{"record":{"id":"922f517c1e50163e","repo":"Tencent/APIJSON","slug":"ck-column-column0-column1-alias","errorCode":null,"errorMessage":"字符串 {ck} 不合法！预编译模式下 @column:\"column0,column1:alias;function0(arg0,arg1,...);function1(...):alias...\" 中字符串参数不合法，必须以 ' 开头, ' 结尾,字符串中不能包含 ' ","messagePattern":"字符串 (.+?) 不合法！预编译模式下 @column:\"column0,column1:alias;function0\\(arg0,arg1,\\.\\.\\.\\);function1\\(\\.\\.\\.\\):alias\\.\\.\\.\" 中字符串参数不合法，必须以 ' 开头, ' 结尾,字符串中不能包含 ' ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java","lineNumber":2703,"sourceCode":"\t\t\t\tString origin;\n\t\t\t\tString alias;\n\n\t\t\t\t// 如果参数包含 \"'\" ,解析字符串\n\t\t\t\tif (ck.startsWith(\"`\") && ck.endsWith(\"`\")) {\n\t\t\t\t\torigin = ck.substring(1, ck.length() - 1);\n\t\t\t\t\t//sql 注入判断 判断\n\t\t\t\t\tif (origin.startsWith(\"_\") || StringUtil.isName(origin) == false) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(\"字符 \" + ck + \" 不合法！\"\n\t\t\t\t\t\t\t\t+ \"预编译模式下 @column:\\\"`column0`,`column1`:alias;function0(arg0,arg1,...);function1(...):alias...\\\"\"\n\t\t\t\t\t\t\t\t+ \" 中所有字符串 column 都必须必须为1个单词 ！\");\n\t\t\t\t\t}\n\n\t\t\t\t\torigin = gainKey(origin);\n\t\t\t\t}\n\t\t\t\telse if (ck.startsWith(\"'\") && ck.endsWith(\"'\")) {\n\t\t\t\t\torigin = ck.substring(1, ck.length() - 1);\n\t\t\t\t\tif (origin.contains(\"'\")) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(\"字符串 \" + ck + \" 不合法！\"\n\t\t\t\t\t\t\t\t+ \"预编译模式下 @column:\\\"column0,column1:alias;function0(arg0,arg1,...);function1(...):alias...\\\"\"\n\t\t\t\t\t\t\t\t+ \" 中字符串参数不合法，必须以 ' 开头, ' 结尾,字符串中不能包含 ' \");\n\t\t\t\t\t}\n\n\t\t\t\t\t// 1.字符串不是字段也没有别名,所以不解析别名 2. 是字符串，进行预编译，使用getValue() ,对字符串进行截取\n\t\t\t\t\torigin = gainValue(origin).toString();\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\t// 参数不包含\",\",即不是字符串\n\t\t\t\t\t// 解析参数:1. 字段 ,2. 是以空格分隔的参数 eg: cast(now() as date)\n\t\t\t\t\tif (\"=null\".equals(ck)) {\n\t\t\t\t\t\torigin = SQL.isNull();\n\t\t\t\t\t}\n\t\t\t\t\telse if (\"!=null\".equals(ck)) {\n\t\t\t\t\t\torigin = SQL.isNull(false);\n\t\t\t\t\t}\n\t\t\t\t\telse {\n\t\t\t\t\t\torigin = ck;","sourceCodeStart":2685,"sourceCodeEnd":2721,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java#L2685-L2721","documentation":"A single-quoted argument inside a function expression is unquoted; if the inner content itself contains a single quote, this IllegalArgumentException fires. Quotes cannot be escaped in this DSL position, so any embedded apostrophe terminates the literal and is rejected as an injection risk.","triggerScenarios":"\"@column\":\"replace(name,','',' ')\" where the first literal contains an embedded quote; searching for an apostrophe in text; fuzzed payloads like \"concat('a'b')\".","commonSituations":"Text-processing functions operating on strings that contain apostrophes (names like O'Brien); client-side escaping using doubled quotes (SQL style) which this parser does not accept here.","solutions":["Remove the inner quote from the literal, or pass the value as a parameter elsewhere (e.g. @having with precompiled values).","For literal apostrophes, define the expression in @raw server-side where full SQL escaping is available.","Choose literals that do not require embedded quotes."],"exampleFix":"// before\n{\"User\":{\"@column\":\"replace(name,','',' ')\"}}\n// after — server RAW_MAP.put(\"cleanName\", \"replace(name, ',', ' ')\")\n{\"User\":{\"@column\":\"cleanName\",\"@raw\":\"@column\"}}","handlingStrategy":"validation","validationCode":"for(const arg of args){ if(arg.startsWith(\"'\")&&arg.endsWith(\"'\")){ if(arg.slice(1,-1).includes(\"'\"))throw new Error('literal cannot contain a quote'); } }","typeGuard":"function isQuotedArg(a) { return !(a.startsWith(\"'\") && a.endsWith(\"'\") && a.slice(1, -1).includes(\"'\")); }","tryCatchPattern":"catch IllegalArgumentException; move the literal server-side via @raw and retry","preventionTips":["No embedded apostrophes in @column string literals","SQL-style doubled-quote escaping is not supported here","Route dynamic strings through parameterized keys, not @column"],"tags":["apijson","sql","security","input-validation","string-literal"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}