Tencent/APIJSON · error · UnsupportedOperationException

language = " + language + " 不合法！AbstractFunctionParser.ENABL

Error message

language = " + language + " 不合法！AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION == false 时不支持远程函数中的脚本形式！如需支持则设置 AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true ！

What it means

The Function-table row for the called function declares a non-Java language (e.g. luajs, python, js), which routes it to the script-execution path, but AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION is false. APIJSON blocks script-form remote functions by default because they allow arbitrary code strings from the Function table to execute; the flag must be consciously enabled.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java:419

			@NotNull AbstractFunctionParser<T, M, L> parser, @NotNull String function
			, @NotNull Map<String, Object> current, boolean containRaw) throws Exception {
        if (ENABLE_REMOTE_FUNCTION == false) {
            throw new UnsupportedOperationException("AbstractFunctionParser.ENABLE_REMOTE_FUNCTION" +
                    " == false 时不支持远程函数！如需支持则设置 AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true ！");
        }

		FunctionBean fb = parseFunction(function, current, false, containRaw);

		Map<String, Object> row = FUNCTION_MAP.get(fb.getMethod()); //FIXME  fb.getSchema() + "." + fb.getMethod()
		if (row == null) {
			throw new UnsupportedOperationException("不允许调用远程函数 " + fb.getMethod() + " !");
		}

        String language = (String) row.get("language");
        String lang = "java".equalsIgnoreCase(language) ? null : language;

        if (ENABLE_SCRIPT_FUNCTION == false && lang != null) {
            throw new UnsupportedOperationException("language = " + language + " 不合法！AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION" +
                    " == false 时不支持远程函数中的脚本形式！如需支持则设置 AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true ！");
        }

		if (lang != null && SCRIPT_EXECUTOR_MAP.get(lang) == null) {
			throw new ClassNotFoundException("找不到脚本语言 " + lang + " 对应的执行引擎！请先依赖相关库并在后端 APIJSONFunctionParser<T, M, L> 中注册！");
		}

		int version = row.get("version") != null ? Integer.parseInt(row.get("version").toString()) : 0;
		if (parser.getVersion() < version) {
			throw new UnsupportedOperationException("不允许 version = " + parser.getVersion() + " 的请求调用远程函数 " + fb.getMethod() + " ! 必须满足 version >= " + version + " !");
		}
		String tag = (String) row.get("tag");  // TODO 改为 tags，类似 methods 支持多个 tag。或者干脆不要？因为目前非开放请求全都只能后端指定
		if (tag != null && tag.equals(parser.getTag()) == false) {
			throw new UnsupportedOperationException("不允许 tag = " + parser.getTag() + " 的请求调用远程函数 " + fb.getMethod() + " ! 必须满足 tag = " + tag + " !");
		}
		String[] methods = StringUtil.split((String) row.get("methods"));
		List<String> ml = methods == null || methods.length <= 0 ? null : Arrays.asList(methods);
		if (ml != null && ml.contains(parser.getMethod().toString()) == false) {

View on GitHub (pinned to 5284052872)

Solutions

Set AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true at startup if script functions are required.
Otherwise change the Function row's language to 'java' and provide a Java implementation.
Delete/disable the script Function rows so clients cannot reach them.
Review ScriptExecutor registration (and sandboxing) before enabling in production.

Example fix

// before: only remote flag enabled
AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true;

// after
AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true;
AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true;

Defensive patterns

Strategy: validation

Validate before calling

String lang = (String) functionRow.get("language");
boolean needsScript = lang != null && !"java".equalsIgnoreCase(lang);
if (needsScript && !AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION) {
    // either flip the flag in backend init or switch the row to java
}

Try / catch

try { parser.invoke(fn, current); } catch (UnsupportedOperationException e) { if (e.getMessage().contains("ENABLE_SCRIPT_FUNCTION")) { /* config decision needed */ } throw e; }

Prevention

Decide the scripting policy once and encode it in the init class next to ENABLE_REMOTE_FUNCTION.
Prefer 'java' language rows unless dynamic scripts are a hard requirement.
Security-review Function table contents before enabling script execution.

When it happens

Trigger: Function table row has language='javascript' (or any non-'java' value) and a request invokes that function while ENABLE_SCRIPT_FUNCTION == false.

Common situations: Copying demo Function rows that include script functions into a backend that only enabled ENABLE_REMOTE_FUNCTION; security hardening disabled script functions and old payloads still call them.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/0565eae041968bbd. Report an issue: GitHub.