{"record":{"id":"0565eae041968bbd","repo":"Tencent/APIJSON","slug":"language-language-abstractfunctionpa","errorCode":null,"errorMessage":"language = \" + language + \" 不合法！AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION == false 时不支持远程函数中的脚本形式！如需支持则设置 AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true ！","messagePattern":"language = \" \\+ language \\+ \" 不合法！AbstractFunctionParser\\.ENABLE_SCRIPT_FUNCTION == false 时不支持远程函数中的脚本形式！如需支持则设置 AbstractFunctionParser\\.ENABLE_SCRIPT_FUNCTION = true ！","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java","lineNumber":419,"sourceCode":"\t\t\t@NotNull AbstractFunctionParser<T, M, L> parser, @NotNull String function\n\t\t\t, @NotNull Map<String, Object> current, boolean containRaw) throws Exception {\n        if (ENABLE_REMOTE_FUNCTION == false) {\n            throw new UnsupportedOperationException(\"AbstractFunctionParser.ENABLE_REMOTE_FUNCTION\" +\n                    \" == false 时不支持远程函数！如需支持则设置 AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true ！\");\n        }\n\n\t\tFunctionBean fb = parseFunction(function, current, false, containRaw);\n\n\t\tMap<String, Object> row = FUNCTION_MAP.get(fb.getMethod()); //FIXME  fb.getSchema() + \".\" + fb.getMethod()\n\t\tif (row == null) {\n\t\t\tthrow new UnsupportedOperationException(\"不允许调用远程函数 \" + fb.getMethod() + \" !\");\n\t\t}\n\n        String language = (String) row.get(\"language\");\n        String lang = \"java\".equalsIgnoreCase(language) ? null : language;\n\n        if (ENABLE_SCRIPT_FUNCTION == false && lang != null) {\n            throw new UnsupportedOperationException(\"language = \" + language + \" 不合法！AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION\" +\n                    \" == false 时不支持远程函数中的脚本形式！如需支持则设置 AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true ！\");\n        }\n\n\t\tif (lang != null && SCRIPT_EXECUTOR_MAP.get(lang) == null) {\n\t\t\tthrow new ClassNotFoundException(\"找不到脚本语言 \" + lang + \" 对应的执行引擎！请先依赖相关库并在后端 APIJSONFunctionParser<T, M, L> 中注册！\");\n\t\t}\n\n\t\tint version = row.get(\"version\") != null ? Integer.parseInt(row.get(\"version\").toString()) : 0;\n\t\tif (parser.getVersion() < version) {\n\t\t\tthrow new UnsupportedOperationException(\"不允许 version = \" + parser.getVersion() + \" 的请求调用远程函数 \" + fb.getMethod() + \" ! 必须满足 version >= \" + version + \" !\");\n\t\t}\n\t\tString tag = (String) row.get(\"tag\");  // TODO 改为 tags，类似 methods 支持多个 tag。或者干脆不要？因为目前非开放请求全都只能后端指定\n\t\tif (tag != null && tag.equals(parser.getTag()) == false) {\n\t\t\tthrow new UnsupportedOperationException(\"不允许 tag = \" + parser.getTag() + \" 的请求调用远程函数 \" + fb.getMethod() + \" ! 必须满足 tag = \" + tag + \" !\");\n\t\t}\n\t\tString[] methods = StringUtil.split((String) row.get(\"methods\"));\n\t\tList<String> ml = methods == null || methods.length <= 0 ? null : Arrays.asList(methods);\n\t\tif (ml != null && ml.contains(parser.getMethod().toString()) == false) {","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java#L401-L437","documentation":"The Function-table row for the called function declares a non-Java language (e.g. luajs, python, js), which routes it to the script-execution path, but AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION is false. APIJSON blocks script-form remote functions by default because they allow arbitrary code strings from the Function table to execute; the flag must be consciously enabled.","triggerScenarios":"Function table row has language='javascript' (or any non-'java' value) and a request invokes that function while ENABLE_SCRIPT_FUNCTION == false.","commonSituations":"Copying demo Function rows that include script functions into a backend that only enabled ENABLE_REMOTE_FUNCTION; security hardening disabled script functions and old payloads still call them.","solutions":["Set AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true at startup if script functions are required.","Otherwise change the Function row's language to 'java' and provide a Java implementation.","Delete/disable the script Function rows so clients cannot reach them.","Review ScriptExecutor registration (and sandboxing) before enabling in production."],"exampleFix":"// before: only remote flag enabled\nAbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true;\n\n// after\nAbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true;\nAbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true;","handlingStrategy":"validation","validationCode":"String lang = (String) functionRow.get(\"language\");\nboolean needsScript = lang != null && !\"java\".equalsIgnoreCase(lang);\nif (needsScript && !AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION) {\n    // either flip the flag in backend init or switch the row to java\n}","typeGuard":null,"tryCatchPattern":"try { parser.invoke(fn, current); } catch (UnsupportedOperationException e) { if (e.getMessage().contains(\"ENABLE_SCRIPT_FUNCTION\")) { /* config decision needed */ } throw e; }","preventionTips":["Decide the scripting policy once and encode it in the init class next to ENABLE_REMOTE_FUNCTION.","Prefer 'java' language rows unless dynamic scripts are a hard requirement.","Security-review Function table contents before enabling script execution."],"tags":["apijson","scripting","feature-flag","remote-function"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}