What causes "非法的排序字段: %v" in flipped-aurora/gin-vue-admin?

Pass one of the allowed order values: "id", "path", "api_group", "description", "method" (or created_at/updated_at if present in the map).

flipped-aurora/gin-vue-admin · error

非法的排序字段: %v

Error message

非法的排序字段: %v

What it means

GetAPIInfoList builds the ORDER BY clause for the API list endpoint from a client-supplied order key, but only whitelisted columns (id, path, api_group, description, method, plus created_at/updated_at per the full map) are accepted. Any other value returns this error to prevent SQL injection through the order clause.

Source

Thrown at server/service/system/sys_api.go:222

	}

	err = db.Count(&total).Error

	if err != nil {
		return apiList, total, err
	}

	db = db.Limit(limit).Offset(offset)
	OrderStr := "id desc"
	if order != "" {
		orderMap := make(map[string]bool, 5)
		orderMap["id"] = true
		orderMap["path"] = true
		orderMap["api_group"] = true
		orderMap["description"] = true
		orderMap["method"] = true
		if !orderMap[order] {
			err = fmt.Errorf("非法的排序字段: %v", order)
			return apiList, total, err
		}
		OrderStr = order
		if desc {
			OrderStr = order + " desc"
		}
	}
	err = db.Order(OrderStr).Find(&apiList).Error
	return apiList, total, err
}

//@author: [piexlmax](https://github.com/piexlmax)
//@function: GetAllApis
//@description: 获取所有的api
//@return:  apis []model.SysApi, err error

func (apiService *ApiService) GetAllApis(ctx context.Context, authorityID uint) (apis []system.SysApi, err error) {
	parentAuthorityID, err := AuthorityServiceApp.GetParentAuthorityID(ctx, authorityID)

View on GitHub (pinned to 3136500ef3)

Solutions

Pass one of the allowed order values: "id", "path", "api_group", "description", "method" (or created_at/updated_at if present in the map).
Fix the frontend table column sort key to use the DB column name (api_group, not apiGroup).
If sorting by another column is needed, add it to the orderMap whitelist in GetAPIInfoList and rebuild.
Ensure desc is a boolean so the " desc" suffix is appended only intentionally.

Example fix

// before
GET /api/api/getApiList?page=1&pageSize=10&order=apiGroup
// after
GET /api/api/getApiList?page=1&pageSize=10&order=api_group&desc=true

Defensive patterns

Strategy: validation

Validate before calling

allowed := map[string]bool{"id": true, "path": true, "api_group": true, "description": true, "method": true, "created_at": true, "updated_at": true}
if !allowed[order] {
    order = "id"
}

Try / catch

list, total, err := apiService.GetAPIInfoList(info)
if err != nil && strings.Contains(err.Error(), "非法的排序字段") {
    info.Order = "id"
    list, total, err = apiService.GetAPIInfoList(info)
}

Prevention

Send DB column names (snake_case) in the order parameter
Constrain frontend table sorters to the backend whitelist
Default to order=id when the sort key is unknown
Never interpolate raw user input into ORDER BY clauses

When it happens

Trigger: GET /api/api/getApiList with order set to anything outside the whitelist — e.g. order="1" (frontend sends a numeric key by mistake), order="name", or injected SQL fragments like "id; drop table".

Common situations: Frontend table sorter passes a column key that doesn't match the DB column names (camelCase vs snake_case); custom clients pass arbitrary values; upgraded frontend using renamed columns against an older backend.

Related errors

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/7bb0f0b802227329. Report an issue: GitHub.