From 7f4f5a0a472aa12b9f2e80d52c1e2f43cdd225cb Mon Sep 17 00:00:00 2001
From: safe1ine <140062425+safe1ine@users.noreply.github.com>
Date: Tue, 10 Feb 2026 17:51:59 +0800
Subject: [PATCH] fix: Prevent SQL injection via orderBy parameter in
 WithOrderBy and WithOrderRuleBy (#11856)

Co-authored-by: maosite <naocanmonster@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: monkeycode-ai <monkeycode-ai@chaitin.com>
---
 agent/app/api/v2/website_ssl.go | 2 +-
 agent/app/repo/common.go        | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/agent/app/api/v2/website_ssl.go b/agent/app/api/v2/website_ssl.go
index b00d71f2c..2466209bc 100644
--- a/agent/app/api/v2/website_ssl.go
+++ b/agent/app/api/v2/website_ssl.go
@@ -26,7 +26,7 @@ import (
 // @Router /websites/ssl/search [post]
 func (b *BaseApi) PageWebsiteSSL(c *gin.Context) {
 	var req request.WebsiteSSLSearch
-	if err := helper.CheckBind(&req, c); err != nil {
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
 	if !reflect.DeepEqual(req.PageInfo, dto.PageInfo{}) {
diff --git a/agent/app/repo/common.go b/agent/app/repo/common.go
index 3da6ce0ca..156402e2c 100644
--- a/agent/app/repo/common.go
+++ b/agent/app/repo/common.go
@@ -3,6 +3,7 @@ package repo
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/constant"
@@ -151,10 +152,15 @@ func WithByCreatedAt(startTime, endTime time.Time) DBOption {
 	}
 }
 
+var validColumnName = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
+
 func WithOrderBy(orderStr string) DBOption {
 	if orderStr == "createdAt" {
 		orderStr = "created_at"
 	}
+	if !validColumnName.MatchString(orderStr) {
+		orderStr = "created_at"
+	}
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Order(orderStr)
 	}
@@ -163,6 +169,9 @@ func WithOrderRuleBy(orderBy, order string) DBOption {
 	if orderBy == "createdAt" {
 		orderBy = "created_at"
 	}
+	if !validColumnName.MatchString(orderBy) {
+		orderBy = "created_at"
+	}
 	switch order {
 	case constant.OrderDesc:
 		order = "desc"