Tencent/APIJSON · error · UnsupportedOperationException

AbstractFunctionParser.ENABLE_REMOTE_FUNCTION == false 时不支持远

Error message

AbstractFunctionParser.ENABLE_REMOTE_FUNCTION == false 时不支持远程函数！如需支持则设置 AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true ！

What it means

Static gate on remote functions: AbstractFunctionParser.ENABLE_REMOTE_FUNCTION defaults to false, and any attempt to execute a function through the Function-table path throws UnsupportedOperationException until the flag is explicitly enabled. This is a deliberate security default — remote functions let requests trigger server-side Java/script calls, so they are opt-in.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java:404

		if (StringUtil.isEmpty(function, true)) {
			throw new IllegalArgumentException("字符 " + function + " 不合法！");
		}

		return invoke(this, function, current, containRaw);
	}

	/**反射调用
	 * @param parser
	 * @param function 例如get(Map:map,key)，参数只允许引用，不能直接传值
     * @param current
     * @return {@link #invoke(AbstractFunctionParser, String, Class[], Object[])}
	 */
	@SuppressWarnings({"unchecked", "rawtypes"})
	public static <T, M extends Map<String, Object>, L extends List<Object>> Object invoke(
			@NotNull AbstractFunctionParser<T, M, L> parser, @NotNull String function
			, @NotNull Map<String, Object> current, boolean containRaw) throws Exception {
        if (ENABLE_REMOTE_FUNCTION == false) {
            throw new UnsupportedOperationException("AbstractFunctionParser.ENABLE_REMOTE_FUNCTION" +
                    " == false 时不支持远程函数！如需支持则设置 AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true ！");
        }

		FunctionBean fb = parseFunction(function, current, false, containRaw);

		Map<String, Object> row = FUNCTION_MAP.get(fb.getMethod()); //FIXME  fb.getSchema() + "." + fb.getMethod()
		if (row == null) {
			throw new UnsupportedOperationException("不允许调用远程函数 " + fb.getMethod() + " !");
		}

        String language = (String) row.get("language");
        String lang = "java".equalsIgnoreCase(language) ? null : language;

        if (ENABLE_SCRIPT_FUNCTION == false && lang != null) {
            throw new UnsupportedOperationException("language = " + language + " 不合法！AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION" +
                    " == false 时不支持远程函数中的脚本形式！如需支持则设置 AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true ！");
        }

View on GitHub (pinned to 5284052872)

Solutions

Set AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true during backend initialization (e.g. in your DemoApplication or Framework-level static init) if remote functions are intended.
If not intended, remove the function expressions from the request/client code.
Make sure the assignment happens before the first request, not lazily.

Example fix

// before
// flag left at default false; requests with functions fail

// after
static {
    AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true;
}
// or in DemoVerifier/DemoInitializer init()

Defensive patterns

Strategy: validation

Validate before calling

if (!AbstractFunctionParser.ENABLE_REMOTE_FUNCTION && requestContainsFunctions(request)) {
    // reject before sending, or instruct ops to enable the flag in backend init
}

Try / catch

try { parser.invoke(fn, current); } catch (UnsupportedOperationException e) { if (e.getMessage().contains("ENABLE_REMOTE_FUNCTION")) { /* surface config guidance to operator */ } throw e; }

Prevention

Centralize APIJSON static config (ENABLE_REMOTE_FUNCTION, ENABLE_SCRIPT_FUNCTION) in one init class run at startup.
Document in deployment checklists whether the app uses remote functions.
Only enable if the Function table contents are fully trusted.

When it happens

Trigger: A request contains a remote function call (e.g. "@column": "plus(id,1)" style, or invoke(...) is reached) while ENABLE_REMOTE_FUNCTION is still false.

Common situations: Freshly deployed APIJSON backend where features were used from a demo project without porting the static init block that sets the flag; upgrade reset custom initialization; security review deliberately disabled it.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/90ddbece21aa89aa. Report an issue: GitHub.