提交

backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java

@@ -183,6 +183,8 @@ public class AuthController {
     @ApiEncrypt
     @PostMapping("/register")
     public R<Void> register(@Validated @RequestBody RegisterBody user) {
+        // 先校验租户（含格式白名单），禁止脏 tenantId 进入 selectRegisterEnabled 触发 SQL 注入
+        loginService.checkTenant(user.getTenantId());
         if (!configService.selectRegisterEnabled(user.getTenantId())) {
             return R.fail("当前系统没有开启注册功能！");
         }

backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysLoginService.java

@@ -231,6 +231,8 @@ public class SysLoginService {
         if (StringUtils.isBlank(tenantId)) {
             throw new TenantException("tenant.number.not.blank");
         }
+        // 格式白名单，阻断恶意 tenantId 进入后续查询/动态租户
+        TenantHelper.checkTenantIdFormat(tenantId);
         if (TenantConstants.DEFAULT_TENANT_ID.equals(tenantId)) {
             return;
         }

backend/ruoyi-admin/src/main/resources/application-prod.yml

@@ -107,7 +107,7 @@ spring.data:
     # 数据库索引
     database: 3
     # redis 密码必须配置
-    password: Hzdyjs@redis@123456
+    password: Hzdyschool@redis@15937
     # 连接超时时间
     timeout: 10s
     # 是否开启ssl

backend/ruoyi-admin/src/main/resources/application.yml

@@ -164,6 +164,7 @@ tenant:
     - sys_user_role
     - sys_client
     - sys_oss_config
+    - sys_bucket_access_record
     - xljk_evaluation
     - xljk_evaluation_detail
 

backend/ruoyi-admin/src/main/resources/i18n/messages.properties

@@ -56,6 +56,7 @@ social.code.not.blank=第三方登录平台[code]不能为空
 social.state.not.blank=第三方登录平台[state]不能为空
 ##租户
 tenant.number.not.blank=租户编号不能为空
+tenant.id.invalid=租户编号格式不正确
 tenant.not.exists=对不起, 您的租户不存在，请联系管理员
 tenant.blocked=对不起，您的租户已禁用，请联系管理员
 tenant.expired=对不起，您的租户已过期，请联系管理员

backend/ruoyi-admin/src/main/resources/i18n/messages_en_US.properties

@@ -56,6 +56,7 @@ social.code.not.blank=Social login platform [code] cannot be blank
 social.state.not.blank=Social login platform [state] cannot be blank
 ##租户
 tenant.number.not.blank=Tenant number cannot be blank
+tenant.id.invalid=Invalid tenant number format
 tenant.not.exists=Sorry, your tenant does not exist. Please contact the administrator
 tenant.blocked=Sorry, your tenant is disabled. Please contact the administrator
 tenant.expired=Sorry, your tenant has expired. Please contact the administrator.

backend/ruoyi-admin/src/main/resources/i18n/messages_zh_CN.properties

@@ -56,6 +56,7 @@ social.code.not.blank=第三方登录平台[code]不能为空
 social.state.not.blank=第三方登录平台[state]不能为空
 ##租户
 tenant.number.not.blank=租户编号不能为空
+tenant.id.invalid=租户编号格式不正确
 tenant.not.exists=对不起, 您的租户不存在，请联系管理员
 tenant.blocked=对不起，您的租户已禁用，请联系管理员
 tenant.expired=对不起，您的租户已过期，请联系管理员

backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java

@@ -31,7 +31,8 @@ public class PlusTenantLineHandler implements TenantLineHandler {
             log.error("无法获取有效的租户id -> Null");
             return new NullValue();
         }
-        // 返回固定租户
+        // sink 白名单：非法租户ID绝不拼进 SQL（防 SQL 注入）
+        TenantHelper.checkTenantIdFormat(tenantId);
         return new StringValue(tenantId);
     }
 

backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/helper/TenantHelper.java

@@ -16,9 +16,11 @@ import org.dromara.common.core.utils.StringUtils;
 import org.dromara.common.core.utils.reflect.ReflectUtils;
 import org.dromara.common.redis.utils.RedisUtils;
 import org.dromara.common.satoken.utils.LoginHelper;
+import org.dromara.common.tenant.exception.TenantException;
 
 import java.util.Stack;
 import java.util.function.Supplier;
+import java.util.regex.Pattern;
 
 /**
  * 租户助手
@@ -35,6 +37,12 @@ public class TenantHelper {
 
     private static final ThreadLocal<Stack<Integer>> REENTRANT_IGNORE = ThreadLocal.withInitial(Stack::new);
 
+    /**
+     * 租户ID格式白名单：仅允许纯数字（与系统生成的 6 位租户编号及默认租户 000000 一致）
+     * 防止外部传入的 tenantId 被拼进 SQL 字面量导致注入
+     */
+    private static final Pattern TENANT_ID_PATTERN = Pattern.compile("^[0-9]{1,20}$");
+
     /**
      * 租户功能是否启用
      */
@@ -42,6 +50,30 @@ public class TenantHelper {
         return Convert.toBool(SpringUtils.getProperty("tenant.enable"), false);
     }
 
+    /**
+     * 校验租户ID格式是否合法（白名单）
+     *
+     * @param tenantId 租户ID
+     * @return true 合法
+     */
+    public static boolean isValidTenantId(String tenantId) {
+        return StringUtils.isNotBlank(tenantId) && TENANT_ID_PATTERN.matcher(tenantId).matches();
+    }
+
+    /**
+     * 校验租户ID格式，非法则抛出异常（fail-closed，不降级继续拼 SQL）
+     *
+     * @param tenantId 租户ID
+     */
+    public static void checkTenantIdFormat(String tenantId) {
+        if (!isValidTenantId(tenantId)) {
+            String safe = tenantId == null ? "null"
+                : tenantId.length() > 64 ? tenantId.substring(0, 64) + "..." : tenantId;
+            log.error("租户ID格式非法，已阻断: [{}]", safe);
+            throw new TenantException("tenant.id.invalid");
+        }
+    }
+
     private static IgnoreStrategy getIgnoreStrategy() {
         Object ignoreStrategyLocal = ReflectUtils.getStaticFieldValue(ReflectUtils.getField(InterceptorIgnoreHelper.class, "IGNORE_STRATEGY_LOCAL"));
         if (ignoreStrategyLocal instanceof ThreadLocal<?> IGNORE_STRATEGY_LOCAL) {
@@ -131,6 +163,8 @@ public class TenantHelper {
         if (!isEnable()) {
             return;
         }
+        // 动态租户一律做格式白名单校验，覆盖 login/register/config 等所有 TenantHelper.dynamic 入口
+        checkTenantIdFormat(tenantId);
         if (!LoginHelper.isLogin() || !global) {
             TEMP_DYNAMIC_TENANT.set(tenantId);
             return;

backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/config/DbInitializer.java

@@ -1,35 +0,0 @@
-package org.dromara.rs.config;
-
-import org.dromara.rs.util.SqlScriptRunner;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.CommandLineRunner;
-import org.springframework.stereotype.Component;
-
-/**
- * 数据库初始化器，在应用启动时执行SQL脚本
- */
-@Component
-public class DbInitializer implements CommandLineRunner {
-
-    private static final Logger logger = LoggerFactory.getLogger(DbInitializer.class);
-
-    @Autowired
-    private SqlScriptRunner sqlScriptRunner;
-
-    @Override
-    public void run(String... args) throws Exception {
-        try {
-            // 吴自龙 注释了
-            // logger.info("开始执行数据库升级脚本...");
-            // 执行升级脚本
-            // sqlScriptRunner.executeScript("mapper/rs/update-rs-application-table.sql");
-            // logger.info("数据库升级脚本执行完成");
-        } catch (Exception e) {
-            logger.error("执行数据库升级脚本失败", e);
-            // 这里选择记录错误但不中断应用启动，因为可能是表结构已经更新过
-            // 如果需要严格控制，可以抛出异常中断应用启动
-        }
-    }
-}

backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/controller/SqlUpdateController.java

@@ -1,91 +0,0 @@
-package org.dromara.rs.controller;
-
-import org.dromara.common.core.domain.R;
-// import org.dromara.rs.mapper.RsSystemMapper;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import java.io.BufferedReader;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * SQL更新控制器
- *
- * @author weizzzz
- * @date 2025-07-24
- */
-@RestController
-@RequestMapping("/rs/db")
-public class SqlUpdateController {
-
-    // 编译不过，吴自龙注释，
-    // @Autowired
-    // private RsSystemMapper rsSystemMapper;
-
-    /**
-     * 执行培训模块SQL更新脚本
-     */
-    // @GetMapping("/update/training")
-    // public R<Map<String, Object>> executeTrainingUpdateScript() {
-    // Map<String, Object> result = new HashMap<>();
-    // try {
-    // // 读取SQL脚本
-    // InputStream is =
-    // getClass().getClassLoader().getResourceAsStream("mapper/rs/training-update.sql");
-    // if (is == null) {
-    // result.put("success", false);
-    // result.put("message", "SQL脚本文件不存在");
-    // return R.ok(result);
-    // }
-
-    // // 解析SQL语句
-    // BufferedReader reader = new BufferedReader(new InputStreamReader(is));
-    // StringBuilder sb = new StringBuilder();
-    // String line;
-    // while ((line = reader.readLine()) != null) {
-    // // 忽略注释行
-    // if (line.trim().startsWith("--") || line.trim().isEmpty()) {
-    // continue;
-    // }
-    // sb.append(line);
-
-    // // 如果是SQL语句结束
-    // if (line.trim().endsWith(";")) {
-    // String sql = sb.toString().trim();
-    // if (sql.endsWith(";")) {
-    // sql = sql.substring(0, sql.length() - 1); // 移除分号，MyBatis会自动处理
-    // }
-    // executeSql(sql);
-    // sb = new StringBuilder();
-    // }
-    // }
-
-    // result.put("success", true);
-    // result.put("message", "SQL脚本执行成功");
-    // return R.ok(result);
-    // } catch (Exception e) {
-    // e.printStackTrace();
-    // result.put("success", false);
-    // result.put("message", "执行SQL脚本出错: " + e.getMessage());
-    // return R.fail("执行SQL脚本出错: " + e.getMessage());
-    // }
-    // }
-
-    //// 编译不过，吴自龙注释，
-    /**
-     * 执行单条SQL语句
-     */
-    // private void executeSql(String sql) {
-    // try {
-    // rsSystemMapper.executeSql(sql);
-    // } catch (Exception e) {
-    // // 记录错误但继续执行
-    // System.out.println("SQL执行警告: " + e.getMessage());
-    // }
-    // }
-}

backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/mapper/RsSystemMapper.java

