jeecgboot/JeecgBoot · error · JeecgSqlInjectionException

请注意，值可能存在SQL注入风险---> \*.*\

Error message

请注意，值可能存在SQL注入风险---> \*.*\

What it means

Thrown by SqlInjectionUtil.checkSqlAnnotation when the input matches the block-comment regex /*...*/ (SQL_ANNOTATION). Raises JeecgSqlInjectionException. This blocks C-style block comments which can be used to bypass keyword filters or to truncate SQL.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java:368

	/**
	 * 校验是否有sql注释 
	 * @return
	 */
	public static void checkSqlAnnotation(String str){
		if(str.contains(SQL_ANNOTATION2)){
			String error = "请注意，SQL中不允许含注释，有安全风险！";
			log.error(error);
			throw new RuntimeException(error);
		}

		
		Matcher matcher = SQL_ANNOTATION.matcher(str);
		if(matcher.find()){
			String error = "请注意，值可能存在SQL注入风险---> \\*.*\\";
			log.error(error);
			throw new JeecgSqlInjectionException(error);
		}
	}


	/**
	 * 返回查询表名
	 * <p>
	 * sql注入过滤处理，遇到注入关键字抛异常
	 *
	 * @param table
	 */
	private static Pattern tableNamePattern = Pattern.compile("^[a-zA-Z][a-zA-Z0-9_\\$]{0,63}$");
	public static String getSqlInjectTableName(String table) {
		if(oConvertUtils.isEmpty(table)){
			return table;
		}

		// 代码逻辑说明: 表单设计器列表翻译存在表名带条件，导致翻译出问题----

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Strip or reject '/*' and '*/' sequences from values before they reach filterContent if they are legitimate non-SQL text.
2. Use parameterized queries so comment-like text is bound as data, not parsed as SQL.
3. For report SQL, author static SQL without block comments.
4. Recognize the regex matches across the whole string ([\s\S]*), so even distant '/*'...'*/' pairs trigger it.

Example fix

// before
String val = "path/*glob*/x";
SqlInjectionUtil.filterContent(val, null); // throws

// after — bind as parameter, or strip comment markers
String safe = val.replaceAll("/\\*.*?\\*/", "");

// Strip block-comment sequences if they are legitimate non-SQL text
String safe = value.replaceAll("/\\*[\\s\\S]*?\\*/", "");
if (safe.contains("/*") || safe.contains("*/")) {
    throw new IllegalArgumentException("输入包含非法注释字符");
}

null

try {
    SqlInjectionUtil.filterContent(value, null);
} catch (JeecgSqlInjectionException e) {
    log.warn("SQL 块注释检测拦截: {}", e.getMessage());
    throw new IllegalArgumentException("输入包含非法字符");
}

When it happens

Trigger: A value passed to any filterContent variant contains a '/* ... */' sequence. This includes crafted injection payloads using inline comments (e.g. 'uni/**/on') or text that legitimately contains '/*' followed later by '*/'.

Common situations: Injection bypass attempt using comment-splitting; a path or text value containing '/*' (glob patterns, regex); Online report SQL with block comments; filesystem path like '/usr/*' that happens to pair with a later '*/'.

Related errors

• 请注意，SQL中不允许含注释，有安全风险！
• 请注意，值可能存在SQL注入风险!--->{value}
• 表名不合法，存在SQL注入风险!--->{table}
• 字段不合法，存在SQL注入风险!--->{field}
• 非法存储路径，路径包含遍历字符: {storePath}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/54f9cfbf97f37a6b. Report an issue: GitHub.