From 44a562cbd0bfd2545449e149125d2ba62a957db4 Mon Sep 17 00:00:00 2001
From: Karson <karsonzhang@163.com>
Date: Thu, 27 Aug 2026 11:46:40 +0800
Subject: [PATCH] =?UTF-8?q?=E5=8A=A0=E5=BC=BAJSON=E5=AD=97=E6=AE=B5?=
 =?UTF-8?q?=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 library/think/db/builder/Mysql.php | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/library/think/db/builder/Mysql.php b/library/think/db/builder/Mysql.php
index be2af714..76ff6606 100644
--- a/library/think/db/builder/Mysql.php
+++ b/library/think/db/builder/Mysql.php
@@ -97,7 +97,18 @@ class Mysql extends Builder
         $key = trim($key);
         if (strpos($key, '$.') && false === strpos($key, '(')) {
             // JSON字段支持
-            list($field, $name) = explode('$.', $key);
+            list($field, $name) = explode('$.', $key, 2);
+            if ($field === '' || $name === '') {
+                throw new Exception('invalid json field: ' . $key);
+            }
+            // 验证 field 为合法字段名（只允许字母、数字、下划线、点号，且不能有连续点或首尾点）
+            if (!preg_match('/^[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+)*$/', $field)) {
+                throw new Exception('invalid json field: ' . $field);
+            }
+            // 验证 name 为合法 JSON 路径（支持嵌套点和数组下标）
+            if (!preg_match('/^[a-zA-Z0-9_]+(\[[0-9]+\]|\.[a-zA-Z0-9_]+)*$/', $name)) {
+                throw new Exception('invalid json field: ' . $name);
+            }
             return 'json_extract(' . $field . ', \'$.' . $name . '\')';
         } elseif (strpos($key, '.') && !preg_match('/[,\'\"\(\)`\s]/', $key)) {
             list($table, $key) = explode('.', $key, 2);