{"record":{"id":"7ad5142130a3cc02","repo":"Tencent/APIJSON","slug":"key-value-value-sch","errorCode":null,"errorMessage":"{}: { @key(): value } 对应存储过程 value 中字符 {} 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！","messagePattern":"(.+?): (.+?) 对应存储过程 value 中字符 (.+?) 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java","lineNumber":702,"sourceCode":"\t\treturn fb;\n\t}\n\n\tpublic static void verifySchema(String sch, String table) {\n\t\textractSchema(sch, table);\n\t}\n\n\tpublic static String extractSchema(String sch, String table) {\n\t\tif (StringUtil.isEmpty(sch)) {\n\t\t\treturn sch;\n\t\t}\n\n\t\tif (table == null) {\n\t\t\ttable = \"Table\";\n\t\t}\n\n\t\tint ind = sch.indexOf(\"`\");\n\t\tif (ind > 0) {\n\t\t\tthrow new IllegalArgumentException(table + \": { @key(): value } 对应存储过程 value 中字符 \"\n\t\t\t\t\t+ sch + \" 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！\");\n\t\t}\n\n\t\tif (ind == 0) {\n\t\t\tsch = sch.substring(1);\n\t\t\tif (sch.indexOf(\"`\") != sch.length() - 1) {\n\t\t\t\tthrow new IllegalArgumentException(table + \": { @key(): value } 对应存储过程 value 中字符 `\"\n\t\t\t\t\t\t+ sch + \" 不合法！`schema` 当有 ` 包裹时一定是首尾各一个，不能多也不能少！\");\n\t\t\t}\n\n\t\t\tsch = sch.substring(0, sch.length() - 1);\n\t\t}\n\n\t\tif (PATTERN_SCHEMA.matcher(sch).matches() == false || sch.contains(\"--\")) {\n\t\t\tthrow new IllegalArgumentException(table + \": { @key(): value } 对应存储过程 value 中字符 \"\n\t\t\t\t\t+ sch + \" 不合法！schema.function(arg) 中 schema 必须符合 数据库名/模式名 的命名规则！\"\n\t\t\t\t\t+ \"一般只能传英文字母、数字、下划线！不允许 -- 等可能导致 SQL 注入的符号！\");\n\t\t}","sourceCodeStart":684,"sourceCodeEnd":720,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java#L684-L720","documentation":"extractSchema() validates the schema part of a stored-procedure reference 'schema.function(arg)'. A backtick is allowed only as a wrapping pair at the very start and end. This branch fires when the first backtick appears at index > 0 (e.g. 'my`schema' or 'ab`'), meaning the schema contains a stray backtick that is not a leading wrapper, which the parser rejects to prevent malformed and injectable identifiers.","triggerScenarios":"A stored procedure / SQL function string like '@procedure()': 'my`db.func(...)' or 'sch`ema.method(key)' — any schema segment whose first '`' is not the first character.","commonSituations":"Copy-pasting MySQL identifiers that contain escaped backticks; typos when hand-writing quoted schema names; migrating table DDL with back-quoted names into request JSON without stripping quotes.","solutions":["Use an unquoted schema name: 'schema.function(arg)' with only letters/digits/underscores.","If quoting, wrap exactly: '`schema`.function(arg)' — one backtick at the very start and one at the very end of the schema, nothing else.","Remove any embedded backticks from the schema identifier; if the DB schema truly contains such characters, rename it or map it server-side."],"exampleFix":"// before\n\"@procedure()\": \"my`db.my_proc(id)\"\n// after\n\"@procedure()\": \"`mydb`.my_proc(id)\"  // or simply mydb.my_proc(id)","handlingStrategy":"validation","validationCode":"// schema must be bare identifier or a single leading+trailing backtick pair\nprivate static final Pattern BARE = Pattern.compile(\"^[A-Za-z0-9_]+$\");\nString check(String sch) {\n  String s = sch.startsWith(\"`\") ? sch.substring(1, sch.length() - 1) : sch;\n  if (!BARE.matcher(s).matches() || s.contains(\"`\") || sch.indexOf('`') > 0 && !sch.startsWith(\"`\")) throw new IllegalArgumentException(\"bad schema\");\n  return sch;\n}","typeGuard":"function isValidSchema(s: string): boolean {\n  const t = s.startsWith('`') ? s.slice(1, -1) : s;\n  return /^[A-Za-z0-9_]+$/.test(t) && !t.includes('`') && (s.indexOf('`') === -1 || s.startsWith('`'));\n}","tryCatchPattern":null,"preventionTips":["Prefer unquoted schema names made only of letters, digits, underscores.","If quoting, template as '`' + name + '`' so the pair is always symmetric.","Validate the schema segment client-side with a strict identifier regex."],"tags":["apijson","stored-procedure","schema","sql-injection-guard","validation"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}