feat(sql): 新增 SqlSortUtils 工具类，提供排序字段校验功能

- 实现 isValidColumn 方法，校验前端传入的排序字段是否合法
- 更新 SqlFilterArgumentResolver，使用 SqlSortUtils 进行排序字段校验

(cherry picked from commit 1833847cd835d9972c2237cb804f00fd8075d4e8)

pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java

@@ -20,9 +20,9 @@ package com.pig4cloud.pigx.common.data.resolver;
 import cn.hutool.core.comparator.CompareUtil;
 import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.metadata.OrderItem;
-import com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtils;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.pig4cloud.pigx.common.core.exception.CheckedException;
+import com.pig4cloud.pigx.common.data.util.SqlSortUtils;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.core.MethodParameter;
@@ -92,14 +92,16 @@ public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver
 		List<OrderItem> orderItemList = new ArrayList<>();
 		Optional.ofNullable(ascs)
 			.ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA))
-				.filter(asc -> !SqlInjectionUtils.check(asc))
+				.map(String::trim)
+				.filter(SqlSortUtils::isValidColumn)
 				.map(OrderItem::asc)
-                    .toList()));
+				.toList()));
 		Optional.ofNullable(descs)
 			.ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA))
-				.filter(desc -> !SqlInjectionUtils.check(desc))
+				.map(String::trim)
+				.filter(SqlSortUtils::isValidColumn)
 				.map(OrderItem::desc)
-                    .toList()));
+				.toList()));
 		page.addOrder(orderItemList);
 
 		return page;

pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/util/SqlSortUtils.java

@@ -0,0 +1,43 @@
+/*
+ *    Copyright (c) 2018-2025, lengleng All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * Neither the name of the pig4cloud.com developer nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * Author: lengleng (wangiegie@gmail.com)
+ */
+
+package com.pig4cloud.pigx.common.data.util;
+
+import java.util.regex.Pattern;
+
+/**
+ * 前端排序字段校验。仅接受字段名或表别名限定的字段名，不接受 SQL 表达式。
+ * <p>
+ * 本工具只校验字段格式，业务层仍需限制允许排序的字段。
+ */
+public final class SqlSortUtils {
+
+	private static final Pattern SORT_COLUMN = Pattern.compile("[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*)?");
+
+	private SqlSortUtils() {
+	}
+
+	/**
+	 * 校验单个排序字段。调用方应先拆分多个字段并去除首尾空白。
+	 * @param column 前端传入的排序字段
+	 * @return 是否为合法的字段名或别名限定字段名
+	 */
+	public static boolean isValidColumn(String column) {
+		return column != null && SORT_COLUMN.matcher(column).matches();
+	}
+
+}