@@ -1,25 +0,0 @@
-package org.dromara.rs.mapper;
-
-import org.apache.ibatis.annotations.Mapper;
-import org.apache.ibatis.annotations.Update;
-import org.apache.ibatis.annotations.Param;
-
-/**
- * 人事管理系统SQL执行Mapper
- * 用于替代直接的数据库连接操作
- *
- * @author ruoyi
- * @date 2025-08-05
- */
-@Mapper
-public interface RsSystemMapper {
-
-    /**
-     * 执行SQL语句
-     * 
-     * @param sql SQL语句
-     * @return 影响的行数
-     */
-    @Update("${sql}")
-    int executeSql(@Param("sql") String sql);
-} 

backend/ruoyi-modules/ruoyi-rs/src/main/java/org/dromara/rs/util/SqlScriptRunner.java

@@ -1,57 +0,0 @@
-package org.dromara.rs.util;
-
-// import org.dromara.rs.mapper.RsSystemMapper;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.stereotype.Component;
-
-import java.io.BufferedReader;
-import java.io.InputStreamReader;
-
-/**
- * SQL脚本执行工具
- */
-@Component
-public class SqlScriptRunner {
-
-    // 吴自龙注释，编译不过
-    // @Autowired
-    // private RsSystemMapper rsSystemMapper;
-
-    // /**
-    // * 执行SQL脚本
-    // *
-    // * @param scriptPath 脚本路径（相对于classpath）
-    // * @throws Exception 执行异常
-    // */
-    // public void executeScript(String scriptPath) throws Exception {
-    // ClassPathResource resource = new ClassPathResource(scriptPath);
-    // try (BufferedReader reader = new BufferedReader(new
-    // InputStreamReader(resource.getInputStream()))) {
-    // StringBuilder sb = new StringBuilder();
-    // String line;
-    // while ((line = reader.readLine()) != null) {
-    // // 忽略注释行和空行
-    // if (line.trim().startsWith("--") || line.trim().isEmpty()) {
-    // continue;
-    // }
-    // sb.append(line);
-
-    // // 如果是SQL语句结束
-    // if (line.trim().endsWith(";")) {
-    // String sql = sb.toString().trim();
-    // if (sql.endsWith(";")) {
-    // sql = sql.substring(0, sql.length() - 1); // 移除分号，MyBatis会自动处理
-    // }
-    // try {
-    // rsSystemMapper.executeSql(sql);
-    // } catch (Exception e) {
-    // // 记录错误但继续执行
-    // System.out.println("SQL执行警告: " + e.getMessage());
-    // }
-    // sb = new StringBuilder();
-    // }
-    // }
-    // }
-    // }
-}

backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/domain/SysBucketAccessRecord.java

@@ -1,23 +1,26 @@
 package org.dromara.system.domain;
 
-import com.baomidou.mybatisplus.annotation.*;
+import com.baomidou.mybatisplus.annotation.FieldFill;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
 import lombok.Data;
-import lombok.EqualsAndHashCode;
-import org.dromara.common.tenant.core.TenantEntity;
 
 import java.io.Serial;
+import java.io.Serializable;
 import java.util.Date;
 
 /**
  * bucket访问记录对象 sys_bucket_access_record
+ * <p>
+ * 该表无 tenant_id 字段，不继承 TenantEntity，避免租户插件/字段填充写不存在的列。
  *
  * @author Lion Li
  * @date 2025-01-27
  */
 @Data
-@EqualsAndHashCode(callSuper = true)
 @TableName("sys_bucket_access_record")
-public class SysBucketAccessRecord extends TenantEntity {
+public class SysBucketAccessRecord implements Serializable {
 
     @Serial
     private static final long serialVersionUID = 1L;

backend/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysBucketAccessPasswordServiceImpl.java

@@ -4,6 +4,7 @@ import cn.hutool.core.util.StrUtil;
 import cn.hutool.crypto.digest.DigestUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.common.core.exception.ServiceException;
@@ -192,9 +193,8 @@ public class SysBucketAccessPasswordServiceImpl implements ISysBucketAccessPassw
             LambdaQueryWrapper<SysBucketAccessRecord> wrapper = new LambdaQueryWrapper<>();
             wrapper.eq(SysBucketAccessRecord::getBucketName, bucketName);
             wrapper.orderByDesc(SysBucketAccessRecord::getAccessTime);
-            wrapper.last("LIMIT " + limit);
-
-            return recordMapper.selectList(wrapper);
+            int safeLimit = limit <= 0 ? 10 : Math.min(limit, 500);
+            return recordMapper.selectPage(new Page<>(1, safeLimit), wrapper).getRecords();
         } catch (Exception e) {
             log.error("获取bucket访问记录失败: {}", e.getMessage(), e);
             return List.of();

backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgDormManagerServiceImpl.java

@@ -89,10 +89,12 @@ public class XgDormManagerServiceImpl implements IXgDormManagerService {
         sql.append("INNER JOIN sys_user_role ur ON u.user_id = ur.user_id ");
         sql.append("INNER JOIN sys_role r ON ur.role_id = r.role_id ");
         sql.append(
-                "WHERE (r.role_key = 'teacher'  or u.account_type='1')     AND u.status = '0' and not exists (select 1 from xg_dorm_manager where user_id = u.user_id and deleted = '0' and manager_type = '"
-                        + managerType + "') ");
+                "WHERE (r.role_key = 'teacher'  or u.account_type='1') AND u.status = '0' ");
+        sql.append(
+                "and not exists (select 1 from xg_dorm_manager where user_id = u.user_id and deleted = '0' and manager_type = ?) ");
 
         List<Object> params = new ArrayList<>();
+        params.add(managerType);
 
         if (StringUtils.isNotBlank(name)) {
             sql.append("AND u.nick_name LIKE ? ");
@@ -102,11 +104,7 @@ public class XgDormManagerServiceImpl implements IXgDormManagerService {
         sql.append("ORDER BY u.user_name ASC, u.nick_name");
 
         try {
-            if (params.isEmpty()) {
-                return jdbcTemplate.queryForList(sql.toString());
-            } else {
-                return jdbcTemplate.queryForList(sql.toString(), params.toArray());
-            }
+            return jdbcTemplate.queryForList(sql.toString(), params.toArray());
         } catch (Exception e) {
             log.error("查询教师列表异常", e);
             return new ArrayList<>();

backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentServiceImpl.java

@@ -68,8 +68,9 @@ public class XgStudentServiceImpl implements IXgStudentService {
         lqw.like(StringUtils.isNotBlank(name), XgStudentMsg::getName, name);
         lqw.eq(XgStudentMsg::getStudentStatus, "1"); // 只查询在籍学生
         lqw.orderByDesc(XgStudentMsg::getStudentNo);
-        lqw.last("LIMIT " + (limit != null ? limit : 10));
-        return baseMapper.selectVoList(lqw);
+        int safeLimit = (limit == null || limit <= 0) ? 10 : Math.min(limit, 100);
+        Page<XgStudentVo> page = baseMapper.selectVoPage(new Page<>(1, safeLimit), lqw);
+        return page.getRecords();
     }
 
     /**

backend/ruoyi-modules/ruoyi-xg/src/main/java/org/dromara/xg/service/impl/XgStudentStatusChangeServiceImpl.java

