Tencent/APIJSON · error · IllegalArgumentException

{method}请求，{name}/{key} 里面的 {idInKey}:[] 中所有项的类型都只能是 Long 或

Error message

{method}请求，{name}/{key} 里面的 {idInKey}:[] 中所有项的类型都只能是 Long 或 String ！

What it means

Thrown by verifyId when an id{} element is neither Number nor String (the final else of the item loop) — e.g. a boolean, nested object, or inner array. Each item must be a scalar id so the IN(...) list can be built safely (this also blocks payloads like ["1' OR 1='1"-style objects] from sneaking through).

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:794

			//解决 id{}: ["1' OR 1='1'))--"] 绕过id{}限制
			//new ArrayList<Long>(idIn) 不能检查类型，Java泛型擦除问题，居然能把 ["a"] 赋值进去还不报错
			for (int i = 0; i < idIn.size(); i++) {
				Object o = idIn.get(i);
				if (o == null) {
					throw new IllegalArgumentException(method + "请求，" + name + "/" + key
							+ " 里面的 " + idInKey + ":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \"\" ] 中任何一个 ！");
				}
				if (o instanceof Number) {
					//解决 Windows mysql-5.6.26-winx64 等低于 5.7 的 MySQL 可能 id{}: [0] 生成 id IN(0) 触发 MySQL bug 导致忽略 IN 条件
					//例如 UPDATE `apijson`.`TestRecord` SET `testAccountId` = -1 WHERE ( (`id` IN (0)) AND (`userId`= 82001) )
					if (((Number) o).longValue() <= 0) {
						throw new IllegalArgumentException(method + "请求，" + name + "/" + key
								+ " 里面的 " + idInKey + ":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \"\" ] 中任何一个 ！");
					}
				}
				else if (o instanceof String) {
					if (StringUtil.isEmpty(o, true)) {
						throw new IllegalArgumentException(method + "请求，" + name + "/" + key
								+ " 里面的 " + idInKey + ":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \"\" ] 中任何一个 ！");
					}
				}
				else {
					throw new IllegalArgumentException(method + "请求，" + name + "/" + key
							+ " 里面的 " + idInKey + ":[] 中所有项的类型都只能是 Long 或 String ！");
				}
			}
		}
	}


	/**校验并将response转换为指定的内容和结构
	* @param method
	* @param name
	* @param target
	* @param response
	* @param database

View on GitHub (pinned to 5284052872)

Solutions

Map the array to scalar ids: rows.map(r => r.id)
Ensure each element is a number or a non-empty string before sending
Add a pre-send type check helper shared by all write calls

Example fix

// before
{"User":{"id{}":[{"id":1},{"id":2}]}}
// after
{"User":{"id{}":[1,2]}}

Defensive patterns

Strategy: type-guard

Validate before calling

const idItemsValid = (ids) => ids.every(id => typeof id === 'number' || (typeof id === 'string' && id.trim() !== ''));

Type guard

const isScalarId = (v) => typeof v === 'number' || (typeof v === 'string' && v.trim() !== '');

Prevention

Map row objects to their id field before putting them in id{}
Run an every() type check on batch arrays in shared request middleware

When it happens

Trigger: PUT/DELETE with {"User":{"id{}":[{"id":1}]}} or {"User":{"id{}":[true]}} or {"User":{"id{}":[[1]]}}.

Common situations: Client maps API objects into the array instead of extracting id fields: ids = rows.map(r => r) instead of rows.map(r => r.id); a JSON serializer double-wraps values.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/83c7880fbfb0ba9c. Report an issue: GitHub.