{"record":{"id":"5f9917bdf13095ca","repo":"Tencent/APIJSON","slug":"method-method","errorCode":null,"errorMessage":"不支持在 ${method} 中 ${_method} ！","messagePattern":"不支持在 (.+?) 中 (.+?) ！","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractParser.java","lineNumber":2505,"sourceCode":"\t\t\t\t\t\t\tif (method == RequestMethod.CRUD) {\n\t\t\t\t\t\t\t\t_method = GET;\n\t\t\t\t\t\t\t\tMap<String, Object> objAttrMap = new HashMap<>();\n\t\t\t\t\t\t\t\tobjAttrMap.put(KEY_METHOD, GET);\n\t\t\t\t\t\t\t\tkeyObjectAttributesMap.put(key, objAttrMap);\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t_method = method;\n\t\t\t\t\t\t\t\tMap<String, Object> objAttrMap = new HashMap<>();\n\t\t\t\t\t\t\t\tobjAttrMap.put(KEY_METHOD, method);\n\t\t\t\t\t\t\t\tkeyObjectAttributesMap.put(key, objAttrMap);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t_method = (RequestMethod) attrMap.get(KEY_METHOD);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\t// 非 CRUD 方法，都只能和 URL method 完全一致，避免意料之外的安全风险。\n\t\t\t\t\tif (method != RequestMethod.CRUD && _method != method) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(\"不支持在 \" + method + \" 中 \" + _method + \" ！\");\n\t\t\t\t\t}\n\n\t\t\t\t\t// get请求不校验\n\t\t\t\t\tif (RequestMethod.isPublicMethod(_method)) {\n\t\t\t\t\t\tcorrectRequest.put(key, obj);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\n\t\t\t\t\tif (tag != null && ! tag.contains(\":\")) {\n\t\t\t\t\t\tM object = getRequestStructure(_method, tag, version);\n\t\t\t\t\t\tM ret = objectVerify(_method, tag, version, name, request, maxUpdateCount, creator, object);\n\t\t\t\t\t\tcorrectRequest.putAll(ret);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tString _tag = buildTag(request, key, method, tag);\n\t\t\t\t\tM object = getRequestStructure(_method, _tag, version);\n\t\t\t\t\tif (method == RequestMethod.CRUD && StringUtil.isEmpty(tag, true)) {","sourceCodeStart":2487,"sourceCodeEnd":2523,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractParser.java#L2487-L2523","documentation":"For non-CRUD endpoints, every table object's resolved method must exactly equal the URL method; the parser throws '不支持在 X 中 Y ！' when an object declares a different method. This is a deliberate security guard so a /get request cannot smuggle a write via per-object @method.","triggerScenarios":"POST /get with \"User\": {\"@method\": \"PUT\"}; /put endpoint containing an object declared as POST; any non-CRUD URL where attrMap/method directive sets a mismatched per-object method.","commonSituations":"Reusing one generic request body across endpoints; migrating an endpoint from /crud to /get but keeping per-object @method values; method directive @put inside a /get request.","solutions":["Match the object method to the URL: use /crud if one request must mix methods","Or delete the per-object @method / method directive so it inherits the URL method","Audit shared request templates for leftover @method keys"],"exampleFix":"// before\nPOST /get  {\"User\": {\"@method\": \"PUT\", \"id\": 1}}\n// after\nPOST /crud {\"User\": {\"@method\": \"PUT\", \"id\": 1}}  // or drop @method on /get","handlingStrategy":"validation","validationCode":"if (urlMethod !== 'CRUD') {\n  for (const [tbl, obj] of Object.entries(req)) {\n    const m = obj?.['@method'];\n    if (m && m.toUpperCase() !== urlMethod.toUpperCase()) {\n      throw new Error(`${tbl}: @method ${m} conflicts with URL ${urlMethod}; use /crud`);\n    }\n  }\n}","typeGuard":"const methodMatchesUrl = (m, url) => url === 'CRUD' || !m || m.toUpperCase() === url.toUpperCase();","tryCatchPattern":"try { await client.invoke(url, req); } catch (e) { if (e.message.includes('不支持在')) rerouteToCrud(url, req); else throw e; }","preventionTips":["Route mixed-method requests to /crud by design","Never carry @method across endpoint changes; regenerate templates per endpoint"],"tags":["apijson","method-mismatch","security"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}