@@ -78,16 +78,17 @@ public class XgStudentStatusChangeServiceImpl implements IXgStudentStatusChangeS
 
     private LambdaQueryWrapper<XgStudentStatusChange> buildQueryWrapper(XgStudentStatusChangeBo bo) {
         LambdaQueryWrapper<XgStudentStatusChange> lqw = Wrappers.lambdaQuery();
-        lqw.eq(bo.getId() != null, XgStudentStatusChange::getId, bo.getId());
-        lqw.eq(bo.getStudentId() != null, XgStudentStatusChange::getStudentId, bo.getStudentId());
-        lqw.like(StringUtils.isNotBlank(bo.getStudentNo()), XgStudentStatusChange::getStudentNo, bo.getStudentNo());
-        lqw.eq(StringUtils.isNotBlank(bo.getChangeType()), XgStudentStatusChange::getChangeType, bo.getChangeType());
-        lqw.eq(bo.getEffectiveDate() != null, XgStudentStatusChange::getEffectiveDate, bo.getEffectiveDate());
-        lqw.like(StringUtils.isNotBlank(bo.getReason()), XgStudentStatusChange::getReason, bo.getReason());
-        lqw.eq(bo.getOperatorId() != null, XgStudentStatusChange::getOperatorId, bo.getOperatorId());
-        lqw.like(StringUtils.isNotBlank(bo.getOperatorName()), XgStudentStatusChange::getOperatorName, bo.getOperatorName());
-        lqw.eq(StringUtils.isNotBlank(bo.getSource()), XgStudentStatusChange::getSource, bo.getSource());
-        lqw.eq(bo.getProcessStatus() != null, XgStudentStatusChange::getProcessStatus, bo.getProcessStatus());
+        // JOIN 查询需带表别名，避免 student_no / create_time 等字段歧义
+        lqw.apply(bo.getId() != null, "c.id = {0}", bo.getId());
+        lqw.apply(bo.getStudentId() != null, "c.student_id = {0}", bo.getStudentId());
+        lqw.apply(StringUtils.isNotBlank(bo.getStudentNo()), "c.student_no LIKE CONCAT('%', {0}, '%')", bo.getStudentNo());
+        lqw.apply(StringUtils.isNotBlank(bo.getChangeType()), "c.change_type = {0}", bo.getChangeType());
+        lqw.apply(bo.getEffectiveDate() != null, "c.effective_date = {0}", bo.getEffectiveDate());
+        lqw.apply(StringUtils.isNotBlank(bo.getReason()), "c.reason LIKE CONCAT('%', {0}, '%')", bo.getReason());
+        lqw.apply(bo.getOperatorId() != null, "c.operator_id = {0}", bo.getOperatorId());
+        lqw.apply(StringUtils.isNotBlank(bo.getOperatorName()), "c.operator_name LIKE CONCAT('%', {0}, '%')", bo.getOperatorName());
+        lqw.apply(StringUtils.isNotBlank(bo.getSource()), "c.source = {0}", bo.getSource());
+        lqw.apply(bo.getProcessStatus() != null, "c.process_status = {0}", bo.getProcessStatus());
         return lqw;
     }
 

backend/ruoyi-modules/ruoyi-xg/src/main/resources/mapper/studentStatusChange/XgStudentStatusChangeMapper.xml

@@ -39,9 +39,16 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where c.deleted = 0
     </sql>
 
+    <!-- 已有 where 时不能用 ew.customSqlSegment（会再拼 WHERE），改用 sqlSegment 用 AND 拼接 -->
+    <sql id="queryWrapperSegment">
+        <if test="ew != null and ew.sqlSegment != null and ew.sqlSegment != ''">
+            AND ${ew.sqlSegment}
+        </if>
+    </sql>
+
     <select id="selectVoList" resultMap="XgStudentStatusChangeResult">
         <include refid="selectXgStudentStatusChangeVo"/>
-        ${ew.getCustomSqlSegment}
+        <include refid="queryWrapperSegment"/>
     </select>
 
     <select id="selectVoById" parameterType="Long" resultMap="XgStudentStatusChangeResult">
@@ -51,19 +58,19 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
 
     <select id="selectVoPage" resultMap="XgStudentStatusChangeResult">
         <include refid="selectXgStudentStatusChangeVo"/>
-        ${ew.getCustomSqlSegment}
+        <include refid="queryWrapperSegment"/>
     </select>
 
     <!-- 自定义查询方法，包含学生信息 -->
     <select id="selectVoPageWithStudentInfo" resultMap="XgStudentStatusChangeResult">
         <include refid="selectXgStudentStatusChangeVo"/>
-        ${ew.getCustomSqlSegment}
+        <include refid="queryWrapperSegment"/>
         order by c.create_time desc
     </select>
 
     <select id="selectVoListWithStudentInfo" resultMap="XgStudentStatusChangeResult">
         <include refid="selectXgStudentStatusChangeVo"/>
-        ${ew.getCustomSqlSegment}
+        <include refid="queryWrapperSegment"/>
         order by c.create_time desc
     </select>
 

backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/controller/XljkConsultationDebugController.java

@@ -1,88 +0,0 @@
-package org.dromara.xljk.controller;
-
-import org.dromara.common.core.domain.R;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.web.bind.annotation.*;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * 心理咨询预约调试控制器
- * 注意：此控制器仅用于开发环境调试，生产环境应该移除
- */
-@RestController
-@RequestMapping("/xljk/consultation/debug")
-public class XljkConsultationDebugController {
-
-    @Autowired
-    private JdbcTemplate jdbcTemplate;
-
-    /**
-     * 执行SQL查询
-     * 
-     * @param params 包含SQL语句的参数对象
-     * @return 查询结果
-     */
-    @PostMapping("/execute-sql")
-    public R<List<Map<String, Object>>> executeSql(@RequestBody Map<String, String> params) {
-        try {
-            String sql = params.get("sql");
-            if (sql == null || sql.trim().isEmpty()) {
-                return R.fail("SQL语句不能为空");
-            }
-            
-            // 安全检查，只允许SELECT语句
-            sql = sql.trim();
-            if (!sql.toLowerCase().startsWith("select")) {
-                return R.fail("只允许执行SELECT语句");
-            }
-            
-            List<Map<String, Object>> result = jdbcTemplate.queryForList(sql);
-            return R.ok(result);
-        } catch (Exception e) {
-            return R.fail("执行SQL失败: " + e.getMessage());
-        }
-    }
-    
-    /**
-     * 查询学生预约记录
-     * 
-     * @param studentId 学生ID
-     * @return 预约记录
-     */
-    @GetMapping("/appointments/{studentId}")
-    public R<List<Map<String, Object>>> getAppointmentsByStudentId(@PathVariable("studentId") String studentId) {
-        try {
-            String sql = "SELECT * FROM xljk_consultation_appointment WHERE student_id = ?";
-            List<Map<String, Object>> result = jdbcTemplate.queryForList(sql, studentId);
-            return R.ok(result);
-        } catch (Exception e) {
-            return R.fail("查询失败: " + e.getMessage());
-        }
-    }
-    
-    /**
-     * 查询学生信息
-     * 
-     * @param studentNo 学号
-     * @return 学生信息
-     */
-    @GetMapping("/student/{studentNo}")
-    public R<Map<String, Object>> getStudentInfo(@PathVariable("studentNo") String studentNo) {
-        try {
-            // 这里假设学生信息存储在sys_user表中，可能需要根据实际情况调整
-            String sql = "SELECT * FROM sys_user WHERE user_name = ?";
-            List<Map<String, Object>> result = jdbcTemplate.queryForList(sql, studentNo);
-            
-            if (result.isEmpty()) {
-                return R.fail("未找到该学号的学生信息");
-            }
-            
-            return R.ok(result.get(0));
-        } catch (Exception e) {
-            return R.fail("查询失败: " + e.getMessage());
-        }
-    }
-} 

backend/ruoyi-modules/ruoyi-xljk/src/main/java/org/dromara/xljk/service/impl/XljkConsultationAppointmentServiceImpl.java

@@ -80,15 +80,15 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
                 vo.getConsultationContent() != null ? vo.getConsultationContent().length() : 0,
                 vo.getCounselorSuggestion() != null ? vo.getCounselorSuggestion().length() : 0);
 
-        // 使用与selectList相同的方式查询关联信息
+        // 使用参数化查询关联信息，避免 ID 拼接进 SQL
         String sql = "SELECT s.name as student_name, s.student_no, s.class_name, s.college_name, s.major_name, " +
                 "u.nick_name as counselor_name " +
                 "FROM xg_student_msg s " +
-                "LEFT JOIN sys_user u ON u.user_id = " + entity.getCounselorId() + " " +
-                "WHERE s.id = " + entity.getStudentId();
+                "LEFT JOIN sys_user u ON u.user_id = ? " +
+                "WHERE s.id = ?";
 
         try {
-            Map<String, Object> result = jdbcTemplate.queryForMap(sql);
+            Map<String, Object> result = jdbcTemplate.queryForMap(sql, entity.getCounselorId(), entity.getStudentId());
             log.info("关联查询结果: {}", result);
 
             // 填充关联信息
@@ -103,9 +103,8 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
             // 如果关联查询失败，尝试分别查询
             try {
                 // 查询学生信息
-                String studentSql = "SELECT name, student_no, class_name, college_name, major_name FROM xg_student_msg WHERE id = "
-                        + entity.getStudentId();
-                Map<String, Object> studentInfo = jdbcTemplate.queryForMap(studentSql);
+                String studentSql = "SELECT name, student_no, class_name, college_name, major_name FROM xg_student_msg WHERE id = ?";
+                Map<String, Object> studentInfo = jdbcTemplate.queryForMap(studentSql, entity.getStudentId());
                 log.info("学生信息查询结果: {}", studentInfo);
 
                 vo.setStudentName((String) studentInfo.get("name"));
@@ -692,11 +691,13 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
         log.info("获取学生预约记录，studentId: {}", studentId);
 
         // 使用原生SQL查询以绕过MyBatis缓存，确保获取最新数据
-        String sql = "SELECT a.*, u.nick_name AS counselor_name " +
+        // 预约表无 student_no，学号从学生表关联；排序按预约日期
+        String sql = "SELECT a.*, u.nick_name AS counselor_name, s.student_no " +
                 "FROM xljk_consultation_appointment a " +
                 "LEFT JOIN sys_user u ON a.counselor_id = u.user_id " +
+                "LEFT JOIN xg_student_msg s ON a.student_id = s.id " +
                 "WHERE a.student_id = ? AND a.deleted = 0 " +
-                "ORDER BY a.student_no DESC, a.id DESC, a.create_time DESC";
+                "ORDER BY a.appointment_date DESC, a.id DESC, a.create_time DESC";
 
         List<XljkConsultationAppointmentVo> result = new ArrayList<>();
 
