jeecgboot/JeecgBoot · error · JeecgSqlInjectionException

系统设置了安全规则，敏感表和敏感字段禁止查询，联系管理员授权!

Error message

系统设置了安全规则，敏感表和敏感字段禁止查询，联系管理员授权!

What it means

Thrown as JeecgSqlInjectionException by AbstractQueryBlackListHandler when a SQL query references a table or field that is on the configured security blacklist (ruleMap). The default blacklist blocks SELECT on sys_user.password and sys_user.salt. Additional rules can be configured via the XSS_STR_TABLE property (database-level blacklist) and the ruleMap static map. The exception propagates through JeecgBootExceptionHandler which has a dedicated @ExceptionHandler for JeecgSqlInjectionException.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java:103

                }

            }
            // 判断是否调用了黑名单数据库
            String dbName = table.getDbName();
            if (oConvertUtils.isNotEmpty(dbName)) {
                dbName = dbName.toLowerCase().trim();
                if (xssTableSet.contains(dbName)) {
                    flag = false;
                    log.warn("sql黑名单校验，数据库【" + dbName + "】禁止查询");
                    break;
                }
            }
        }

        // 返回黑名单校验结果（不合法直接抛出异常）
        if(!flag){
            log.error(this.getError());
            throw new JeecgSqlInjectionException(this.getError());
        }
        return flag;
    }

    /**
     * 校验表名和字段名是否有效，或是是否会带些特殊的字符串进行sql注入
     * issues/4983 SQL Injection in 3.5.1 #4983
     * @return
     */
    private boolean checkTableAndFieldsName(List<QueryTable> list){
        boolean flag = true;
        for(QueryTable queryTable: list){
            String tableName = queryTable.getName();
            if(hasSpecialString(tableName)){
                flag = false;
                log.warn("sql黑名单校验，表名【"+tableName+"】包含特殊字符");
                break;
            }

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Remove the sensitive column (e.g., password, salt) from the SELECT clause in your report or query.
2. If the access is legitimate, ask the administrator to adjust the ruleMap or XSS_STR_TABLE configuration.
3. Use a view or computed column that excludes sensitive fields instead of querying the base table directly.
4. Check JeecgBootExceptionHandler for how the error is returned to the client and handle it in the front-end.

Example fix

// before — online report SQL selects sensitive fields
SELECT username, password, salt FROM sys_user WHERE id = #{id}

// after — exclude blacklisted fields
SELECT username, realname, phone FROM sys_user WHERE id = #{id}

// Review the SQL before executing — check ruleMap and XSS_STR_TABLE
// Ensure sensitive fields (password, salt) are not in the SELECT clause
String sql = "SELECT username, realname FROM sys_user";
// Avoid: SELECT * FROM sys_user (ruleMap may block password/salt fields)

try {
    // execute online report / custom query
} catch (JeecgSqlInjectionException e) {
    log.warn("SQL blacklist blocked query: {}", e.getMessage());
    return Result.error("查询包含敏感表或字段，请联系管理员授权");
}

When it happens

Trigger: An online report, drag report, or custom SQL query that includes 'sys_user.password' or 'sys_user.salt' in its SELECT clause; a query against a database name listed in the XSS_STR_TABLE blacklist; a query using SELECT * on a table whose ruleMap entry is '*'.

Common situations: Online report designer (drag/online module) generates SQL that references a sensitive column; a developer writes a custom SQL query in an online form that accidentally selects password/salt fields; a database name is added to the XSS_STR_TABLE config and a legitimate query hits it; SQL parser identifies a field name that overlaps with a blacklisted one.

Related errors

• 请注意，值可能存在SQL注入风险!--->{value}
• 请注意，将要排序的列字段不存在：${column}
• 请注意，SQL中不允许含注释，有安全风险！
• 请注意，值可能存在SQL注入风险---> \*.*\
• 表名不合法，存在SQL注入风险!--->{table}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/0af70e3e6412227e. Report an issue: GitHub.