jeecgboot/JeecgBoot · error · RuntimeException

请注意，SQL中不允许含注释，有安全风险！

Error message

请注意，SQL中不允许含注释，有安全风险！

What it means

Thrown by SqlInjectionUtil.checkSqlAnnotation when the input contains the SQL line-comment marker '--'. This is a hard block: any '--' substring (even in legitimate text) raises a RuntimeException (not JeecgSqlInjectionException). checkSqlAnnotation is the first step of every filterContent variant, so this fires before keyword/regex checks.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java:360

			if (Pattern.matches(regular, value)) {
				log.error(SqlInjectionUtil.SQL_INJECTION_KEYWORD_TIP, regularOriginal);
				log.error(SqlInjectionUtil.SQL_INJECTION_TIP_VARIABLE, value);
				throw new JeecgSqlInjectionException(SqlInjectionUtil.SQL_INJECTION_TIP + value);
			}
		}
		return;
	}


	/**
	 * 校验是否有sql注释 
	 * @return
	 */
	public static void checkSqlAnnotation(String str){
		if(str.contains(SQL_ANNOTATION2)){
			String error = "请注意，SQL中不允许含注释，有安全风险！";
			log.error(error);
			throw new RuntimeException(error);
		}

		
		Matcher matcher = SQL_ANNOTATION.matcher(str);
		if(matcher.find()){
			String error = "请注意，值可能存在SQL注入风险---> \\*.*\\";
			log.error(error);
			throw new JeecgSqlInjectionException(error);
		}
	}


	/**
	 * 返回查询表名
	 * <p>
	 * sql注入过滤处理，遇到注入关键字抛异常
	 *
	 * @param table

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Remove any '--' from the value before it reaches filterContent, or avoid passing such values through dynamic SQL.
2. For Online report SQL, strip comments from templates rather than embedding them.
3. If the double-hyphen is legitimate data, store and bind it as a parameter so it never enters filterContent.
4. Note this throws RuntimeException, not JeecgSqlInjectionException — catch accordingly.

Example fix

// before — value with '--' passed to filter
String val = "order--pending";
SqlInjectionUtil.filterContent(val, null); // throws RuntimeException

// after — sanitize or bind
String safe = val.replace("--", "");
// or use parameterized SQL so val never reaches filterContent

// Strip or reject SQL line-comment markers before filtering
if (value.contains("--")) {
    // either reject, or sanitize if '--' is legitimate data
    value = value.replace("--", "");
}

null

try {
    SqlInjectionUtil.filterContent(value, null);
} catch (RuntimeException e) { // note: RuntimeException, not JeecgSqlInjectionException
    log.warn("SQL 注释检测拦截: {}", e.getMessage());
    throw new IllegalArgumentException("输入包含非法字符");
}

When it happens

Trigger: Any value passed to filterContent / specialFilterContentForDictSql / specialFilterContentForOnlineReport that contains '--' anywhere — including legitimate hyphenated text, negative ranges, or intended SQL comments.

Common situations: A legitimate value containing a double-hyphen (e.g. 'A--B', '2026-01-01--draft'); an Online report SQL template with comments; a dict code with dashes. Because the check is a raw contains('--'), it is prone to false positives.

Related errors

• 请注意，值可能存在SQL注入风险---> \*.*\
• 请注意，值可能存在SQL注入风险!--->{value}
• 表名不合法，存在SQL注入风险!--->{table}
• 字段不合法，存在SQL注入风险!--->{field}
• 非法存储路径，路径包含遍历字符: {storePath}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/a212d18d4579e8f5. Report an issue: GitHub.