@@ -711,6 +712,8 @@ public class XljkConsultationAppointmentServiceImpl implements IXljkConsultation
                 vo.setId(((Number) row.get("id")).longValue());
                 vo.setStudentId(((Number) row.get("student_id")).longValue());
                 vo.setStudentNo((String) row.get("student_no"));
+                // 预约表自带姓名；学号来自学生表关联（可能为空）
+                vo.setStudentName((String) row.get("student_name"));
                 vo.setAppointmentDate(convertToDate(row.get("appointment_date")));
                 vo.setAppointmentTime((String) row.get("appointment_time"));
                 vo.setAppointmentDetailTime((String) row.get("appointment_detail_time"));

backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/mapper/XskhDisciplineRecordMapper.java

@@ -23,12 +23,12 @@ public interface XskhDisciplineRecordMapper extends BaseMapperPlus<XskhDisciplin
          * 查询学生选项列表（用于下拉框）
          *
          * @param keyword  搜索关键词（学号或姓名）
-         * @param pageNum  页码
+         * @param offset   分页偏移（从 0 开始）
          * @param pageSize 每页数量
          * @return 学生选项列表
          */
         List<XskhStudentOptionVo> selectStudentOptions(@Param("keyword") String keyword,
-                        @Param("pageNum") Integer pageNum,
+                        @Param("offset") Integer offset,
                         @Param("pageSize") Integer pageSize);
 
         /**

backend/ruoyi-modules/ruoyi-xskh/src/main/java/org/dromara/xskh/service/impl/XskhDisciplineRecordServiceImpl.java

@@ -173,7 +173,10 @@ public class XskhDisciplineRecordServiceImpl implements IXskhDisciplineRecordSer
      */
     @Override
     public List<XskhStudentOptionVo> getStudentOptionsPage(String keyword, Integer pageNum, Integer pageSize) {
-        return baseMapper.selectStudentOptions(keyword, pageNum, pageSize);
+        int safePageNum = (pageNum == null || pageNum < 1) ? 1 : pageNum;
+        int safePageSize = (pageSize == null || pageSize < 1) ? 50 : Math.min(pageSize, 200);
+        int offset = (safePageNum - 1) * safePageSize;
+        return baseMapper.selectStudentOptions(keyword, offset, safePageSize);
     }
 
     /**

backend/ruoyi-modules/ruoyi-xskh/src/main/resources/mapper/XskhDisciplineRecordMapper.xml

@@ -62,8 +62,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         </if>
         order by student_no desc
         <choose>
-            <when test="pageNum != null and pageSize != null">
-                limit ${(pageNum - 1) * pageSize}, #{pageSize, jdbcType=INTEGER}
+            <when test="offset != null and pageSize != null">
+                limit #{offset, jdbcType=INTEGER}, #{pageSize, jdbcType=INTEGER}
             </when>
             <otherwise>
                 limit 50

backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/domain/vo/ZsjyEnrollmentStatisticsQueryVo.java

@@ -91,11 +91,6 @@ public class ZsjyEnrollmentStatisticsQueryVo implements Serializable {
      */
     private Boolean calculatePercentage;
 
-    /**
-     * 额外的查询条件
-     */
-    private String extraCondition;
-
     /**
      * 当前页码
      */

backend/ruoyi-modules/ruoyi-zsjy/src/main/java/org/dromara/zsjy/mapper/ZsjyEnrollmentInfoMapper.java

@@ -106,7 +106,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}",
         "GROUP BY",
         "    YEAR(ei.create_time)",
         "ORDER BY",
@@ -115,8 +114,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
     })
     List<ZsjyEnrollmentStatisticsResultVo> statisticsByYear(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 按月统计报名录取信息
@@ -139,7 +137,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}",
         "GROUP BY",
         "    YEAR(ei.create_time), MONTH(ei.create_time)",
         "ORDER BY",
@@ -147,8 +144,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
     })
     List<ZsjyEnrollmentStatisticsResultVo> statisticsByMonth(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 按日统计报名录取信息
@@ -171,7 +167,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}",
         "GROUP BY",
         "    DATE_FORMAT(ei.create_time, '%Y-%m-%d')",
         "ORDER BY",
@@ -180,8 +175,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
     })
     List<ZsjyEnrollmentStatisticsResultVo> statisticsByDay(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 按专业统计报名录取信息
@@ -204,8 +198,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}",
-        "    ${majorCondition}",
         "GROUP BY",
         "    ei.major_code, ei.applied_major",
         "ORDER BY",
@@ -214,9 +206,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
     })
     List<ZsjyEnrollmentStatisticsResultVo> statisticsByMajor(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition,
-        @Param("majorCondition") String majorCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 按地区统计报名录取信息
@@ -239,8 +229,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}",
-        "    ${regionCondition}",
         "GROUP BY",
         "    ei.province_code, ei.province_name",
         "ORDER BY",
@@ -249,9 +237,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
     })
     List<ZsjyEnrollmentStatisticsResultVo> statisticsByRegion(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition,
-        @Param("regionCondition") String regionCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 按性别统计报名录取信息
@@ -272,8 +258,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}",
-        "    ${genderCondition}",
         "GROUP BY",
         "    ei.gender",
         "ORDER BY",
@@ -282,9 +266,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
     })
     List<ZsjyEnrollmentStatisticsResultVo> statisticsByGender(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition,
-        @Param("genderCondition") String genderCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 按状态统计报名录取信息
@@ -315,8 +297,6 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}",
-        "    ${statusCondition}",
         "GROUP BY",
         "    ep.current_status",
         "ORDER BY",
@@ -325,9 +305,7 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
     })
     List<ZsjyEnrollmentStatisticsResultVo> statisticsByStatus(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition,
-        @Param("statusCondition") String statusCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 获取报名录取汇总统计
@@ -347,12 +325,10 @@ public interface ZsjyEnrollmentInfoMapper extends BaseMapperPlus<ZsjyEnrollmentI
         "WHERE",
         "    ei.create_time BETWEEN #{startDate} AND #{endDate}",
         "    AND ei.deleted = 0",
-        "    ${extraCondition}"
     })
     Map<String, Object> getEnrollmentSummary(
         @Param("startDate") Date startDate,
-        @Param("endDate") Date endDate,
-        @Param("extraCondition") String extraCondition);
+        @Param("endDate") Date endDate);
 
     /**
      * 根据身份证号查询报名信息

web/src/views/xg/xsjcxx/studentStatusChange/index.vue

@@ -180,7 +180,7 @@ const selectedRows = ref<XgStudentStatusChangeVo[]>([]);
 const single = ref(true);
 const multiple = ref(true);
 const total = ref(0);
-const dateRange = ref<[string, string]>(['', '']);
+const dateRange = ref<[string, string] | undefined>(undefined);
 const showSearch = ref(true);
 
 // 分页参数
@@ -262,13 +262,13 @@ const handleQuery = () => {
 
 /** 重置按钮操作 */
 const resetQuery = () => {
-  dateRange.value = ['', ''];
-  proxy?.resetForm(queryFormRef.value);
+  dateRange.value = undefined;
+  queryFormRef.value?.resetFields();
   queryParams.pageNum = 1;
-  queryParams.studentNo = '';
-  queryParams.changeType = '';
-  queryParams.processStatus = null;
-  queryParams.operatorName = '';
+  queryParams.studentNo = undefined;
+  queryParams.changeType = undefined;
+  queryParams.processStatus = undefined;
+  queryParams.operatorName = undefined;
   handleQuery();
 };
 

