漏洞
Unable to query REST API when using a referenced service coming from an Oracle database or file geodatabase for a text field; the text is treated as a string, causing the query to fail when attempting to use ST_CODE = 54 without quotes due to ArcGIS Server's standardized queries enforcing SQL-92 syntax.
| 漏洞 ID 编号 | BUG-000174956 |
|---|---|
| 已提交 | March 11, 2025 |
| 上次修改时间 | July 7, 2025 |
| 适用范围 | ArcGIS Pro |
| 找到的版本 | 2.9.12 |
| 操作系统 | Windows OS |
| 操作系统版本 | 11.0 64 bit |
| 状态 | As Designed |
附加信息
The behavior in which the REST query ST_CODE = 54 fails without quotes but succeeds with ST_CODE = '54' is expected and by design. This is consistent with our official documentation on standardized queries in ArcGIS Server, which enforces SQL-92 syntax for security purposes (see: https://resources.arcgis.com/en/help/main/10.2/index.html#//015400000641000000).解决办法
Immediate Fix:
- Use: ST_CODE = '54'.
- Effect: Resolves the error regardless of settings, as validated in the test report.
Long-Term Consistency:
- Verify Settings: Path: system > properties > update.
- Confirm: "standardizedQueries": "true".
- Action: Keep enabled for security.
- Avoid Disabling: Disabling ("standardizedQueries": "false") allows lax syntax but risks SQL injection.
重现步骤
漏洞 ID: BUG-000174956
软件:
- ArcGIS Pro
当漏洞状态发生变化时获得通知
发现关于本主题的更多内容
搜索相关信息
查找与此主题相关的培训
探索想法并提供反馈
获取来自 ArcGIS 专家的帮助
下载 Esri 支持应用程序