jeecgboot/JeecgBoot · critical · JeecgSqlInjectionException

表名不合法，存在SQL注入风险!--->{table}

Error message

表名不合法，存在SQL注入风险!--->{table}

What it means

Thrown by SqlInjectionUtil.validateTableName when a caller passes a table name that fails the strict identifier regex (tableNamePattern). The validator enforces that table names contain only letters, digits and underscores, start with a letter, and stay within the 64-char limit. After the regex it also runs filterContentMulti() for deeper keyword injection checks. The goal is to block dynamic-table-name SQL concatenation attacks used by JeecgBoot's code generators and online form engines.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java:405

		int index = table.toLowerCase().indexOf(" where ");
		if (index != -1) {
			table = table.substring(0, index);
			log.info("截掉where之后的新表名：" + table);
		}

		table = table.trim();
		/**
		 * 检验表名是否合法
		 *
		 * 表名只能由字母、数字和下划线组成。
		 * 表名必须以字母开头。
		 * 表名长度通常有限制，例如最多为 64 个字符。
		 */
		boolean isValidTableName = tableNamePattern.matcher(table).matches();
		if (!isValidTableName) {
			String errorMsg = "表名不合法，存在SQL注入风险!--->" + table;
			log.error(errorMsg);
			throw new JeecgSqlInjectionException(errorMsg);
		}

		//进一步验证是否存在SQL注入风险
		filterContentMulti(table);
		return table;
	}


	/**
	 * 返回查询字段
	 * <p>
	 * sql注入过滤处理，遇到注入关键字抛异常
	 *
	 * @param field
	 */
	static final Pattern fieldPattern = Pattern.compile("^[a-zA-Z0-9_]+$");
	public static String getSqlInjectField(String field) {
		if(oConvertUtils.isEmpty(field)){

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Strip schema/db prefixes before calling validateTableName: pass only the bare table identifier, or extend the whitelist if schema-qualified names are legitimately required.
2. Pre-validate on the frontend/DTO with the same regex ^[A-Za-z][A-Za-z0-9_]{0,63}$ and reject early with a friendly message.
3. If you genuinely need dotted names, split on '.' and validate each segment separately instead of the whole string.
4. Confirm the caller is passing a real DB table name and not a UI label or column expression.

Example fix

// before
String table = "public.sys_user";
SqlInjectionUtil.validateTableName(table); // throws

// after
String[] parts = table.split("\\.");
String bare = parts[parts.length - 1];
SqlInjectionUtil.validateTableName(bare);

private static final Pattern TABLE = Pattern.compile("^[A-Za-z][A-Za-z0-9_]{0,63}$");
public boolean isSafeTable(String table) {
    if (table == null) return false;
    String bare = table.contains(".") ? table.substring(table.lastIndexOf('.') + 1) : table;
    return TABLE.matcher(bare.trim()).matches();
}
// call before SqlInjectionUtil.validateTableName(table)

public static boolean isValidTableName(String t){
    return t != null && t.matches("^[A-Za-z][A-Za-z0-9_]{0,63}$");
}

try {
    SqlInjectionUtil.validateTableName(table);
} catch (JeecgSqlInjectionException e) {
    log.warn("rejected table name {}", table);
    return ResponseEntity.badRequest().body("Invalid table name");
}

When it happens

Trigger: Calling any API that lets the client choose a table name dynamically — code generator table import, online form binding, dynamic report datasource, jeecg-grid list queries with a 'tableName' param — where the supplied value contains characters outside [A-Za-z_][A-Za-z0-9_]{0,63}, e.g. 'sys_user;--', 'user` WHERE 1=1', or a 70-char name. Also triggered when schema-qualified names like 'dbo.users' are passed, because the dot fails the pattern.

Common situations: Passing a schema-prefixed table ('public.users'), passing a table with a hyphen or space, exceeding the 64-char MySQL identifier limit, a frontend form accidentally submitting the table caption instead of the real table name, or a malicious probe attempting stacked queries via the tableName parameter.

Related errors

• 字段不合法，存在SQL注入风险!--->{field}
• 请注意，值可能存在SQL注入风险!--->{value}
• 请注意，SQL中不允许含注释，有安全风险！
• 请注意，值可能存在SQL注入风险---> \*.*\
• 下载失败，存在非法文件类型：{suffix}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/2b8c11e89411a789. Report an issue: GitHub.