问题整改/SQL注入攻击日志摘录-20260916.md

@@ -0,0 +1,172 @@
+# SQL 注入攻击日志摘录（对应攻防演练报告）
+
+> 来源日志包：`问题整改/日志.rar`  
+> 对照报告：`问题整改/杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx`  
+> 整理日期：2026-09-17  
+
+---
+
+## 1. 结论
+
+在客户提供的 `日志.rar` 中，**已定位到与 Word 报告完全吻合的 SQL 注入攻击痕迹**。
+
+核心对应关系：
+
+| Word 报告描述 | 日志证据 |
+|---------------|----------|
+| 入口 `POST /prod-api/auth/register` | 大量 `请求地址'/auth/register',发生未知异常` |
+| `tenantId` 注入进 SQL | `sys_config ... AND tenant_id = '000000' AND extractvalue(...)` |
+| 报错型注入 `extractvalue` / XPATH | `java.sql.SQLException: XPATH syntax error: '~...'` |
+| 落点 `SysConfigMapper` | `The error may exist in org/dromara/system/mapper/SysConfigMapper.java` |
+| 泄露 `root@172.16.0.68` | `XPATH syntax error: '~root@172.16.0.68'`（约 200 次） |
+| 查注册开关触发 | 参数 `sys.account.registerUser` |
+| 拖库用户/配置 | 报错片段中出现表字段、时间戳、BCrypt 哈希分片等 |
+
+**主证据文件（推荐引用）：**
+
+- `日志/ruoyi-admin-68-9901.log`（节点 68，体量最大、攻击痕迹最完整）  
+- 同内容副本：`日志/68/ruoyi-admin-68-9901.log`  
+
+---
+
+## 2. 日志包结构说明
+
+`日志.rar` 解压后主要包含双机节点日志：
+
+| 目录 | 说明 |
+|------|------|
+| `日志/67/` | 节点 67 应用/系统日志 |
+| `日志/68/` | 节点 68 应用/系统日志 |
+| `日志/*.log` | 根目录另有一份拷贝（与 67/68 有重叠） |
+
+攻击相关命中主要集中在 **68 节点** 的 `ruoyi-admin-68-9901.log`。
+
+---
+
+## 3. 攻击时间线（基于主日志）
+
+主日志：`ruoyi-admin-68-9901.log`
+
+| 统计项 | 数值 |
+|--------|------|
+| `XPATH syntax error` | **42230** 次 |
+| `extractvalue` | **16726** 次 |
+| `/auth/register` 异常 | **8644** 次 |
+| `SysConfigMapper` | **8540** 次 |
+| `root@172.16.0.68` 泄露 | **200** 次 |
+| 参数 `sys.account.registerUser` | **8747** 次 |
+| 首次 XPATH 关联时间 | **2026-09-16 10:43:25** |
+| 末次 XPATH 关联时间 | **2026-09-16 23:36:48** |
+
+按小时分布（XPATH 相关）：
+
+| 时段 | 相对强度 |
+|------|----------|
+| 10 时 | 少量探测 |
+| 14 时 | 明确命中（含 `root@`、版本探测） |
+| **15 时** | **高峰（约 3.1 万行级）** |
+| 16 时 | 仍高强度 |
+| 17 / 21 / 22 / 23 时 | 持续/回扫 |
+
+与报告截图高度吻合的关键时刻示例：
+
+- **2026-09-16 14:49:32**：`/auth/register` + `extractvalue(SELECT version())` → `~5.7.39-log`
+- **2026-09-16 14:50:08**：`/auth/register` + `extractvalue(SELECT user())` → `~root@172.16.0.68`
+
+---
+
+## 4. 关键证据摘录（与报告逐条对应）
+
+### 4.1 攻击入口：注册接口
+
+```text
+请求地址'/auth/register',发生未知异常.
+```
+
+（同秒内连续多次，符合自动化注入工具特征）
+
+### 4.2 注入点：tenant_id 拼进 sys_config 查询
+
+```text
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, ...
+     FROM sys_config
+     WHERE (config_key = ?)
+       AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+==> Parameters: sys.account.registerUser(String)
+```
+
+说明：注册流程先查“是否开启注册”，恶意 `tenantId` 被多租户插件拼进 SQL，从而触发注入。
+
+### 4.3 报错栈落点：SysConfigMapper
+
+```text
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+```
+
+### 4.4 与报告完全一致的库账号泄露
+
+```text
+java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+```
+
+### 4.5 信息探测与拖数痕迹（报错回显）
+
+XPATH 回显片段（日志统计 Top）可见攻击者在逐步抽取元数据/业务数据，例如：
+
+| 回显片段（截断） | 含义（推断） |
+|------------------|--------------|
+| `~5.7.39-log` | MySQL 版本 |
+| `~root@172.16.0.68` | 当前数据库用户 |
+| `~tenant_id` / `~create_time` / `~create_by` 等 | 表字段枚举 |
+| `~2025-12-23 13:1...` | 用户创建时间等数据分片 |
+| `~$2a$10$...` | 密码哈希分片（敏感） |
+
+另有 SQL 探测 `information_schema` / `table_schema='hzdyjs_xg'` 的记录，表明已进入库表枚举阶段。
+
+> 完整敏感哈希与用户明细不在正文展开；原始摘录见同目录附件。
+
+---
+
+## 5. 典型攻击链路（日志还原）
+
+```text
+POST /auth/register
+  → selectRegisterEnabled(tenantId)  // 参数含恶意 tenantId
+    → 查询 sys_config(config_key=sys.account.registerUser)
+      → 多租户插件拼接: AND tenant_id = '<恶意内容>'
+        → extractvalue(...) 报错回显
+          → 泄露 version / user() / database / 表字段 / 业务数据分片
+```
+
+该链路与 Word 报告 Burp 截图、成果描述（root 权限判定、用户数据拖取、初始密码配置等）一致。
+
+---
+
+## 6. 附件清单（本目录）
+
+目录：`问题整改/攻击日志摘录/`
+
+| 文件 | 内容 |
+|------|------|
+| `stats.txt` | 主日志命中统计与时间分布 |
+| `primary-xpath-context.txt` | 首批 XPATH 上下文（含 register + root） |
+| `primary-extract-sql-samples.txt` | 被注入的 SQL 样本 |
+| `primary-register-hits.txt` | `/auth/register` 异常样本 |
+| `primary-root-leaks.txt` | `root@172.16.0.68` 泄露样本 |
+| `primary-sysconfig-hits.txt` | SysConfigMapper 报错样本 |
+| `evidence-block-auth-register-root.txt` | 连续证据块（从版本探测到 root 泄露） |
+
+---
+
+## 7. 处置建议（日志侧）
+
+1. 将本摘录作为攻防复盘/整改验收附件归档。  
+2. 代码侧已完成 `tenantId` 白名单与注册接口加固后，需在**生产发布**后再做一次同类关键字复查（应不再出现 `extractvalue`/`XPATH`/`tenant_id = '...extractvalue`）。  
+3. 因日志显示存在密码哈希分片外泄痕迹，建议同步：**强制相关账号改密、轮换初始密码与第三方密钥、审计异常登录**。  
+
+---
+
+## 8. 一句话结论
+
+**客户日志可证实：2026-09-16 当日存在针对 `/auth/register` + `tenantId` 的报错型 SQL 注入，成功回显 `root@172.16.0.68`，并持续拖取库表元数据与业务数据；与 Word 补充成果报告一致。**

问题整改/SQL注入攻击日志核查说明-20260916.md

@@ -0,0 +1,104 @@
+# SQL 注入攻击相关日志核查说明（2026-09-16）
+
+## 1. 核查结论（重要）
+
+### 1.1 后续补充（已完成）
+
+客户另提供 `问题整改/日志.rar` 后，已成功定位与 Word 报告一致的攻击日志。
+
+正式摘录文档见：
+
+- `问题整改/SQL注入攻击日志摘录-20260916.md`
+- 附件目录：`问题整改/攻击日志摘录/`
+
+### 1.2 关于 `20260916.zip`（早期误传包）
+
+对客户提供的 `问题整改/20260916.zip` 完成解压与内容核查后：
+
+**该压缩包中未发现系统运行日志（如 `sys-error.log` / `sys-info.log` / `sys-console.log` / Nginx access/error 等），因此无法从该包中提取与 Word 报告对应的攻击日志原文。**
+
+### 压缩包实际内容
+
+| 路径 | 大小约 | 说明 |
+|------|--------|------|
+| `20260916/ruoyi-admin.jar` | ~159MB | 后端可执行包（部署产物，不是日志） |
+| `20260916/dist/build/h5/` | 若干静态资源 | 移动端 H5 前端构建产物 |
+| 其它 | — | `.DS_Store`、`__MACOSX` 等无关文件 |
+
+**结论：当前 zip 更像是 2026-09-16 的部署备份包，而不是“昨天的系统日志”。**
+
+---
+
+## 2. Word 报告中的攻击特征（用于后续在真实日志中检索）
+
+依据 `杭州第一技师学院智慧校园系统存在SQL注入漏洞（补充成果）.docx`：
+
+| 项 | 内容 |
+|----|------|
+| 检测日期 | 2026-09-16 |
+| 入口站点 | `http://ykt.hzdyjsxy.cn:18081/#/`（mobile H5） |
+| 攻击接口 | `POST /prod-api/auth/register`（报告截图为 `/prod-api/auth//register`） |
+| 注入参数 | JSON 字段 `tenantId` |
+| 注入手法 | 基于报错的 `extractvalue`（XPATH syntax error） |
+| 泄露信息 | 数据库账号形如 `root@172.16.0.68`；拖取 `sys_config`、`sys_user`（报告称 16278 条）等 |
+| 关联代码路径（报错栈） | `SysConfigMapper` / 多租户 `tenant_id` 条件拼接 |
+
+---
+
+## 3. 建议向客户补要的真实日志
+
+请客户提供 **2026-09-16**（建议覆盖全天，至少渗透时段）以下文件之一或打包：
+
+1. 后端应用日志目录（典型路径）  
+   - `logs/sys-error.log`  
+   - `logs/sys-info.log` / `logs/sys-console.log`  
+   - 若按日滚动：`sys-error.2026-09-16.log` 等
+2. 反向代理访问日志  
+   - Nginx：`access.log` / `error.log`（含 `/prod-api/auth/register` 请求）
+3. 如有 WAF / 网关日志，一并提供
+
+### 建议检索关键字（拿到真实日志后）
+
+```text
+/auth/register
+tenantId
+extractvalue
+updatexml
+XPATH syntax error
+SysConfigMapper
+tenant_id
+java.sql.SQLException
+root@
+sys_config
+sys_user
+```
+
+命中后应重点保留：时间、来源 IP、请求 URI、异常堆栈、是否返回 500、是否伴随大量异常 SQL。
+
+---
+
+## 4. 与本仓库整改的对应关系
+
+本仓库已完成针对该漏洞的代码加固（详见同目录其它说明）：
+
+- `tenantId` 格式白名单（sink）  
+- `/auth/register` 先校验租户再查注册开关  
+- 删除心理咨询 debug 任意 SQL 接口  
+- 清理其它高危手写拼接 SQL（P0/P1/单点 LIMIT）
+
+**在真实攻击日志到位后，可再补一版《攻击日志摘录》附录，把命中行按时间线附入本文。**
+
+---
+
+## 5. 下一步
+
+请客户重新提供 **含 2026-09-16 运行日志的压缩包**（或直接给 `logs/` 目录）。收到后可继续：
+
+1. 按上述关键字自动检索并摘录  
+2. 形成独立《SQL注入攻击日志摘录》文档（含时间线、源 IP、异常片段）  
+3. 与 Word 报告截图逐条对照
+
+---
+
+*文档生成时间：2026-09-17*  
+*核查对象：`问题整改/20260916.zip` + Word 渗透补充成果*

