{"record":{"id":"83c7880fbfb0ba9c","repo":"Tencent/APIJSON","slug":"method-name-key-idinkey-83c788","errorCode":null,"errorMessage":"{method}请求，{name}/{key} 里面的 {idInKey}:[] 中所有项的类型都只能是 Long 或 String ！","messagePattern":"(.+?)请求，(.+?)/(.+?) 里面的 (.+?):\\[\\] 中所有项的类型都只能是 Long 或 String ！","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java","lineNumber":794,"sourceCode":"\t\t\t//解决 id{}: [\"1' OR 1='1'))--\"] 绕过id{}限制\n\t\t\t//new ArrayList<Long>(idIn) 不能检查类型，Java泛型擦除问题，居然能把 [\"a\"] 赋值进去还不报错\n\t\t\tfor (int i = 0; i < idIn.size(); i++) {\n\t\t\t\tObject o = idIn.get(i);\n\t\t\t\tif (o == null) {\n\t\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t\t+ \" 里面的 \" + idInKey + \":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \\\"\\\" ] 中任何一个 ！\");\n\t\t\t\t}\n\t\t\t\tif (o instanceof Number) {\n\t\t\t\t\t//解决 Windows mysql-5.6.26-winx64 等低于 5.7 的 MySQL 可能 id{}: [0] 生成 id IN(0) 触发 MySQL bug 导致忽略 IN 条件\n\t\t\t\t\t//例如 UPDATE `apijson`.`TestRecord` SET `testAccountId` = -1 WHERE ( (`id` IN (0)) AND (`userId`= 82001) )\n\t\t\t\t\tif (((Number) o).longValue() <= 0) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t\t\t+ \" 里面的 \" + idInKey + \":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \\\"\\\" ] 中任何一个 ！\");\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\telse if (o instanceof String) {\n\t\t\t\t\tif (StringUtil.isEmpty(o, true)) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t\t\t+ \" 里面的 \" + idInKey + \":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \\\"\\\" ] 中任何一个 ！\");\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\tthrow new IllegalArgumentException(method + \"请求，\" + name + \"/\" + key\n\t\t\t\t\t\t\t+ \" 里面的 \" + idInKey + \":[] 中所有项的类型都只能是 Long 或 String ！\");\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\n\t/**校验并将response转换为指定的内容和结构\n\t* @param method\n\t* @param name\n\t* @param target\n\t* @param response\n\t* @param database","sourceCodeStart":776,"sourceCodeEnd":812,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java#L776-L812","documentation":"Thrown by verifyId when an id{} element is neither Number nor String (the final else of the item loop) — e.g. a boolean, nested object, or inner array. Each item must be a scalar id so the IN(...) list can be built safely (this also blocks payloads like [\"1' OR 1='1\"-style objects] from sneaking through).","triggerScenarios":"PUT/DELETE with {\"User\":{\"id{}\":[{\"id\":1}]}} or {\"User\":{\"id{}\":[true]}} or {\"User\":{\"id{}\":[[1]]}}.","commonSituations":"Client maps API objects into the array instead of extracting id fields: ids = rows.map(r => r) instead of rows.map(r => r.id); a JSON serializer double-wraps values.","solutions":["Map the array to scalar ids: rows.map(r => r.id)","Ensure each element is a number or a non-empty string before sending","Add a pre-send type check helper shared by all write calls"],"exampleFix":"// before\n{\"User\":{\"id{}\":[{\"id\":1},{\"id\":2}]}}\n// after\n{\"User\":{\"id{}\":[1,2]}}","handlingStrategy":"type-guard","validationCode":"const idItemsValid = (ids) => ids.every(id => typeof id === 'number' || (typeof id === 'string' && id.trim() !== ''));","typeGuard":"const isScalarId = (v) => typeof v === 'number' || (typeof v === 'string' && v.trim() !== '');","tryCatchPattern":null,"preventionTips":["Map row objects to their id field before putting them in id{}","Run an every() type check on batch arrays in shared request middleware"],"tags":["apijson","validation","type-mismatch","batch"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}