elunez/eladmin · error · IllegalArgumentException

非法的应用名称，请勿包含[; | &]等特殊字符

Error message

非法的应用名称，请勿包含[; | &]等特殊字符

What it means

AppServiceImpl.create rejects an App name containing ';', '|' or '&' with IllegalArgumentException — a command-injection guard added for CVE-style issue elunez/eladmin#873, because the app name is later interpolated into shell commands during deployment. It fires on the create path before verification() and save().

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/maint/service/impl/AppServiceImpl.java:70

    @Override
    public List<AppDto> queryAll(AppQueryCriteria criteria){
        return appMapper.toDto(appRepository.findAll((root, criteriaQuery, criteriaBuilder) -> QueryHelp.getPredicate(root,criteria,criteriaBuilder)));
    }

    @Override
    public AppDto findById(Long id) {
        App app = appRepository.findById(id).orElseGet(App::new);
        ValidationUtil.isNull(app.getId(),"App","id",id);
        return appMapper.toDto(app);
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public void create(App resources) {
        // 验证应用名称是否存在恶意攻击payload，https://github.com/elunez/eladmin/issues/873
        String appName = resources.getName();
        if (appName.contains(";") || appName.contains("|") || appName.contains("&")) {
            throw new IllegalArgumentException("非法的应用名称，请勿包含[; | &]等特殊字符");
        }
        verification(resources);
        appRepository.save(resources);
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public void update(App resources) {
        // 验证应用名称是否存在恶意攻击payload，https://github.com/elunez/eladmin/issues/873
        String appName = resources.getName();
        if (appName.contains(";") || appName.contains("|") || appName.contains("&")) {
            throw new IllegalArgumentException("非法的应用名称，请勿包含[; | &]等特殊字符");
        }
        verification(resources);
        App app = appRepository.findById(resources.getId()).orElseGet(App::new);
        ValidationUtil.isNull(app.getId(),"App","id",resources.getId());
        app.copy(resources);
        appRepository.save(app);

View on GitHub (pinned to 55fbf70595)

Solutions

1. Rename the app avoiding ';', '|', '&' (use '-', '_', or 'and'), then create it.
2. If '&' is a hard requirement, patch the guard to escape/encode the name for the shell instead of rejecting it — coordinate with the deploy-command construction in DeployServiceImpl.
3. Sanitize names in the frontend form (input validation + hint) before submission.

Example fix

// before
app.setName("R&D System"); // '&' -> 非法的应用名称

// after
app.setName("R-D System"); // or "RnD System"

// Sanitize/validate the name before create
String name = resources.getName();
if (name != null && name.matches(".*[;|&].*")) {
    throw new IllegalArgumentException("App name must not contain ; | &");
}
appService.create(resources);

boolean isSafeAppName(String name) {
    return name != null && !name.matches(".*[;|&].*");
}

try {
    appService.create(app);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("非法的应用名称")) { showNameFormatError(); return; }
    throw e;
}

When it happens

Trigger: POST /api/app with name like 'nacos & rm -rf /', 'my|app', or 'a;b' — any name where one of the three shell metacharacters appears. Also innocuous names like 'Tom & Jerry' or 'F&B-Sys' trip it.

Common situations: Legitimate business names containing '&' (e.g. 'R&D System'); copy-pasted names with pipes; security testing injecting shell payloads; names from upstream systems not sanitized.

Related errors

• 文件只能上传在opt目录或者home目录
• 文件只能部署在opt目录或者home目录
• 文件只能备份在opt目录或者home目录
• 文件超出规定大小:{maxSize}MB
• {entity} 不存在: {parameter} is {value}

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/19066b23c5fcd152. Report an issue: GitHub.