{"record":{"id":"90ddbece21aa89aa","repo":"Tencent/APIJSON","slug":"abstractfunctionparser-enable-remote-function-f","errorCode":null,"errorMessage":"AbstractFunctionParser.ENABLE_REMOTE_FUNCTION == false 时不支持远程函数！如需支持则设置 AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true ！","messagePattern":"AbstractFunctionParser\\.ENABLE_REMOTE_FUNCTION == false 时不支持远程函数！如需支持则设置 AbstractFunctionParser\\.ENABLE_REMOTE_FUNCTION = true ！","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java","lineNumber":404,"sourceCode":"\t\tif (StringUtil.isEmpty(function, true)) {\n\t\t\tthrow new IllegalArgumentException(\"字符 \" + function + \" 不合法！\");\n\t\t}\n\n\t\treturn invoke(this, function, current, containRaw);\n\t}\n\n\t/**反射调用\n\t * @param parser\n\t * @param function 例如get(Map:map,key)，参数只允许引用，不能直接传值\n     * @param current\n     * @return {@link #invoke(AbstractFunctionParser, String, Class[], Object[])}\n\t */\n\t@SuppressWarnings({\"unchecked\", \"rawtypes\"})\n\tpublic static <T, M extends Map<String, Object>, L extends List<Object>> Object invoke(\n\t\t\t@NotNull AbstractFunctionParser<T, M, L> parser, @NotNull String function\n\t\t\t, @NotNull Map<String, Object> current, boolean containRaw) throws Exception {\n        if (ENABLE_REMOTE_FUNCTION == false) {\n            throw new UnsupportedOperationException(\"AbstractFunctionParser.ENABLE_REMOTE_FUNCTION\" +\n                    \" == false 时不支持远程函数！如需支持则设置 AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true ！\");\n        }\n\n\t\tFunctionBean fb = parseFunction(function, current, false, containRaw);\n\n\t\tMap<String, Object> row = FUNCTION_MAP.get(fb.getMethod()); //FIXME  fb.getSchema() + \".\" + fb.getMethod()\n\t\tif (row == null) {\n\t\t\tthrow new UnsupportedOperationException(\"不允许调用远程函数 \" + fb.getMethod() + \" !\");\n\t\t}\n\n        String language = (String) row.get(\"language\");\n        String lang = \"java\".equalsIgnoreCase(language) ? null : language;\n\n        if (ENABLE_SCRIPT_FUNCTION == false && lang != null) {\n            throw new UnsupportedOperationException(\"language = \" + language + \" 不合法！AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION\" +\n                    \" == false 时不支持远程函数中的脚本形式！如需支持则设置 AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true ！\");\n        }\n","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractFunctionParser.java#L386-L422","documentation":"Static gate on remote functions: AbstractFunctionParser.ENABLE_REMOTE_FUNCTION defaults to false, and any attempt to execute a function through the Function-table path throws UnsupportedOperationException until the flag is explicitly enabled. This is a deliberate security default — remote functions let requests trigger server-side Java/script calls, so they are opt-in.","triggerScenarios":"A request contains a remote function call (e.g. \"@column\": \"plus(id,1)\" style, or invoke(...) is reached) while ENABLE_REMOTE_FUNCTION is still false.","commonSituations":"Freshly deployed APIJSON backend where features were used from a demo project without porting the static init block that sets the flag; upgrade reset custom initialization; security review deliberately disabled it.","solutions":["Set AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true during backend initialization (e.g. in your DemoApplication or Framework-level static init) if remote functions are intended.","If not intended, remove the function expressions from the request/client code.","Make sure the assignment happens before the first request, not lazily."],"exampleFix":"// before\n// flag left at default false; requests with functions fail\n\n// after\nstatic {\n    AbstractFunctionParser.ENABLE_REMOTE_FUNCTION = true;\n}\n// or in DemoVerifier/DemoInitializer init()","handlingStrategy":"validation","validationCode":"if (!AbstractFunctionParser.ENABLE_REMOTE_FUNCTION && requestContainsFunctions(request)) {\n    // reject before sending, or instruct ops to enable the flag in backend init\n}","typeGuard":null,"tryCatchPattern":"try { parser.invoke(fn, current); } catch (UnsupportedOperationException e) { if (e.getMessage().contains(\"ENABLE_REMOTE_FUNCTION\")) { /* surface config guidance to operator */ } throw e; }","preventionTips":["Centralize APIJSON static config (ENABLE_REMOTE_FUNCTION, ENABLE_SCRIPT_FUNCTION) in one init class run at startup.","Document in deployment checklists whether the app uses remote functions.","Only enable if the Function table contents are fully trusted."],"tags":["apijson","remote-function","feature-flag","configuration"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}