jeecgboot/JeecgBoot · error · JeecgBootException

请注意，将要排序的列字段不存在：${column}

Error message

请注意，将要排序的列字段不存在：${column}

What it means

QueryGenerator builds MyBatis-Plus query wrappers including ORDER BY clauses derived from the request's column/page sort parameters. Before translating a sort column to SQL, it validates the column name against the entity's declared fields (allFields). If the requested sort column is not a field of the entity (after stripping the dict-text suffix _dictText and before resolving @TableField mappings), it throws a JeecgBootException to prevent SQL injection via arbitrary column names. This is a security-critical guard.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/system/query/QueryGenerator.java:335

			return;
		}
		
		//TODO 避免用户自定义表无默认字段创建时间，导致排序报错
		if(DataBaseConstant.CREATE_TIME.equals(column) && !fieldColumnMap.containsKey(DataBaseConstant.CREATE_TIME)){
			column = "id";
			log.warn("检测到实体里没有字段createTime，改成采用ID排序！");
		}
		
		if (oConvertUtils.isNotEmpty(column) && oConvertUtils.isNotEmpty(order)) {
			//字典字段，去掉字典翻译文本后缀
			if(column.endsWith(CommonConstant.DICT_TEXT_SUFFIX)) {
				column = column.substring(0, column.lastIndexOf(CommonConstant.DICT_TEXT_SUFFIX));
			}

			//判断column是不是当前实体的
			log.debug("当前字段有："+ allFields);
			if (!allColumnExist(column, allFields)) {
				throw new JeecgBootException("请注意，将要排序的列字段不存在：" + column);
			}

			//多字段排序方法没有读取 MybatisPlus 注解 @TableField 里 value 的值
			if (column.contains(",")) {
				List<String> columnList = Arrays.asList(column.split(","));
				String columnStrNew = columnList.stream().map(c -> fieldColumnMap.get(c)).collect(Collectors.joining(","));
				if (oConvertUtils.isNotEmpty(columnStrNew)) {
					column = columnStrNew;
				}
			}else{
				column = fieldColumnMap.get(column);
			}

			//SQL注入check
			SqlInjectionUtil.filterContentMulti(column);

			// 排序规则修改
			// 将现有排序 _ 前端传递排序条件{....,column: 'column1,column2',order: 'desc'} 翻译成sql "column1,column2 desc"

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Align the frontend sort column name with the entity's property name (or its @TableField value).
2. If the column is genuinely a computed field, exclude it from sortable columns or map it server-side in the mapper.
3. Verify the entity class has the field and that allFields population includes it (check field visibility/annotation).
4. For dict-text columns, ensure the base field (without _dictText suffix) exists on the entity.

Example fix

// before — frontend sorts by a non-existent column
sortField: 'displayLabel' // not on entity -> throws

// after — sort by the real entity property
sortField: 'name' // matches entity field

// Frontend: only send sortable columns that map to real entity fields
const SORTABLE_FIELDS = ['createTime', 'updateTime', 'id']; // entity-backed
const safeSort = SORTABLE_FIELDS.includes(column) ? column : null;

// Backend: guard before QueryGenerator
if (!entityFields.contains(sortColumn)) {
  log.warn("Ignoring invalid sort column: {}", sortColumn);
  // skip sort instead of throwing
}

try {
  queryWrapper = QueryGenerator.initQueryWrapper(entity, req);
} catch (e) {
  // invalid sort column; retry without the sort param
  req.setColumn("");
  queryWrapper = QueryGenerator.initQueryWrapper(entity, req);
}

When it happens

Trigger: A list page sends a sort request with a column name that doesn't map to any field on the entity — e.g. a computed/alias column, a typo, a frontend column key that differs from the entity property, or a column that exists only in a SQL view/projection. Also triggered by column names containing the dict-text suffix when the base field is absent.

Common situations: Frontend table column `dataIndex`/`field` doesn't match the entity property name; sorting on a virtual/concatenated column; entity refactored (field renamed) but frontend sort config not updated; a column aliased in a custom mapper SQL that isn't a real entity field.

Related errors

• 未获取到用户
• Illegal access to path outside of base directory.
• 非法业务路径，禁止访问上传目录之外的路径: ${bizPath}
• Could not parse date, date format is error
• 模板缺少参数：${item}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/add28bedc0264501. Report an issue: GitHub.