jeecgboot/JeecgBoot · error · IllegalArgumentException

命令参数包含非法字符，已拒绝执行:

Error message

命令参数包含非法字符，已拒绝执行: 

What it means

Thrown by CommandExecUtil.validateArg(String) when a command argument contains shell metacharacters matched by SHELL_INJECTION_PATTERN: & | ; < > ` $ ! \ \r \n. This is a security guard against command injection — even though execCommand uses ProcessBuilder/Runtime.exec (which bypasses the shell), the check defends against arguments that could be re-interpreted if the command vector ever changes.

Source

Thrown at jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/handler/CommandExecUtil.java:56

     */
    private static final Pattern SHELL_INJECTION_PATTERN =
            Pattern.compile("[&|;<>`$!\\\\\\r\\n]");

    /**
     * 禁止文件名中出现的危险字符（防止通过文件名注入命令）
     */
    private static final Pattern FILENAME_INJECTION_PATTERN =
            Pattern.compile("[&|;<>`$!\"'\\r\\n]");

    /**
     * 校验单个命令参数，拒绝包含 Shell 注入字符的参数
     *
     * @param arg 待校验参数
     * @throws IllegalArgumentException 若参数包含危险字符
     */
    public static void validateArg(String arg) {
        if (arg != null && SHELL_INJECTION_PATTERN.matcher(arg).find()) {
            throw new IllegalArgumentException("命令参数包含非法字符，已拒绝执行: " + arg);
        }
    }

    /**
     * 校验文件路径，拒绝包含危险字符（防止文件名注入）
     *
     * @param filePath 待校验文件路径
     * @throws IllegalArgumentException 若文件路径包含危险字符
     */
    public static void validateFilePath(String filePath) {
        if (filePath != null && FILENAME_INJECTION_PATTERN.matcher(filePath).find()) {
            throw new IllegalArgumentException("文件路径包含非法字符，已拒绝处理: " + filePath);
        }
    }

    /**
     * 执行命令行
     *

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Sanitize or rename the input argument to remove shell metacharacters before passing it to execCommand.
2. If the argument is a file path, strip or URL-decode query parameters and colons from the path before use.
3. For Windows backslashes in paths, pass the path through validateFilePath instead (which does not block backslash), or normalize to forward slashes.

Example fix

// before
String[] args = {"-p", fileName}; // fileName = "report & budget.pdf"
CommandExecUtil.execCommand(command, args);

// after
String safeName = fileName.replaceAll("[&|;<>`$!\\\r\n]", "_");
String[] args = {"-p", safeName};
CommandExecUtil.execCommand(command, args);

String safeArg = arg == null ? null : arg.replaceAll("[&|;<>`$!\\\\\r\n]", "_");
// then pass safeArg to execCommand

private static boolean isSafeArg(String arg) {
    return arg == null || !Pattern.compile("[&|;<>`$!\\\\\r\n]").matcher(arg).find();
}

try {
    CommandExecUtil.execCommand(command, args);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("命令参数包含非法字符")) {
        log.warn("Rejected arg with shell metacharacters: {}", e.getMessage());
        // sanitize and retry, or report to user
    }
    throw e;
}

When it happens

Trigger: Passing any arg containing an ampersand, pipe, semicolon, backtick, dollar sign, exclamation mark, backslash, or CR/LF to execCommand(String[], String[]). For example: a filename like "report&del.txt", a path with "$HOME", or a Windows directory containing '&' in its name.

Common situations: User uploads a file whose name contains a restricted character (e.g. "plan & budget.pdf"); a URL-derived path includes a query string with '&param=value'; Windows paths containing backslashes trigger the backslash clause.

Related errors

• 文件路径包含非法字符，已拒绝处理:
• 非法存储路径，路径包含遍历字符: {storePath}
• 请注意，值可能存在SQL注入风险!--->{value}
• 请注意，SQL中不允许含注释，有安全风险！
• 请注意，值可能存在SQL注入风险---> \*.*\

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/4202bc1068b9a96f. Report an issue: GitHub.