问题整改/SQL注入漏洞整改说明-tenantId.md

@@ -0,0 +1,22 @@
+# SQL 注入漏洞整改说明（tenantId）
+
+## 背景
+
+攻防演练报告指出智慧校园（mobile H5：`ykt.hzdyjsxy.cn:18081/#/`）存在 SQL 注入，可拖取 `sys_user` / `sys_config` 等数据。
+
+实际利用入口为后端免登接口 `POST /prod-api/auth/register` 的 `tenantId` 字段，经多租户插件拼入 SQL（与 RuoYi-Vue-Plus XVE-2026-50962 同类问题）。
+
+## 整改内容（2026-09-17）
+
+| # | 措施 | 改动位置 |
+|---|------|----------|
+| 1 | sink 白名单：租户 ID 仅允许 `^[0-9]{1,20}$`，非法直接抛错，不拼 SQL | `PlusTenantLineHandler`、`TenantHelper.checkTenantIdFormat` |
+| 2 | 注册接口先 `checkTenant`，再查注册开关 | `AuthController.register` |
+| 3 | 所有 `TenantHelper.dynamic/setDynamic` 入口统一格式校验；登录 `checkTenant` 增加格式校验 | `TenantHelper`、`SysLoginService.checkTenant` |
+| 4 | 删除心理咨询调试任意 SQL 接口 | 删除 `XljkConsultationDebugController` |
+
+## 发布注意
+
+- 需重新编译并发布 **backend** 后生效；仅发 mobile 前端无效。
+- 建议同步轮换初始密码、微信 AppSecret，并审计异常访问。
+- 生产环境确认 `sys.account.registerUser=false`（关闭开放注册）。

问题整改/手写拼接SQL风险范围清单.md

@@ -0,0 +1,26 @@
+# 手写/拼接 SQL 风险范围清单
+
+> 梳理日期：2026-09-17  
+> 更新：同日已完成 **P0 / P1 / 单点 LIMIT** 修复；**全局 orderBy 列白名单暂不改**。
+
+## 已修复（本次）
+
+| 原优先级 | 项 | 处理 |
+|----------|----|------|
+| P0 | `RsSystemMapper` `${sql}` + `SqlUpdateController` + `SqlScriptRunner` + `DbInitializer` | 已删除 |
+| P0 | 招生 `ZsjyEnrollmentInfoMapper` `${*Condition}` | 已去掉 `${}` 条件参数；VO 删除 `extraCondition` |
+| P1 | 宿舍 `managerType` 字符串拼接 | 已改为 JDBC `?` |
+| P2 | 学生搜索 `LIMIT + limit` | 已改为 `Page` 安全分页 |
+| P2 | bucket 访问记录 LIMIT | 已改为 `Page` 安全分页 |
+| P2 | 违纪 `limit ${(pageNum-1)*pageSize}` | 已改为 `#{offset}`/`#{pageSize}`，Service 计算 offset |
+| P2 | 心理咨询详情 Long 拼接 | 已改为 `?` 占位 |
+
+另：`tenantId` 注入、debug 任意 SQL 接口此前已修。
+
+## 暂不改造
+
+| 级 | 项 | 说明 |
+|----|----|------|
+| P2 | 全局 `PageQuery.orderByColumn` | 现有正则已基本挡住经典注入；列名白名单属加固，影响面大 |
+| P3 | 会话 userId/deptId 的 `exists`/`inSql` | 面窄，可后续顺手改 |
+| P3 | 其它已用 `?` 的手写 JdbcTemplate | 维护面问题，非紧急注入 |

问题整改/攻击日志摘录/analysis_summary.txt

@@ -0,0 +1,48 @@
+TOTAL_MATCH_LINES 182130
+DAY_2026_09_16_MATCHES 168
+COUNT_extractvalue 8
+COUNT_updatexml 0
+COUNT_XPATH 160
+COUNT_register 0
+COUNT_SysConfigMapper 0
+COUNT_root@ 0
+TIME_FIRST None
+TIME_LAST None
+TOP_FILES
+  80	/tmp/logs_20260916/日志/ruoyi-admin-68-9901.log
+  80	/tmp/logs_20260916/日志/68/ruoyi-admin-68-9901.log
+  4	/tmp/logs_20260916/日志/ruoyi-admin-68-9903.log
+  4	/tmp/logs_20260916/日志/68/ruoyi-admin-68-9903.log
+ROOT_LEAKS []
+WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-xpath.txt rows 25 of 160
+WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-register.txt rows 0 of 0
+WROTE /Users/wuzilong/work/00code/hzdyjs_xg/问题整改/攻击日志摘录/excerpts-root-leak.txt rows 0 of 0
+FILE_SIZE /tmp/logs_20260916/日志/68/sys-error.2026-09-16.log 113485
+FILE_HEAD sys-error.2026-09-16.log
+2026-09-17 01:22:54 [XNIO-1 task-7] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/studentMsg/studentMsg/personalInfo',认证失败'token 无效：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDg5NTQxMjI0OTQ5MTAwNTQ1Iiwicm5TdHIiOiIxZXp1b2tmNTNSdTBsaTBCUUxTV2dGeHFDUVNsamxucSIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjA4OTU0MTIyNDk0OTEwMDU0NSwidXNlck5hbWUiOiIyMDI2MDIwMzIwNTUiLCJkZXB0SWQiOjIwODk1MzUzMjEzNzgxNDAxNjEsImRlcHROYW1lIjoi55S15rCUMjYxIiwiZGVwdENhdGVnb3J5IjoiYmot55S15rCUMjYxIiwibmlja05hbWUiOiLlvKDln47lrocifQ.h0aBajg5T_SkY8Z9pEK6GzUHcZuLUPkltO2cCo8Z45Q',无法访问系统资源
+2026-09-17 01:22:54 [XNIO-1 task-3] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/xgss/dormBuildingTree/listAll',认证失败'未能读取到有效 token',无法访问系统资源
+2026-09-17 01:22:55 [XNIO-1 task-2] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/system/SysRegion/tree',认证失败'未能读取到有效 token',无法访问系统资源
+2026-09-17 06:49:40 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler - 密码输入错误1次
+2026-09-17 07:09:49 [XNIO-1 task-2] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwMzQwIiwicm5TdHIiOiJYaHhIa3NHQlNpcTZEMEhZT2xkZXRUV2dEeXRub20zOSIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDM0MCwidXNlck5hbWUiOiIyMDIzMDQzOTMwNDIiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDEwNiwiZGVwdE5hbWUiOiLml6DkurrmnLoyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDAyIiwibmlja05hbWUiOiLoooHlsJHnv7AifQ.iNTwJ0G4LE9lzmZihsfVaw4dTAebdc5EKe5S169eZvg',无法访问系统资源
+2026-09-17 07:11:23 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler - 请求地址'/resource/oss/upload',发生未知异常.
+org.dromara.common.oss.exception.OssException: 文件存储服务类型无法找到!
+	at org.dromara.common.oss.factory.OssFactory.instance(OssFactory.java:36)
+	at org.dromara.system.service.impl.SysOssServiceImpl.upload(SysOssServiceImpl.java:283)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
+
+---FILE_END_HEAD---
+FILE_SIZE /tmp/logs_20260916/日志/67/sys-error.2026-09-16.log 6726
+FILE_HEAD sys-error.2026-09-16.log
+2026-09-17 06:51:27 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在.
+2026-09-17 06:51:29 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在.
+2026-09-17 06:51:30 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：Hzdyjsxs123456!@# 不存在.
+2026-09-17 06:54:26 [XNIO-1 task-5] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwODg4Iiwicm5TdHIiOiJFTFhSWjNNT09PSlVJWVk2d3lZOFBCSk9oanlBRmZ6USIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDg4OCwidXNlck5hbWUiOiIyMDIzMDcxMTMwNDAiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDQ0OCwiZGVwdE5hbWUiOiLlm63mnpflt6XnqIsyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDE0Iiwibmlja05hbWUiOiLlupTlpZXokLEifQ.vQAIqY-m7edMQpJ48ccpYHIh_hrAkKtgOLI5-4YnNrE',无法访问系统资源
+2026-09-17 07:04:00 [XNIO-1 task-7] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoyMDI1MTIyMzE4MTAxNDEwMTU5Iiwicm5TdHIiOiJEZnZqUW5xdXNqNzU1aDVrZU8xOXB3VERHbkw0d0M0SyIsImNsaWVudGlkIjoiZTVjZDdlNDg5MWJmOTVkMWQxOTIwNmNlMjRhN2IzMmUiLCJ0ZW5hbnRJZCI6IjAwMDAwMCIsInVzZXJJZCI6MjAyNTEyMjMxODEwMTQxMDE1OSwidXNlck5hbWUiOiIyMDIzMDIwMzIwMjgiLCJkZXB0SWQiOjIwMjUxMjIzMTQwOTA5MDA1NCwiZGVwdE5hbWUiOiLnlLXmsJQyMzEiLCJkZXB0Q2F0ZWdvcnkiOiJiai0yMDIzMDAxIiwibmlja05hbWUiOiLlr7_lrrbnq4sifQ.e8IF_NjJCCwbuSCYI6rHJUWG2gqph4afmrIe7pQJXSw',无法访问系统资源
+2026-09-17 07:29:41 [XNIO-1 task-5] ERROR o.d.c.w.h.GlobalExceptionHandler - 对不起, 您的账号：20260137007 不存在.
+2026-09-17 07:31:50 [XNIO-1 task-5] ERROR o.d.c.s.h.SaTokenExceptionHandler - 请求地址'/resource/oss/listByIds/1994610252481355777',认证失败'token 已被冻结：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOiJzeXNfdXNlcjoxNDYiLCJyblN0ciI6InZIdmxGVTZuR0pLU25tdmNaeGtPalB2YVBSS0pKRFFRIiwiY2xpZW50aWQiOiJlNWNkN2U0ODkxYmY5NWQxZDE5MjA2Y2UyNGE3YjMyZSIsInRlbmFudElkIjoiMDAwMDAwIiwidXNlcklkIjoxNDYsInVzZXJOYW1lIjoiMTkyNzU3NDEwMDMiLCJkZXB0SWQiOjIwMjUxMjIzMTMwNzE3MDAyMiwiZGVwdE5hbWUiOiLppJDppa7kvJHpl7LlrabpmaIiLCJkZXB0Q2F0ZWdvcnkiOiJ4eS0xOCIsIm5pY2tOYW1lIjoi6YKs5amV5oWnIn0.NK6MSCbs5L_hptULfIZEYFfF9Hm-uD9eJ7qLt26AVQg',无法访问系统资源
+2026-09-17 07:43:16 [XNIO-1 task-6] ERROR o.d.c.s.h.SaTokenExceptionHandler
+---FILE_END_HEAD---

