Tencent/APIJSON · critical · UnsupportedOperationException

AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION == false 时不支持执

Error message

AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION == false 时不支持执行脚本！如需支持则设置为 true ！

What it means

getScriptEngine(lang) is the single gate for executing script-based remote functions (key():"script..." / script functions in APIJSONORM). It throws UnsupportedOperationException when the static flag AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION is false — the library's default hard-off switch, because allowing client-supplied scripts to run on the server is a code-execution risk. The error message itself tells you the fix: set the flag to true.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:1342

					if (v instanceof Map<?, ?> == false) {
						throw new IllegalArgumentException("Request 表 structure 配置的 " + IF.name()
								+ ":{ " + k + ":value } 中 value 不合法，必须是 JSONRequest {} ！");
					}

					if (nkl.contains(k) || real.get(k) != null) {
						real = parse(method, name, (M) v, real, database, datasource, namespace, catalog, schema, idCallback, parser, callback);
					}
				}
			}
		}

		Log.i(TAG, "parse  return real = " + toJSONString(real));
		return real;
	}

	public static ScriptEngine getScriptEngine(String lang) {
		if (ENABLE_SCRIPT_FUNCTION == false) {
			throw new UnsupportedOperationException("AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION" +
					" == false 时不支持执行脚本！如需支持则设置为 true ！");
		}

		boolean isEmpty = StringUtil.isEmpty(lang, true);
		ScriptEngine engine = isEmpty ? SCRIPT_ENGINE : SCRIPT_ENGINE_MANAGER.getEngineByName(lang);

		if (engine == null) {
			throw new NullPointerException("找不到可执行 " + (isEmpty ? "js" : lang) + " 脚本的引擎！engine == null!");
		}

		return engine;
	}


	/**执行操作
	 * @param opt
	 * @param targetChild
	 * @param real

View on GitHub (pinned to 5284052872)

Solutions

If you truly need script functions, opt in at startup: AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true; (once, during app init) — and understand it enables server-side script execution of request-supplied code.
Prefer replacing the script function with a server-registered Java remote function (implement FunctionParser, register in FunctionList) so no script engine is needed.
Remove the script-function key (e.g. "...()":"...") from the client request if the feature is not required.

Example fix

// before
// app init: nothing set; request uses "@script()":"javascript:java.lang.Math.abs(-1)"

// after (opt-in during application startup)
static {
    apijson.orm.AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true;
}
// or better: register a Java function and call "@abs()":"abs(-1)"

Defensive patterns

Strategy: validation

Validate before calling

if (requestUsesScriptFunction(body) && !AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION) {
  throw new UnsupportedOperationException(
    "Script functions disabled; enable AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION or use registered Java functions");
}

Try / catch

try { result = parser.executeScript(...); }
catch (UnsupportedOperationException e) {
  if (e.getMessage() != null && e.getMessage().contains("ENABLE_SCRIPT_FUNCTION")) {
    // feature not enabled — degrade to a registered Java function or reject the request; do NOT auto-enable in prod
    return fallbackRegisteredFunction();
  }
  throw e;
}

Prevention

Decide at deploy time whether script functions are allowed; set ENABLE_SCRIPT_FUNCTION once in app init, never per-request.
Audit client payloads for 'key():"..."' script functions when the flag is off; replace them with server-registered FunctionParser implementations.
Treat enabling this flag as a security review item — it permits execution of request-supplied code.

When it happens

Trigger: Any request containing a script function (e.g. "@raw()":"javascript:..." style or a function resolved via ScriptEngine) reaches AbstractVerifier.getScriptEngine while ENABLE_SCRIPT_FUNCTION retains its default false, and the throw happens before any engine lookup. Often first observed right after upgrading to a newer APIJSON that introduced the flag.

Common situations: Upgrading APIJSON to a version that disabled script functions by default (security hardening); a demo/test app copied from an older README that used script functions; deploying to production where the flag was intentionally left off and a legacy client still sends scripts.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/d591d262b7a120e5. Report an issue: GitHub.