Tencent/APIJSON · error · IllegalArgumentException
字符 {origin} 不合法！预编译模式下 @column:"column0,column1:alias;functi
Error message
字符 {origin} 不合法！预编译模式下 @column:"column0,column1:alias;function0(arg0,arg1,...);function1(...):alias..." 中所有 arg 都必须是1个不以 _ 开头的单词 或者符合正则表达式 {PATTERN_FUNCTION} 且不包含连续减号 -- ！DISTINCT 必须全大写，且后面必须有且只有 1 个空格！其它情况不允许空格！ What it means
Second-pass catch-all validation of @column tokens: if a token (after any splitting) contains a backtick or single quote anywhere, or its origin starts with '_', or contains '--', it is rejected in prepared mode. This complements errors 141/142 by catching mixed cases — e.g. a quote in the middle of a token rather than at both ends — using the same anti-injection rules (identifier word or PATTERN_FUNCTION shape, no SQL comment).
Source
Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java:2856
mkes[j] = gainKey(origin);
continue;
}
else if (ck.startsWith("'") && ck.endsWith("'")) {
origin = ck.substring(1, ck.length() - 1);
if (origin.contains("'")) {
throw new IllegalArgumentException("字符串 " + ck + " 不合法！"
+ "预编译模式下 @column:\"column0,column1:alias;function0(arg0,arg1,...);function1(...):alias...\""
+ " 中字符串参数不合法，必须以 ' 开头, ' 结尾,字符串中不能包含 ' ");
}
// 1.字符串不是字段也没有别名,所以不解析别名 2. 是字符串，进行预编译，使用getValue() ,对字符串进行截取
mkes[j] = gainValue(origin).toString();
continue;
}
else if (ck.contains("`") || ck.contains("'") || origin.startsWith("_") || origin.contains("--")) {
// || PATTERN_FUNCTION.matcher(origin).matches() == false) {
throw new IllegalArgumentException("字符 " + origin + " 不合法！"
+ "预编译模式下 @column:\"column0,column1:alias;function0(arg0,arg1,...);function1(...):alias...\""
+ " 中所有 arg 都必须是1个不以 _ 开头的单词 或者符合正则表达式 " + PATTERN_FUNCTION
+ " 且不包含连续减号 -- ！DISTINCT 必须全大写，且后面必须有且只有 1 个空格！其它情况不允许空格！");
}
if (StringUtil.isNumber(origin)) {
//do nothing
} else {
String[] keys = origin.split("[.]");
StringBuilder sb = new StringBuilder();
int len = keys == null ? 0 : keys.length;
if (len > 0) {
boolean first = true;
for (String k : keys) {
if (StringUtil.isName(k) == false) {
sb = null;
break;View on GitHub (pinned to 5284052872)
Solutions
- Fix quoting so each quoted token is fully wrapped (then 141/142 rules apply cleanly) or remove quotes entirely.
- Remove '--' sequences and '_' prefixes as in error 140.
- Strip a bad alias: the offending part may be the ':alias' half — make alias a plain word not starting with '_'.
- Add a client-side pre-check that rejects tokens containing ` or ' mid-token (see validation code).
Example fix
// before
{"@column":"concat(name,'x) AS c, _id"}
// after
{"@column":"concat(name,'x'):c, id"} Defensive patterns
Strategy: validation
Validate before calling
boolean ok = Arrays.stream(atColumn.split(",")).allMatch(t -> {
String origin = t.contains(":") ? t.substring(0, t.indexOf(':')) : t;
return !t.contains("`") && !t.contains("'")
&& !origin.startsWith("_") && !origin.contains("--");
}); Type guard
function safeToken(t: string): boolean {
const origin = t.includes(':') ? t.slice(0, t.indexOf(':')) : t;
return !t.includes('`') && !t.includes("'") && !origin.startsWith('_') && !origin.includes('--');
} Try / catch
catch (IllegalArgumentException e) { log.warn("@column rejected: {}", atColumn); /* fall back to safe column list */ } Prevention
- Fully wrap or fully remove quotes — never mix.
- Remember the alias half also gets checked; keep aliases plain words.
- Run the same token lint client-side before each request.
When it happens
Trigger: @column items like "a`b", "tag='x'", "_id", "price--discount" or function args mixing quotes with identifiers, e.g. "concat(name,'x")" where quotes are unbalanced so the 141/142 branches don't fire and control falls to this else-if at AbstractSQLConfig.java:2856.
Common situations: Unbalanced quoting when dynamically concatenating @column strings; copying SQL expressions that embed quotes; legacy '_'-prefixed columns; subtraction typos with double minus. Note the check mixes ck (raw token) and origin (alias-stripped), so an alias starting with '_' can also trip it.
Related errors
- 字符 {ck} 不合法！预编译模式下 @column:"column0,column1:alias;function0(
- Cannot convert value of type " + value.getClass().getName()
- 字符 " + function + " 不合法！
- 字符 " + method + " 不合法！函数的名称 function 不能为空且必须符合方法命名规范！总体必须为 f
- 字符 {} 不合法！远程函数不允许指定类名！且必须为 function(key0,key1,...) 这种单函数格式！\
AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14).
Data as JSON: /api/errors/7e6728835085d118.
Report an issue: GitHub.