问题整改/攻击日志摘录/evidence-block-auth-register-root.txt

@@ -0,0 +1,611 @@
+2026-09-16 14:49:14 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
+ - 对不起, 您的租户不存在，请联系管理员
+2026-09-16 14:49:23 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
+ - 对不起, 您的租户不存在，请联系管理员
+Creating a new SqlSession
+SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] was not registered for synchronization because synchronization is not active
+JDBC Connection [HikariProxyConnection@214714929 wrapping com.mysql.cj.jdbc.ConnectionImpl@e9301dc] will not be managed by Spring
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
+==> Parameters: sys.account.registerUser(String)
+2026-09-16 14:49:32 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
+ - master - Connection com.mysql.cj.jdbc.ConnectionImpl@e9301dc marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
+java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+	at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
+	at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
+	at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
+	at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)
+	at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58)
+	at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source)
+	at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65)
+	at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80)
+	at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61)
+	at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source)
+	at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65)
+	at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336)
+	at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158)
+	at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110)
+	at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81)
+	at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59)
+	at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142)
+	at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333)
+	at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
+	at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
+	at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
+	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
+	at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
+	at org.dromara.web.controller.AuthController.register(AuthController.java:186)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
+	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
+	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
+	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
+	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
+	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
+	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
+	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
+	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
+	at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
+	at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
+	at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
+	at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
+	at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
+	at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
+	at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
+	at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
+	at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
+	at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
+	at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
+	at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
+	at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
+	at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
+	at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
+	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
+	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
+	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
+	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
+	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+	at java.base/java.lang.Thread.run(Thread.java:840)
+Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3]
+2026-09-16 14:49:32 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
+ - 请求地址'/auth/register',发生未知异常.
+org.springframework.jdbc.UncategorizedSQLException: 
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+### The error may involve defaultParameterMap
+### The error occurred while setting parameters
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
+### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~5.7.39-log'
+	at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:94)
+	at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:347)
+	at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
+	at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
+	at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
+	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
+	at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
+	at org.dromara.web.controller.AuthController.register(AuthController.java:186)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
+	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
+	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
+	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
+	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
+	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
+	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
+	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
+	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
+	at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
+	at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
+	at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
+	at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
+	at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
+	at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
+	at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
+	at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
+	at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
+	at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
+	at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
+	at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
+	at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
+	at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
+	at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
+	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
+	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
+	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
+	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
+	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+	at java.base/java.lang.Thread.run(Thread.java:840)
+Caused by: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+	at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
+	at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
+	at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
+	at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)
+	at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58)
+	at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source)
+	at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65)
+	at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80)
+	at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61)
+	at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source)
+	at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65)
+	at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336)
+	at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158)
+	at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110)
+	at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81)
+	at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59)
+	at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142)
+	at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333)
+	... 115 common frames omitted
+Creating a new SqlSession
+SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] was not registered for synchronization because synchronization is not active
+JDBC Connection [HikariProxyConnection@1203979072 wrapping com.mysql.cj.jdbc.ConnectionImpl@74224bcb] will not be managed by Spring
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+==> Parameters: sys.account.registerUser(String)
+2026-09-16 14:50:08 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
+ - master - Connection com.mysql.cj.jdbc.ConnectionImpl@74224bcb marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
+java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+	at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
+	at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
+	at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
+	at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)
+	at jdk.internal.reflect.GeneratedMethodAccessor48.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:58)
+	at jdk.proxy3/jdk.proxy3.$Proxy426.execute(Unknown Source)
+	at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:65)
+	at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:80)
+	at jdk.internal.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61)
+	at jdk.proxy2/jdk.proxy2.$Proxy424.query(Unknown Source)
+	at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:65)
+	at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:336)
+	at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:158)
+	at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:110)
+	at com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor.intercept(MybatisPlusInterceptor.java:81)
+	at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:59)
+	at jdk.proxy2/jdk.proxy2.$Proxy423.query(Unknown Source)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:154)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:147)
+	at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:142)
+	at jdk.internal.reflect.GeneratedMethodAccessor63.invoke(Unknown Source)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:333)
+	at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
+	at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
+	at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
+	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
+	at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
+	at org.dromara.web.controller.AuthController.register(AuthController.java:186)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
+	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
+	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
+	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
+	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
+	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
+	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
+	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
+	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
+	at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
+	at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
+	at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
+	at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
+	at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
+	at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
+	at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
+	at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
+	at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
+	at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
+	at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
+	at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
+	at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
+	at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
+	at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
+	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
+	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
+	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
+	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
+	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+	at java.base/java.lang.Thread.run(Thread.java:840)
+Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8]
+2026-09-16 14:50:08 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
+ - 请求地址'/auth/register',发生未知异常.
+org.springframework.jdbc.UncategorizedSQLException: 
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+### The error may involve defaultParameterMap
+### The error occurred while setting parameters
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
+	at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:94)
+	at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:347)
+	at jdk.proxy2/jdk.proxy2.$Proxy156.selectList(Unknown Source)
+	at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:194)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.executeForMany(MybatisMapperMethod.java:164)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperMethod.execute(MybatisMapperMethod.java:77)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$PlainMethodInvoker.invoke(MybatisMapperProxy.java:156)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectList(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:332)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:172)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at com.baomidou.mybatisplus.core.mapper.BaseMapper.selectOne(BaseMapper.java:321)
+	at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:732)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy$DefaultMethodInvoker.invoke(MybatisMapperProxy.java:182)
+	at com.baomidou.mybatisplus.core.override.MybatisMapperProxy.invoke(MybatisMapperProxy.java:93)
+	at jdk.proxy2/jdk.proxy2.$Proxy176.selectOne(Unknown Source)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.lambda$selectRegisterEnabled$0(SysConfigServiceImpl.java:87)
+	at org.dromara.common.tenant.helper.TenantHelper.dynamic(TenantHelper.java:211)
+	at org.dromara.system.service.impl.SysConfigServiceImpl.selectRegisterEnabled(SysConfigServiceImpl.java:86)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
+	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:724)
+	at org.dromara.system.service.impl.SysConfigServiceImpl$$SpringCGLIB$$0.selectRegisterEnabled(<generated>)
+	at org.dromara.web.controller.AuthController.register(AuthController.java:186)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
+	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
+	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
+	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258)
+	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191)
+	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986)
+	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891)
+	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
+	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089)
+	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
+	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
+	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:547)
+	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)
+	at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
+	at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.RepeatableFilter.doFilter(RepeatableFilter.java:32)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaServletFilter.doFilter(SaServletFilter.java:143)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaFirewallCheckFilterForJakartaServlet.doFilter(SaFirewallCheckFilterForJakartaServlet.java:69)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenCorsFilterForJakartaServlet.doFilter(SaTokenCorsFilterForJakartaServlet.java:52)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at cn.dev33.satoken.filter.SaTokenContextFilterForJakartaServlet.doFilter(SaTokenContextFilterForJakartaServlet.java:40)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.dromara.common.web.filter.XssFilter.doFilter(XssFilter.java:42)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:67)
+	at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
+	at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
+	at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
+	at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
+	at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
+	at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
+	at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
+	at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
+	at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
+	at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
+	at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
+	at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
+	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
+	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
+	at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
+	at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
+	at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
+	at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
+	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
+	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
+	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
+	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
+	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+	at java.base/java.lang.Thread.run(Thread.java:840)
+Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+	at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:121)
+	at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:988)
+	at com.mysql.cj.jdbc.ClientPreparedStatement.execute(ClientPreparedStatement.java:382)
+	at com.zaxxer.hikari.pool.ProxyPreparedStatement.execute(ProxyPreparedStatement.java:44)
+	at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.execute(HikariProxyPreparedStatement.java)

问题整改/攻击日志摘录/excerpts-xpath.txt

@@ -0,0 +1,75 @@
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630250
+java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630400
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630405
+### Cause: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630406
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:630522
+Caused by: java.sql.SQLException: XPATH syntax error: '~23 13:14:37|2|2026-09-16 '
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:650908
+java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651058
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651063
+### Cause: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651064
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:651180
+Caused by: java.sql.SQLException: XPATH syntax error: '~|0|36.28.73.85|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656229
+java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656379
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656384
+### Cause: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656385
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~0|36.21.215.72|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:656501
+Caused by: java.sql.SQLException: XPATH syntax error: '~0|36.21.215.72|2026-09-16'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:664993
+java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665143
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665148
+### Cause: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665149
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~.138.37|2026-09-16 08:45:'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665265
+Caused by: java.sql.SQLException: XPATH syntax error: '~.138.37|2026-09-16 08:45:'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665619
+java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665769
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665774
+### Cause: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665775
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
+
+### /tmp/logs_20260916/日志/ruoyi-admin-68-9901.log:665891
+Caused by: java.sql.SQLException: XPATH syntax error: '~:37|15|2026-09-16 08:45:3'
+

