fix: allow semicolons in normal request content

national-motion-base-core/src/main/java/org/jeecg/common/util/SecurityUtils.java

@@ -109,7 +109,7 @@ public class SecurityUtils {
      */
     private static final Pattern[] SQL_INJECTION_PATTERNS = {
             // SQL 注释
-            Pattern.compile("('.+--)|(--)|(;)|(\\|{2})"),
+            Pattern.compile("('.+--)|(--)|(\\|{2})"),
             // SQL 函数调用
             Pattern.compile("\\bexec(ute)?\\s*\\(", Pattern.CASE_INSENSITIVE),
             // union 查询

national-motion-base-core/src/test/java/org/jeecg/common/util/SecurityUtilsTest.java

@@ -0,0 +1,27 @@
+package org.jeecg.common.util;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class SecurityUtilsTest {
+
+    @Test
+    void allowsOrdinarySemicolonsInChineseAndHtmlContent() {
+        assertFalse(SecurityUtils.containsSqlInjection("为服务社区; 请遵守场地规定。"));
+        assertFalse(SecurityUtils.containsSqlInjection("<p>入场须知: 请文明使用场地; 爱护公共设施。</p>"));
+    }
+
+    @Test
+    void rejectsSemicolonFollowedByDangerousSqlStatements() {
+        assertTrue(SecurityUtils.containsSqlInjection("正常内容; drop table nm_site_place"));
+        assertTrue(SecurityUtils.containsSqlInjection("正常内容; update nm_site_place set status = 1"));
+    }
+
+    @Test
+    void stillRejectsUnionSelectAndSqlComments() {
+        assertTrue(SecurityUtils.containsSqlInjection("1 union select password from sys_user"));
+        assertTrue(SecurityUtils.containsSqlInjection("正常内容 -- SQL comment"));
+    }
+}