Tencent/APIJSON · error · IllegalArgumentException

{}: { @key(): value } 对应存储过程 value 中字符 {} 不合法！schema.functio

Error message

{}: { @key(): value } 对应存储过程 value 中字符 {} 不合法！schema.function(arg) 中 schema 必须符合 数据库名/模式名 的命名规则！一般只能传英文字母、数字、下划线！不允许 -- 等可能导致 SQL 注入的符号！

What it means

extractSchema() final validation: after optional backtick stripping, the schema must match PATTERN_SCHEMA (database/schema name rules, effectively letters/digits/underscore) and must not contain '--'. This is an explicit SQL-injection guard — schemas like 'db; drop table x' or 'db--comment' are rejected before ever reaching the SQL layer.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java:717

		int ind = sch.indexOf("`");
		if (ind > 0) {
			throw new IllegalArgumentException(table + ": { @key(): value } 对应存储过程 value 中字符 "
					+ sch + " 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！");
		}

		if (ind == 0) {
			sch = sch.substring(1);
			if (sch.indexOf("`") != sch.length() - 1) {
				throw new IllegalArgumentException(table + ": { @key(): value } 对应存储过程 value 中字符 `"
						+ sch + " 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！");
			}

			sch = sch.substring(0, sch.length() - 1);
		}

		if (PATTERN_SCHEMA.matcher(sch).matches() == false || sch.contains("--")) {
			throw new IllegalArgumentException(table + ": { @key(): value } 对应存储过程 value 中字符 "
					+ sch + " 不合法！schema.function(arg) 中 schema 必须符合 数据库名/模式名 的命名规则！"
					+ "一般只能传英文字母、数字、下划线！不允许 -- 等可能导致 SQL 注入的符号！");
		}

		return sch;
	}


	/**
	 * @param method
	 * @param keys
	 * @return
	 */
	public static String getFunction(String method, String[] keys) {
		String f = method + "(JSONMap request";

		if (keys != null) {
			for (int i = 0; i < keys.length; i++) {

View on GitHub (pinned to 5284052872)

Solutions

1. Rename the schema or route through a server-side alias so the request only ever contains [A-Za-z0-9_] identifiers.
2. Sanitize/whitelist user-supplied schema names on the server before composing the procedure string.
3. Never build the schema segment from raw user input; validate with ^[A-Za-z0-9_]+$ client-side too.

Example fix

// before
String proc = userInput + ".get_data(id)"; // userInput = "db; drop table users; --"
// after
if (!userInput.matches("[A-Za-z0-9_]+")) throw new IllegalArgumentException("bad schema");
String proc = userInput + ".get_data(id)";

private static final Pattern SAFE_SCHEMA = Pattern.compile("^[A-Za-z0-9_]+$");
boolean safe(String sch) {
  String s = sch.startsWith("`") && sch.endsWith("`") ? sch.substring(1, sch.length() - 1) : sch;
  return SAFE_SCHEMA.matcher(s).matches() && !s.contains("--");
}

const SAFE_SCHEMA = /^[A-Za-z0-9_]+$/;
function isSafeSchema(s: string): boolean {
  const t = s.startsWith('`') && s.endsWith('`') ? s.slice(1, -1) : s;
  return SAFE_SCHEMA.test(t) && !t.includes('--');
}

When it happens

Trigger: Stored procedure schema segment containing characters outside the allowed pattern: 'db-1.func(...)' (hyphen), 'db;delete.func(...)', 'my db.func(...)' (space), or any segment containing '--'.

Common situations: Attempting injection through the schema field; using schema names with hyphens or spaces (common in ClickHouse/BigQuery-style cluster names); front-end building the schema string from unescaped user input.

Related errors

• {}: { @key(): value } 对应存储过程 value 中字符 {} 不合法！`schema` 当有 `
• {}: { @key(): value } 对应存储过程 value 中字符 `{} 不合法！`schema` 当有 `
• @raw:value 的 value 中 {} 不合法！对应的 {}: value 在当前对象 {} 不存在或 valu
• key[]:{} 只支持 GET, GETS 方法！其它方法不允许传 {}:{} 等这种 key[]:{} 格式！
• ${key}:{} 里的 @combine:value 不合法！开放请求 GET、HEAD 才允许传 @combine:

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/47fd3b45d9141744. Report an issue: GitHub.