{"record":{"id":"4b7178771c34a27c","repo":"Tencent/APIJSON","slug":"method-rk-combine-value","errorCode":null,"errorMessage":"{method} 请求，{rk} 不合法！非开放请求不允许传 @combine:value ！","messagePattern":"(.+?) 请求，(.+?) 不合法！非开放请求不允许传 @combine:value ！","errorType":"validation","errorClass":"UnsupportedOperationException","httpStatus":400,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java","lineNumber":1122,"sourceCode":"\n\t\t// 解析不允许的字段>>>>>>>>>>>>>>>>>>>\n\n\t\tSet<String> onKeys = new LinkedHashSet<>();\n\n\t\t// 判断不允许传的key<<<<<<<<<<<<<<<<<<<<<<<<<\n\t\tfor (String rk : rkset) {\n\t\t\tif (rk == null || KEY_STRING.equals(rk) || KEY_TRIM.equals(rk)) {\n\t\t\t\t// ConcurrentModificationException  real.remove(rk);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (refuseSet.contains(rk)) { // 不允许的字段\n\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name\n\t\t\t\t\t\t+ \" 里面不允许传 \" + rk + \" 等\" + StringUtil.get(refuseSet) + \"内的任何字段！\");\n\t\t\t}\n\n\t\t\tif (KEY_COMBINE.equals(rk)) {\n\t\t\t\tthrow new UnsupportedOperationException(method + \" 请求，\" + rk + \" 不合法！\" +\n\t\t\t\t\t\t\"非开放请求不允许传 \" + KEY_COMBINE + \":value ！\");\n\t\t\t}\n\t\t\tif (KEY_KEY.equals(rk)) {\n\t\t\t\tthrow new UnsupportedOperationException(method + \" 请求，\" + rk + \" 不合法！\" +\n\t\t\t\t\t\t\"非开放请求不允许传 \" + KEY_KEY + \":value ！\");\n\t\t\t}\n\n\t\t\tObject rv = real.get(rk);\n\t\t\tif (rv != null && stringKeyList != null && stringKeyList.contains(rk)) {\n\t\t\t\trv = toJSONString(rv);\n\t\t\t}\n\t\t\tif (rv != null && trimKeyList != null && trimKeyList.contains(rk)) {\n\t\t\t\trv = StringUtil.trim(rv);\n\t\t\t}\n\n\t\t\t// 不允许传远程函数，只能后端配置\n\t\t\tif (rk.endsWith(\"()\") && rv instanceof String) {\n\t\t\t\tthrow new UnsupportedOperationException(method + \" 请求，\" + rk + \" 不合法！\" +","sourceCodeStart":1104,"sourceCodeEnd":1140,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java#L1104-L1140","documentation":"Thrown when a non-open request carries the @combine key. @combine (combined-table query config) is only allowed on requests whose Request-table row marks them as open; closed requests have their combine logic fixed server-side.","triggerScenarios":"GET/POST body contains \"@combine\":\"a,b\" (at any level scanned by verify) for a request whose Request-table tag is not open/OPEN.","commonSituations":"Copying a query body from the auto-generated APIJSON docs (which show @combine examples) into a non-open endpoint; frontend experimenting with combined queries against a locked-down tag.","solutions":["Remove @combine from the request body","Ask the backend to configure the needed combine in the Request-table row, or mark the tag open if cross-table ad-hoc queries are intended","Use the dedicated open/document endpoint for exploratory combined queries"],"exampleFix":"// before\n{\"User\":{\"name\":\"a\",\"@combine\":\"name,id\"}}\n// after\n{\"User\":{\"name\":\"a\"}}","handlingStrategy":"validation","validationCode":"function stripLockedKeys(obj) {\n  const out = { ...obj };\n  delete out['@combine'];\n  return out;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only send @combine against tags documented as open","Keep a list of server-locked keys (@combine, @key) stripped in request middleware"],"tags":["apijson","combine","open-request","security"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}