flipped-aurora/gin-vue-admin · error

order by %s is not secure

Error message

order by %s is not secure

What it means

After validating the sort column, ExportExcel checks the sort direction: if the order parameter has a second token it must be exactly 'asc' or 'desc'. Anything else returns this error, again to prevent injecting arbitrary SQL into the ORDER BY clause.

Source

Thrown at server/service/system/sys_export_template.go:305

		// 通过参数传入order
		order := paramsValues.Get("order")

		if order == "" && template.Order != "" {
			// 如果没有order入参，这里会使用模板的默认排序
			order = template.Order
		}

		if order != "" {
			checkOrderArr := strings.Split(order, " ")
			orderStr := ""
			// 检查请求的排序字段是否在字段列表中
			if _, ok := fields[checkOrderArr[0]]; !ok {
				return nil, "", fmt.Errorf("order by %s is not in the fields", order)
			}
			orderStr = checkOrderArr[0]
			if len(checkOrderArr) > 1 {
				if checkOrderArr[1] != "asc" && checkOrderArr[1] != "desc" {
					return nil, "", fmt.Errorf("order by %s is not secure", order)
				}
				orderStr = orderStr + " " + checkOrderArr[1]
			}
			db = db.Order(orderStr)
		}

		err = db.Find(&tableMap).Error
		if err != nil {
			return nil, "", err
		}
	}

	var rows [][]string
	rows = append(rows, tableTitle)
	for _, exTable := range tableMap {
		var row []string
		for _, column := range columns {
			column = strings.ReplaceAll(column, "\"", "")

View on GitHub (pinned to 3136500ef3)

Solutions

1. Send only 'asc' or 'desc' (lowercase) as the direction
2. Normalize direction to lowercase in the client before building params
3. Omit the direction token entirely if default ordering is acceptable

Example fix

// before
params: 'order=CreatedAt DESC' // uppercase rejected
// after
const dir = sortDir.toLowerCase()
if (dir === 'asc' || dir === 'desc') {
  params = `order=CreatedAt ${dir}`
}

const safeDir = ['asc', 'desc'].includes(dir) ? dir : 'asc'

try {
  await exportExcel(templateId, params)
} catch (e) {
  if (e.message.includes('not secure')) {
    ElMessage.error('排序方向只能是 asc 或 desc')
  }
}

When it happens

Trigger: Export request with order like 'created_at ASCENDING', 'id; drop table x', or 'name ASC extra' — any second token that is not the literal lowercase asc or desc.

Common situations: Frontend sending uppercase 'DESC' or localized sort words; concatenated query strings accidentally appending extra tokens; attempted SQL injection probes.

Related errors

• order by %s is not in the fields
• 参数错误：executionPlan 必须提供
• packageName 不能为空
• packageType 必须是 'package' 或 'plugin'
• packageType 和 packageInfo.template 必须保持一致

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/f45be0744cac3b97. Report an issue: GitHub.