问题整改/攻击日志摘录/primary-extract-sql-samples.txt

@@ -0,0 +1,45 @@
+[2026-09-16 14:07:35] L2067
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L2227
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L2384
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L2544
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L2701
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L2861
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L3018
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L3178
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L3335
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L3495
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L3652
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT schema_name FROM information_schema.schemata limit 0,1))) AND '1'='1'
+
+[2026-09-16 14:07:35] L3812
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT schema_name FROM information_schema.schemata limit 0,1))) AND '1'='1'
+
+[2026-09-16 14:07:35] L3969
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L4129
+### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
+
+[2026-09-16 14:07:35] L4286
+==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema='hzdyjs_xg' limit 0,1))) AND '1'='1'
+

问题整改/攻击日志摘录/primary-register-hits.txt

@@ -0,0 +1,60 @@
+[2026-09-16 14:07:35] L2221
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L2538
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L2855
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L3172
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L3489
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L3806
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L4123
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L4440
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L4757
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L5074
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L5241
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L5562
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L5879
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L6196
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L6513
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L6830
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L7145
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L7458
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L7771
+ - 请求地址'/auth/register',发生未知异常.
+
+[2026-09-16 14:07:35] L8084
+ - 请求地址'/auth/register',发生未知异常.
+

问题整改/攻击日志摘录/primary-root-leaks.txt

@@ -0,0 +1,60 @@
+[2026-09-16 14:07:35] L2388
+java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L2540
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L2545
+### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L2546
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L2664
+Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L3022
+java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L3174
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L3179
+### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L3180
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L3298
+Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L6046
+java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L6198
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L6203
+### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L6204
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L6322
+Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L930214
+java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L930364
+### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L930369
+### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L930370
+; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
+
+[2026-09-16 14:07:35] L930486
+Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+

问题整改/攻击日志摘录/primary-sysconfig-hits.txt

@@ -0,0 +1,45 @@
+[2026-09-16 14:07:35] L2224
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L2541
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L2858
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L3175
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L3492
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L3809
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L4126
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L4443
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L4760
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L5077
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L5244
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L5565
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L5882
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L6199
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+
+[2026-09-16 14:07:35] L6516
+### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+

问题整改/攻击日志摘录/primary-xpath-context.txt

@@ -0,0 +1,120 @@
+===== BLOCK 1 ts=2026-09-16 14:07:35 =====
+2064: Creating a new SqlSession
+2065: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3] was not registered for synchronization because synchronization is not active
+2066: JDBC Connection [HikariProxyConnection@214714929 wrapping com.mysql.cj.jdbc.ConnectionImpl@e9301dc] will not be managed by Spring
+2067: ==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
+2068: ==> Parameters: sys.account.registerUser(String)
+2069: 2026-09-16 14:49:32 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
+2070:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@e9301dc marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
+2071: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+
+===== BLOCK 2 ts=2026-09-16 14:07:35 =====
+2216: 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+2217: 	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+2218: 	at java.base/java.lang.Thread.run(Thread.java:840)
+2219: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@78067be3]
+2220: 2026-09-16 14:49:32 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
+2221:  - 请求地址'/auth/register',发生未知异常.
+2222: org.springframework.jdbc.UncategorizedSQLException: 
+2223: ### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+
+===== BLOCK 3 ts=2026-09-16 14:07:35 =====
+2221:  - 请求地址'/auth/register',发生未知异常.
+2222: org.springframework.jdbc.UncategorizedSQLException: 
+2223: ### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+2224: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+2225: ### The error may involve defaultParameterMap
+2226: ### The error occurred while setting parameters
+2227: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
+2228: ### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+
+===== BLOCK 4 ts=2026-09-16 14:07:35 =====
+2222: org.springframework.jdbc.UncategorizedSQLException: 
+2223: ### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+2224: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+2225: ### The error may involve defaultParameterMap
+2226: ### The error occurred while setting parameters
+2227: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1'
+2228: ### Cause: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+2229: ; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~5.7.39-log'
+
+===== BLOCK 5 ts=2026-09-16 14:07:35 =====
+2340: 	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
+2341: 	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
+2342: 	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
+2343: 	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
+2344: 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+2345: 	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+2346: 	at java.base/java.lang.Thread.run(Thread.java:840)
+2347: Caused by: java.sql.SQLException: XPATH syntax error: '~5.7.39-log'
+
+===== BLOCK 6 ts=2026-09-16 14:07:35 =====
+2381: Creating a new SqlSession
+2382: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8] was not registered for synchronization because synchronization is not active
+2383: JDBC Connection [HikariProxyConnection@1203979072 wrapping com.mysql.cj.jdbc.ConnectionImpl@74224bcb] will not be managed by Spring
+2384: ==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+2385: ==> Parameters: sys.account.registerUser(String)
+2386: 2026-09-16 14:50:08 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
+2387:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@74224bcb marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
+2388: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+===== BLOCK 7 ts=2026-09-16 14:07:35 =====
+2533: 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+2534: 	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+2535: 	at java.base/java.lang.Thread.run(Thread.java:840)
+2536: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@293b36f8]
+2537: 2026-09-16 14:50:08 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
+2538:  - 请求地址'/auth/register',发生未知异常.
+2539: org.springframework.jdbc.UncategorizedSQLException: 
+2540: ### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+===== BLOCK 8 ts=2026-09-16 14:07:35 =====
+2538:  - 请求地址'/auth/register',发生未知异常.
+2539: org.springframework.jdbc.UncategorizedSQLException: 
+2540: ### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+2541: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+2542: ### The error may involve defaultParameterMap
+2543: ### The error occurred while setting parameters
+2544: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+2545: ### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+===== BLOCK 9 ts=2026-09-16 14:07:35 =====
+2539: org.springframework.jdbc.UncategorizedSQLException: 
+2540: ### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+2541: ### The error may exist in org/dromara/system/mapper/SysConfigMapper.java (best guess)
+2542: ### The error may involve defaultParameterMap
+2543: ### The error occurred while setting parameters
+2544: ### SQL: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT user()))) AND '1'='1'
+2545: ### Cause: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+2546: ; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~root@172.16.0.68'
+
+===== BLOCK 10 ts=2026-09-16 14:07:35 =====
+2657: 	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
+2658: 	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
+2659: 	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
+2660: 	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
+2661: 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+2662: 	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+2663: 	at java.base/java.lang.Thread.run(Thread.java:840)
+2664: Caused by: java.sql.SQLException: XPATH syntax error: '~root@172.16.0.68'
+
+===== BLOCK 11 ts=2026-09-16 14:07:35 =====
+2698: Creating a new SqlSession
+2699: SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@5b14fe1e] was not registered for synchronization because synchronization is not active
+2700: JDBC Connection [HikariProxyConnection@519848463 wrapping com.mysql.cj.jdbc.ConnectionImpl@5708c209] will not be managed by Spring
+2701: ==>  Preparing: SELECT config_id, config_name, config_key, config_value, config_type, remark, tenant_id, create_dept, create_by, create_time, update_by, update_time FROM sys_config WHERE (config_key = ?) AND tenant_id = '000000' AND extractvalue(1,concat(0x7e,(SELECT database()))) AND '1'='1'
+2702: ==> Parameters: sys.account.registerUser(String)
+2703: 2026-09-16 14:52:10 [XNIO-1 task-2] WARN  c.zaxxer.hikari.pool.ProxyConnection
+2704:  - master - Connection com.mysql.cj.jdbc.ConnectionImpl@5708c209 marked as broken because of SQLSTATE(HY000), ErrorCode(1105)
+2705: java.sql.SQLException: XPATH syntax error: '~hzdyjs_xg'
+
+===== BLOCK 12 ts=2026-09-16 14:07:35 =====
+2850: 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
+2851: 	at org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
+2852: 	at java.base/java.lang.Thread.run(Thread.java:840)
+2853: Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@5b14fe1e]
+2854: 2026-09-16 14:52:10 [XNIO-1 task-2] ERROR o.d.c.w.h.GlobalExceptionHandler
+2855:  - 请求地址'/auth/register',发生未知异常.
+2856: org.springframework.jdbc.UncategorizedSQLException: 
+2857: ### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~hzdyjs_xg'
+

问题整改/攻击日志摘录/stats.txt

@@ -0,0 +1,34 @@
+COUNTS {'extractvalue': 16726, 'registerUser_param': 8747, 'xpath': 42230, 'register': 8644, 'SysConfigMapper': 8540, 'root_leak': 200}
+TS_FIRST 2026-09-16 10:43:25
+TS_LAST 2026-09-16 23:36:48
+TS_UNIQUE 978
+HOURS
+2026-09-16 10 count_lines=15
+2026-09-16 14 count_lines=65
+2026-09-16 15 count_lines=31500
+2026-09-16 16 count_lines=10125
+2026-09-16 17 count_lines=5
+2026-09-16 21 count_lines=15
+2026-09-16 22 count_lines=380
+2026-09-16 23 count_lines=125
+TOP_FRAGS
+8705	~__EMPTY__
+260	~
+235	~tenant_id
+230	~create_by
+225	~create_time
+225	~update_by
+225	~update_time
+210	~2025-12-23 13:1
+205	~create_dept
+200	~root@172.16.0.68
+185	~610252481355777
+170	~remark
+170	~025122313071700
+160	~id
+135	~deleted
+130	~~|~$2a$10$FGldU
+130	~5BGGq9ONuBmYhxL
+130	~weFhmbkE45keMKA
+130	~SNZpjETXawE1oGb
+120	~~2025-12-23 13: