{"record":{"id":"47fd3b45d9141744","repo":"Tencent/APIJSON","slug":"key-value-value-sche","errorCode":null,"errorMessage":"{}: { @key(): value } 对应存储过程 value 中字符 {} 不合法！schema.function(arg) 中 schema 必须符合 数据库名/模式名 的命名规则！一般只能传英文字母、数字、下划线！不允许 -- 等可能导致 SQL 注入的符号！","messagePattern":"(.+?): (.+?) 对应存储过程 value 中字符 (.+?) 不合法！schema\\.function\\(arg\\) 中 schema 必须符合 数据库名/模式名 的命名规则！一般只能传英文字母、数字、下划线！不允许 -- 等可能导致 SQL 注入的符号！","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java","lineNumber":717,"sourceCode":"\n\t\tint ind = sch.indexOf(\"`\");\n\t\tif (ind > 0) {\n\t\t\tthrow new IllegalArgumentException(table + \": { @key(): value } 对应存储过程 value 中字符 \"\n\t\t\t\t\t+ sch + \" 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！\");\n\t\t}\n\n\t\tif (ind == 0) {\n\t\t\tsch = sch.substring(1);\n\t\t\tif (sch.indexOf(\"`\") != sch.length() - 1) {\n\t\t\t\tthrow new IllegalArgumentException(table + \": { @key(): value } 对应存储过程 value 中字符 `\"\n\t\t\t\t\t\t+ sch + \" 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！\");\n\t\t\t}\n\n\t\t\tsch = sch.substring(0, sch.length() - 1);\n\t\t}\n\n\t\tif (PATTERN_SCHEMA.matcher(sch).matches() == false || sch.contains(\"--\")) {\n\t\t\tthrow new IllegalArgumentException(table + \": { @key(): value } 对应存储过程 value 中字符 \"\n\t\t\t\t\t+ sch + \" 不合法！schema.function(arg) 中 schema 必须符合 数据库名/模式名 的命名规则！\"\n\t\t\t\t\t+ \"一般只能传英文字母、数字、下划线！不允许 -- 等可能导致 SQL 注入的符号！\");\n\t\t}\n\n\t\treturn sch;\n\t}\n\n\n\t/**\n\t * @param method\n\t * @param keys\n\t * @return\n\t */\n\tpublic static String getFunction(String method, String[] keys) {\n\t\tString f = method + \"(JSONMap request\";\n\n\t\tif (keys != null) {\n\t\t\tfor (int i = 0; i < keys.length; i++) {","sourceCodeStart":699,"sourceCodeEnd":735,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java#L699-L735","documentation":"extractSchema() final validation: after optional backtick stripping, the schema must match PATTERN_SCHEMA (database/schema name rules, effectively letters/digits/underscore) and must not contain '--'. This is an explicit SQL-injection guard — schemas like 'db; drop table x' or 'db--comment' are rejected before ever reaching the SQL layer.","triggerScenarios":"Stored procedure schema segment containing characters outside the allowed pattern: 'db-1.func(...)' (hyphen), 'db;delete.func(...)', 'my db.func(...)' (space), or any segment containing '--'.","commonSituations":"Attempting injection through the schema field; using schema names with hyphens or spaces (common in ClickHouse/BigQuery-style cluster names); front-end building the schema string from unescaped user input.","solutions":["Rename the schema or route through a server-side alias so the request only ever contains [A-Za-z0-9_] identifiers.","Sanitize/whitelist user-supplied schema names on the server before composing the procedure string.","Never build the schema segment from raw user input; validate with ^[A-Za-z0-9_]+$ client-side too."],"exampleFix":"// before\nString proc = userInput + \".get_data(id)\"; // userInput = \"db; drop table users; --\"\n// after\nif (!userInput.matches(\"[A-Za-z0-9_]+\")) throw new IllegalArgumentException(\"bad schema\");\nString proc = userInput + \".get_data(id)\";","handlingStrategy":"validation","validationCode":"private static final Pattern SAFE_SCHEMA = Pattern.compile(\"^[A-Za-z0-9_]+$\");\nboolean safe(String sch) {\n  String s = sch.startsWith(\"`\") && sch.endsWith(\"`\") ? sch.substring(1, sch.length() - 1) : sch;\n  return SAFE_SCHEMA.matcher(s).matches() && !s.contains(\"--\");\n}","typeGuard":"const SAFE_SCHEMA = /^[A-Za-z0-9_]+$/;\nfunction isSafeSchema(s: string): boolean {\n  const t = s.startsWith('`') && s.endsWith('`') ? s.slice(1, -1) : s;\n  return SAFE_SCHEMA.test(t) && !t.includes('--');\n}","tryCatchPattern":null,"preventionTips":["Whitelist schema names server-side; never interpolate raw user input into procedure strings.","Restrict schema identifiers to [A-Za-z0-9_].","Treat any '--', ';', space, or quote in a schema as an attack signal, log it."],"tags":["apijson","sql-injection","schema","security","stored-procedure"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}