitelist, then promote the rows to prod.","Add new dict tables to the whitelist before exposing the form."],"tags":["security","sql-injection","whitelist","firewall","configuration"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}