jeecgboot/JeecgBoot · error · JeecgSqlInjectionException

白名单校验未通过！

Error message

白名单校验未通过！

What it means

DictTableWhiteListHandlerImpl is JeecgBoot's SQL-injection firewall for dictionary/online-form queries. In production mode (not dev), if a table or any queried field is absent from sys_table_white_list (cached in whiteTablesRuleMap), it throws JeecgSqlInjectionException '白名单校验未通过！'. In dev mode the table/fields are auto-added instead.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/config/firewall/SqlInjection/impl/DictTableWhiteListHandlerImpl.java:271

        if (tableName.contains(" ")) {
            tableName = tableName.substring(0, tableName.indexOf(" ")).trim();
        }

        //【issues/4393】 sys_user , (sys_user), sys_user%20, %60sys_user%60
        String reg = "\\s+|\\(|\\)|`";
        return tableName.replaceAll(reg, "");
    }

    private void throwException() throws JeecgSqlInjectionException {
        this.throwException(this.getErrorMsg());
    }

    private void throwException(String message) throws JeecgSqlInjectionException {
        if (oConvertUtils.isEmpty(message)) {
            message = this.getErrorMsg();
        }
        log.error(message);
        throw new JeecgSqlInjectionException(message);
    }

    @Override
    public String getErrorMsg() {
        return "白名单校验未通过！";
    }

}

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Identify the table/field from the query and add them to sys_table_white_list (or via the whitelist admin UI).
2. In dev, let the handler auto-add, then migrate those rows to prod.
3. Confirm init() actually loads the map (check the '表字典白名单初始化完成' debug log).
4. Verify table/field names in the offending dict config match the whitelist case (lowercased).

// Before issuing a dict/online query, confirm the table+fields are whitelisted
Set<String> allowFields = sysTableWhiteListService.getAllConfigMap().get(tableName.toLowerCase());
if (allowFields == null) { /* register it (dev) or reject early (prod) */ }

try {
    // dict query
} catch (JeecgSqlInjectionException e) {
    if ("白名单校验未通过！".equals(e.getMessage())) {
        log.error("白名单拦截: 表/字段未配置，请补充 sys_table_white_list");
    }
    throw e;
}

When it happens

Trigger: A dict config or online form issues a query whose table name or fields are not whitelisted; the whiteTablesRuleMap cache is empty (init() failed to load from DB); prod deployment shipped without migrating the whitelist table.

Common situations: New dict table not registered; field renamed/added; prod deploy missing sys_table_white_list rows; cache stale after a DB restore.

Related errors

• 请注意，值可能存在SQL注入风险!--->{value}
• 请注意，SQL中不允许含注释，有安全风险！
• 请注意，值可能存在SQL注入风险---> \*.*\
• 表名不合法，存在SQL注入风险!--->{table}
• 字段不合法，存在SQL注入风险!--->{field}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/e7c5f3fcb15b9f5f. Report an issue: GitHub.