{"record":{"id":"52ead90c458fa231","repo":"pinpoint-apm/pinpoint","slug":"invalid-order-by-type-orderby-not-supported","errorCode":null,"errorMessage":"Invalid order by type : +orderBy+ not supported.","messagePattern":"Invalid order by type : \\+orderBy\\+ not supported\\.","errorType":"validation","errorClass":"InvalidParameterException","httpStatus":null,"severity":"error","filePath":"exceptiontrace/exceptiontrace-web/src/main/java/com/navercorp/pinpoint/exceptiontrace/web/util/ExceptionTraceQueryParameter.java","lineNumber":171,"sourceCode":"        public Builder setExceptionId(long exceptionId) {\n            this.exceptionId = exceptionId;\n            return self();\n        }\n\n        public Builder setTimeWindowRangeCount(long timeWindowRangeCount) {\n            this.timeWindowRangeCount = timeWindowRangeCount;\n            return self();\n        }\n\n        public Builder setHardLimit(int limit) {\n            this.hardLimit = Ints.constrainToRange(limit, 50, 200);\n            return self();\n        }\n\n        public Builder setOrderBy(String orderBy) {\n            OrderByAttributes order = OrderByAttributes.fromValue(orderBy);\n            if (order == null) {\n                throw new InvalidParameterException(\"Invalid order by type : \" + orderBy + \" not supported.\");\n            }\n            this.orderBy = order;\n            return self();\n        }\n\n        public Builder setIsDesc(boolean desc) {\n            if (desc) {\n                this.isDesc = \"desc\";\n            } else {\n                this.isDesc = \"asc\";\n            }\n            return self();\n        }\n\n        public Builder setGroupByAttributes(List<GroupByAttributes> groupByAttributes) {\n            this.groupByAttributes.addAll(groupByAttributes);\n            return self();\n        }","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/exceptiontrace/exceptiontrace-web/src/main/java/com/navercorp/pinpoint/exceptiontrace/web/util/ExceptionTraceQueryParameter.java#L153-L189","documentation":"ExceptionTraceQueryParameter.Builder.setOrderBy converts the orderBy string via OrderByAttributes.fromValue. When the value does not match any supported attribute, InvalidParameterException('Invalid order by type : ... not supported.') is thrown, enforcing that sort columns come from a fixed enum of allowed fields.","triggerScenarios":"Calling setOrderBy with a string not in OrderByAttributes — e.g. a column name from an untrusted UI request, wrong case, or a field renamed in a newer version.","commonSituations":"Web client sending an arbitrary orderBy query parameter; API change between versions renaming a sortable attribute; typos like 'timestamp' vs the supported value.","solutions":["Check OrderByAttributes.fromValue(orderBy) != null before calling setOrderBy, or catch and default to a safe order","Restrict UI to a whitelist of sortable columns matching the enum","Update client values after a version rename of sortable fields"],"exampleFix":"// before\nbuilder.setOrderBy(request.getParameter(\"orderBy\")); // arbitrary user input\n// after\nString orderBy = request.getParameter(\"orderBy\");\nif (OrderByAttributes.fromValue(orderBy) != null) {\n    builder.setOrderBy(orderBy);\n} else {\n    builder.setOrderBy(\"timestamp\"); // default\n}","handlingStrategy":"validation","validationCode":"if (orderBy == null || OrderByAttributes.fromValue(orderBy) == null) {\n    orderBy = \"timestamp\"; // safe default\n}\nbuilder.setOrderBy(orderBy);","typeGuard":"boolean isSupportedOrderBy(String orderBy) {\n    return orderBy != null && OrderByAttributes.fromValue(orderBy) != null;\n}","tryCatchPattern":"try {\n    builder.setOrderBy(orderBy);\n} catch (InvalidParameterException e) {\n    logger.warn(\"Unsupported orderBy '{}', using default\", orderBy);\n    builder.setOrderBy(\"timestamp\");\n}","preventionTips":["Whitelist sortable columns in the UI to match OrderByAttributes","Sanitize query parameters before mapping to enum values","Keep client-side sort options in sync with enum renames across versions"],"tags":["validation","enum","query-parameter","web"],"backgroundTag":"invalid-enum-value","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}