{"record":{"id":"ad5ffd3bc86439ce","repo":"Tencent/APIJSON","slug":"key-get-gets-key","errorCode":null,"errorMessage":"key[]:{} 只支持 GET, GETS 方法！其它方法不允许传 {}:{} 等这种 key[]:{} 格式！","messagePattern":"key\\[\\]:(.+?) 只支持 GET, GETS 方法！其它方法不允许传 (.+?):(.+?) 等这种 key\\[\\]:(.+?) 格式！","errorType":"validation","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractParser.java","lineNumber":1329,"sourceCode":"\t * @param request parentObject的value\n\t * @param parentPath parentObject的路径\n\t * @param name parentObject的key\n\t * @param isSubquery 是否为子查询\n\t * @param cache SQL 结果缓存\n\t * @return\n\t * @throws Exception\n\t */\n\t@Override\n\tpublic L onArrayParse(M request, String parentPath, String name, boolean isSubquery, L cache) throws Exception {\n\t\tif (Log.DEBUG) {\n\t\t\tLog.i(TAG, \"\\n\\n\\n onArrayParse parentPath = \" + parentPath\n\t\t\t\t\t+ \"; name = \" + name + \"; request = \" + JSON.toJSONString(request));\n\t\t}\n\n\t\t//不能允许GETS，否则会被通过\"[]\":{\"@role\":\"ADMIN\"},\"Table\":{},\"tag\":\"Table\"绕过权限并能批量查询\n\t\tRequestMethod _method = request.get(KEY_METHOD) == null ? requestMethod : RequestMethod.valueOf(getString(request, KEY_METHOD));\n\t\tif (isSubquery == false && RequestMethod.isGetMethod(_method, true) == false) {\n\t\t\tthrow new UnsupportedOperationException(\"key[]:{} 只支持 GET, GETS 方法！其它方法不允许传 \" + name + \":{} 等这种 key[]:{} 格式！\");\n\t\t}\n\t\tif (request == null || request.isEmpty()) { // jsonKey-jsonValue 条件\n\t\t\treturn null;\n\t\t}\n\t\tString path = getAbsPath(parentPath, name);\n\n\n\t\t//不能改变，因为后面可能继续用到，导致1以上都改变 []:{0:{Comment[]:{0:{Comment:{}},1:{...},...}},1:{...},...}\n\t\tfinal String query = getString(request, apijson.JSONRequest.KEY_QUERY);\n\t\tfinal Boolean compat = getBoolean(request, apijson.JSONRequest.KEY_COMPAT);\n\t\tfinal Integer count = getInteger(request, apijson.JSONRequest.KEY_COUNT); //TODO 如果不想用默认数量可以改成 getIntValue(apijson.JSONRequest.KEY_COUNT);\n\t\tfinal Integer page = getInteger(request, apijson.JSONRequest.KEY_PAGE);\n\t\tfinal Object join = request.get(apijson.JSONRequest.KEY_JOIN);\n\n\t\tint query2;\n\t\tif (query == null) {\n\t\t\tquery2 = apijson.JSONRequest.QUERY_TABLE;\n\t\t}","sourceCodeStart":1311,"sourceCodeEnd":1347,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractParser.java#L1311-L1347","documentation":"onArrayParse rejects key[]:{} array syntax when the effective method is not GET/GETS (with strict true, so HEAD-like variants are excluded). The inner @method override is resolved first; for a non-subquery array under POST/PUT/DELETE etc. it throws UnsupportedOperationException. The comment notes this blocks a privilege bypass via [] with @role ADMIN plus a tag.","triggerScenarios":"Sending e.g. {\"[]\":{...},\"tag\":\"X\"} with requestMethod=POST, or an array whose inner \"@method\":\"PUT\" (only GET/GETS accepted). Subqueries (@from joins) are exempt because isSubquery=true.","commonSituations":"Copy-pasting a GET list query into a POST batch; trying to batch-modify by wrapping objects in an array; frontend reuses the list endpoint's body for a save call; older versions permitted it and an upgrade enforces the rule.","solutions":["For write operations use the batch format key:[] with an array VALUE (e.g. \"User\":[]), not the page-array key[]:{} syntax","Change the HTTP method to GET (or GETS with tag) when you only want to query lists","Remove inner @method overrides that set non-GET methods inside []:{}","Keep pagination/list queries strictly read-only; do reads and writes in separate requests"],"exampleFix":"// before (POST + page-array)\nPOST /post {\"[]\":{\"User\":{...}}}\n// after\nPOST /post {\"User\":[{...},{...}]}","handlingStrategy":"validation","validationCode":"if (method != GET && bodyHasPageArraySyntax(body)) throw new IllegalArgumentException(\"page-array [] not allowed for \" + method);","typeGuard":"boolean isPageArrayRequest(Object key) { return key instanceof String && ((String) key).endsWith(\"[]\"); }","tryCatchPattern":null,"preventionTips":["Keep list queries GET-only; use key:[] batch arrays for writes","Lint requests: reject key[]:{} payloads on write methods before send","Remove stray @method overrides inside [] objects"],"tags":["apijson","method-validation","security","array-syntax"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}