{"record":{"id":"f0b0cb02b2937333","repo":"flipped-aurora/gin-vue-admin","slug":"order-by-s-is-not-in-the-fields","errorCode":null,"errorMessage":"order by %s is not in the fields","messagePattern":"order by (.+?) is not in the fields","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/service/system/sys_export_template.go","lineNumber":300,"sourceCode":"\n\t\tfor _, column := range orderColumns {\n\t\t\tfields[column.Name()] = true\n\t\t}\n\n\t\t// 通过参数传入order\n\t\torder := paramsValues.Get(\"order\")\n\n\t\tif order == \"\" && template.Order != \"\" {\n\t\t\t// 如果没有order入参，这里会使用模板的默认排序\n\t\t\torder = template.Order\n\t\t}\n\n\t\tif order != \"\" {\n\t\t\tcheckOrderArr := strings.Split(order, \" \")\n\t\t\torderStr := \"\"\n\t\t\t// 检查请求的排序字段是否在字段列表中\n\t\t\tif _, ok := fields[checkOrderArr[0]]; !ok {\n\t\t\t\treturn nil, \"\", fmt.Errorf(\"order by %s is not in the fields\", order)\n\t\t\t}\n\t\t\torderStr = checkOrderArr[0]\n\t\t\tif len(checkOrderArr) > 1 {\n\t\t\t\tif checkOrderArr[1] != \"asc\" && checkOrderArr[1] != \"desc\" {\n\t\t\t\t\treturn nil, \"\", fmt.Errorf(\"order by %s is not secure\", order)\n\t\t\t\t}\n\t\t\t\torderStr = orderStr + \" \" + checkOrderArr[1]\n\t\t\t}\n\t\t\tdb = db.Order(orderStr)\n\t\t}\n\n\t\terr = db.Find(&tableMap).Error\n\t\tif err != nil {\n\t\t\treturn nil, \"\", err\n\t\t}\n\t}\n\n\tvar rows [][]string","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/flipped-aurora/gin-vue-admin/blob/3136500ef380842b0eb6c4daa87c3f8a47fcf9e0/server/service/system/sys_export_template.go#L282-L318","documentation":"ExportExcel validates that the requested sort field belongs to the template's field list before applying an ORDER BY, preventing SQL injection via unvalidated column names. If the first token of the 'order' parameter is not a known field key, it returns this error.","triggerScenarios":"Export request with an order parameter whose column name (text before the first space) does not match any key in the template's fields map, e.g. order=password or order=nonexistent_col asc.","commonSituations":"Client sending DB column names instead of the template's exposed field names; renamed fields in the template while frontend caches old names; crafted injection attempts caught by this check.","solutions":["Use a field name present in the export template's conditions/fields list","Sync the frontend sort options with the template's configured fields","Check template config in sys_export_template and add the field if it should be sortable"],"exampleFix":"// before\nparams: 'order=create_time desc' // create_time not in fields\n// after\nparams: 'order=CreatedAt desc' // matches a configured field key","handlingStrategy":"validation","validationCode":"if (!template.fields.some(f => f.key === orderCol)) {\n  orderCol = template.fields[0].key\n}","typeGuard":null,"tryCatchPattern":"try {\n  await exportExcel(templateId, params)\n} catch (e) {\n  if (e.message.includes('not in the fields')) {\n    ElMessage.error('排序字段不在模板字段列表中')\n  }\n}","preventionTips":["Bind sort dropdown options to template fields","Update frontend constants when template fields change"],"tags":["go","export","sql-injection","validation"],"backgroundTag":"invalid-order-field","analyzedSha":"3136500ef380842b0eb6c4daa87c3f8a47fcf9e0","analyzedAt":"2026-08-31T13:50:02.721Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}