jeecgboot/JeecgBoot · critical · SecurityException

不允许加载非 org.jeecg 包路径下的填值规则类: {ruleClass}

Error message

不允许加载非 org.jeecg 包路径下的填值规则类: {ruleClass}

What it means

Thrown by FillRuleUtil.executeRule when the ruleClass field of a sys_fill_rule record does not start with 'org.jeecg.'. This is a class-loading whitelist guard (CWE-470) added to stop arbitrary class instantiation via the fill-rule reflection path. A SecurityException is thrown and the attempt is logged at ERROR level.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/FillRuleUtil.java:79

                            continue;
                        }
                    }

                    String value = params.getString(key);
                    // 2. 用于替换 系统变量的值 #{sys_user_code}
                    if (value != null && value.contains(SymbolConstant.SYS_VAR_PREFIX)) {
                        value = QueryGenerator.getSqlRuleValue(value);
                        params.put(key, value);
                    }
                }

                if (formData == null) {
                    formData = new JSONObject();
                }
                // 包路径白名单校验，防止任意类加载漏洞
                if (!ruleClass.startsWith("org.jeecg.")) {
                    log.error("检测到非法填值规则类加载尝试: {}", ruleClass);
                    throw new SecurityException("不允许加载非 org.jeecg 包路径下的填值规则类: " + ruleClass);
                }

                // 通过反射执行配置的类里的方法（先加载类并校验接口，再实例化）
                //update-begin---author:scott ---date:20260416  for：【PR#9538】Class.forName使用上下文类加载器，增强部署兼容性-----------
                Class<?> clazz = Class.forName(ruleClass, true, Thread.currentThread().getContextClassLoader());
                //update-end---author:scott ---date:20260416  for：【PR#9538】Class.forName使用上下文类加载器，增强部署兼容性-----------
                if (!IFillRuleHandler.class.isAssignableFrom(clazz)) {
                    throw new IllegalArgumentException("类 " + ruleClass + " 未实现 IFillRuleHandler 接口");
                }
                IFillRuleHandler ruleHandler = (IFillRuleHandler) clazz.getDeclaredConstructor().newInstance();
                return ruleHandler.execute(params, formData);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        return null;
    }
}

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Move the custom fill-rule handler class into an org.jeecg.* package (e.g. org.jeecg.modules.xxx.rule) and update rule_class in sys_fill_rule to match.
2. If a non-org.jeecg package is legitimately required, extend the whitelist in FillRuleUtil to include your base package — but treat this as a security review decision.
3. Audit sys_fill_rule rows for rule_class values that do not start with 'org.jeecg.' and correct or remove them.
4. If the value was tampered with, treat it as a security incident and review fill-rule administration access.

Example fix

// before — rule_class = "com.example.OrderNoRule"

// after — move class and update DB
package org.jeecg.modules.order.rule;
public class OrderNoRule implements IFillRuleHandler { ... }
// UPDATE sys_fill_rule SET rule_class = 'org.jeecg.modules.order.rule.OrderNoRule' WHERE rule_code = 'order_no';

String ruleClass = entity.getString("ruleClass");
if (ruleClass == null || !ruleClass.startsWith("org.jeecg.")) {
    throw new SecurityException("非法填值规则类: " + ruleClass);
}

null

try {
    FillRuleUtil.executeRule(ruleCode, formData);
} catch (SecurityException e) {
    log.error("填值规则类加载被拒绝", e);
    return null;
}

When it happens

Trigger: A sys_fill_rule database row has its rule_class column set to a fully-qualified class name outside the org.jeecg package (e.g. com.example.MyRule, java.lang.Runtime). executeRule is invoked (online form auto-fill, dict, code-gen) and the whitelist check rejects the class before Class.forName.

Common situations: A developer placed a custom IFillRuleHandler in a non-org.jeecg package; a database import/migration populated rule_class with a wrong or tampered value; a third-party extension registered a fill rule with its own package prefix.

Related errors

• 类 {ruleClass} 未实现 IFillRuleHandler 接口
• {className} not found!
• 连接地址有安全风险，包含不安全参数【{unsafeParam}】
• 请注意，将要排序的列字段不存在：${column}
• 未获取到用户

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/7187ecb62a085e8d. Report an issue: GitHub.