{"record":{"id":"8296ec6ba9c11822","repo":"Tencent/APIJSON","slug":"method-name-key-idinkey","errorCode":null,"errorMessage":"{method}请求，{name}/{key} 里面的 {idInKey}:[] 中[]的长度不能超过 {maxUpdateCount} ！","messagePattern":"(.+?)请求，(.+?)/(.+?) 里面的 (.+?):\\[\\] 中\\[\\]的长度不能超过 (.+?) ！","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java","lineNumber":773,"sourceCode":"\t\t//批量修改或删除\n\t\tString idInKey = idKey + \"{}\";\n\t\t// id引用, 格式: \"id{}@\": \"sql\"\n\t\tString idRefInKey = getString(robj, idKey + \"{}@\");\n\t\tL idIn = null;\n\t\ttry {\n\t\t\tidIn = get(robj, idInKey); //如果必须传 id{} ，可在Request表中配置NECESSARY\n\t\t} catch (Exception e) {\n\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t+ \" 里面的 \" + idInKey + \":value 中value的类型只能是 [Long] ！\");\n\t\t}\n\t\tif (idIn == null) {\n\t\t\tif (atLeastOne && id == null && idRefInKey == null) {\n\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t+ \" 里面 \" + idKey + \",\" + idInKey  + \",\" + (idKey + \"{}@\") + \" 至少传其中一个！\");\n\t\t\t}\n\t\t} else {\n\t\t\tif (idIn.size() > maxUpdateCount) { //不允许一次操作 maxUpdateCount 条以上记录\n\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t+ \" 里面的 \" + idInKey + \":[] 中[]的长度不能超过 \" + maxUpdateCount + \" ！\");\n\t\t\t}\n\t\t\t//解决 id{}: [\"1' OR 1='1'))--\"] 绕过id{}限制\n\t\t\t//new ArrayList<Long>(idIn) 不能检查类型，Java泛型擦除问题，居然能把 [\"a\"] 赋值进去还不报错\n\t\t\tfor (int i = 0; i < idIn.size(); i++) {\n\t\t\t\tObject o = idIn.get(i);\n\t\t\t\tif (o == null) {\n\t\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t\t+ \" 里面的 \" + idInKey + \":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \\\"\\\" ] 中任何一个 ！\");\n\t\t\t\t}\n\t\t\t\tif (o instanceof Number) {\n\t\t\t\t\t//解决 Windows mysql-5.6.26-winx64 等低于 5.7 的 MySQL 可能 id{}: [0] 生成 id IN(0) 触发 MySQL bug 导致忽略 IN 条件\n\t\t\t\t\t//例如 UPDATE `apijson`.`TestRecord` SET `testAccountId` = -1 WHERE ( (`id` IN (0)) AND (`userId`= 82001) )\n\t\t\t\t\tif (((Number) o).longValue() <= 0) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t\t\t+ \" 里面的 \" + idInKey + \":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \\\"\\\" ] 中任何一个 ！\");\n\t\t\t\t\t}\n\t\t\t\t}","sourceCodeStart":755,"sourceCodeEnd":791,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java#L755-L791","documentation":"Thrown by verifyId when the id{} array length exceeds maxUpdateCount, the per-request cap on how many rows one UPDATE/DELETE may touch. This is a safety valve against accidental mass modification.","triggerScenarios":"PUT/DELETE with {\"User\":{\"id{}\":[ ...more than maxUpdateCount ids... ]}} — default cap is small (e.g. 10 in the framework's verifyId call sites; MAX_UPDATE_COUNT configurable per deployment).","commonSituations":"Bulk-sync jobs pushing thousands of ids in one request; admin 'select all and delete' UI; raising data volume after launch without raising the cap.","solutions":["Chunk the client request into batches of at most maxUpdateCount ids per call","If the operation is legitimate and authorized, raise the maxUpdateCount passed to verifyId / configured for the request","Prefer a server-side batch API or stored procedure for very large sets instead of huge id{} arrays"],"exampleFix":"// before\n{\"User\":{\"id{}\":[1,2,3,...,5000],\"status\":1}}\n// after (chunk client-side, e.g. 100 per request)\n{\"User\":{\"id{}\":[1,2,3,...,100],\"status\":1}}","handlingStrategy":"validation","validationCode":"const MAX_UPDATE_COUNT = 100; // match server config\nfunction chunkIds(ids, size = MAX_UPDATE_COUNT) {\n  const out = [];\n  for (let i = 0; i < ids.length; i += size) out.push(ids.slice(i, i + size));\n  return out;\n}","typeGuard":null,"tryCatchPattern":"catch (e) { if (/长度不能超过/.test(e.message)) { const n = Number(e.message.match(/超过 (\\d+)/)?.[1]); retryInChunks(n); } else throw e; }","preventionTips":["Know the server's maxUpdateCount before building batch UIs","Chunk by default in bulk import/export code paths","Show remaining count in bulk-operation UI so users sense the cap"],"tags":["apijson","batch-limit","update-delete","throughput"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}