{"record":{"id":"d591d262b7a120e5","repo":"Tencent/APIJSON","slug":"abstractfunctionparser-enable-script-function-f","errorCode":null,"errorMessage":"AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION == false 时不支持执行脚本！如需支持则设置为 true ！","messagePattern":"AbstractFunctionParser\\.ENABLE_SCRIPT_FUNCTION == false 时不支持执行脚本！如需支持则设置为 true ！","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"critical","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java","lineNumber":1342,"sourceCode":"\t\t\t\t\tif (v instanceof Map<?, ?> == false) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(\"Request 表 structure 配置的 \" + IF.name()\n\t\t\t\t\t\t\t\t+ \":{ \" + k + \":value } 中 value 不合法，必须是 JSONRequest {} ！\");\n\t\t\t\t\t}\n\n\t\t\t\t\tif (nkl.contains(k) || real.get(k) != null) {\n\t\t\t\t\t\treal = parse(method, name, (M) v, real, database, datasource, namespace, catalog, schema, idCallback, parser, callback);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tLog.i(TAG, \"parse  return real = \" + toJSONString(real));\n\t\treturn real;\n\t}\n\n\tpublic static ScriptEngine getScriptEngine(String lang) {\n\t\tif (ENABLE_SCRIPT_FUNCTION == false) {\n\t\t\tthrow new UnsupportedOperationException(\"AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION\" +\n\t\t\t\t\t\" == false 时不支持执行脚本！如需支持则设置为 true ！\");\n\t\t}\n\n\t\tboolean isEmpty = StringUtil.isEmpty(lang, true);\n\t\tScriptEngine engine = isEmpty ? SCRIPT_ENGINE : SCRIPT_ENGINE_MANAGER.getEngineByName(lang);\n\n\t\tif (engine == null) {\n\t\t\tthrow new NullPointerException(\"找不到可执行 \" + (isEmpty ? \"js\" : lang) + \" 脚本的引擎！engine == null!\");\n\t\t}\n\n\t\treturn engine;\n\t}\n\n\n\t/**执行操作\n\t * @param opt\n\t * @param targetChild\n\t * @param real","sourceCodeStart":1324,"sourceCodeEnd":1360,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java#L1324-L1360","documentation":"getScriptEngine(lang) is the single gate for executing script-based remote functions (key():\"script...\" / script functions in APIJSONORM). It throws UnsupportedOperationException when the static flag AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION is false — the library's default hard-off switch, because allowing client-supplied scripts to run on the server is a code-execution risk. The error message itself tells you the fix: set the flag to true.","triggerScenarios":"Any request containing a script function (e.g. \"@raw()\":\"javascript:...\" style or a function resolved via ScriptEngine) reaches AbstractVerifier.getScriptEngine while ENABLE_SCRIPT_FUNCTION retains its default false, and the throw happens before any engine lookup. Often first observed right after upgrading to a newer APIJSON that introduced the flag.","commonSituations":"Upgrading APIJSON to a version that disabled script functions by default (security hardening); a demo/test app copied from an older README that used script functions; deploying to production where the flag was intentionally left off and a legacy client still sends scripts.","solutions":["If you truly need script functions, opt in at startup: AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true; (once, during app init) — and understand it enables server-side script execution of request-supplied code.","Prefer replacing the script function with a server-registered Java remote function (implement FunctionParser, register in FunctionList) so no script engine is needed.","Remove the script-function key (e.g. \"...()\":\"...\") from the client request if the feature is not required."],"exampleFix":"// before\n// app init: nothing set; request uses \"@script()\":\"javascript:java.lang.Math.abs(-1)\"\n\n// after (opt-in during application startup)\nstatic {\n    apijson.orm.AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION = true;\n}\n// or better: register a Java function and call \"@abs()\":\"abs(-1)\"","handlingStrategy":"validation","validationCode":"if (requestUsesScriptFunction(body) && !AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION) {\n  throw new UnsupportedOperationException(\n    \"Script functions disabled; enable AbstractFunctionParser.ENABLE_SCRIPT_FUNCTION or use registered Java functions\");\n}","typeGuard":null,"tryCatchPattern":"try { result = parser.executeScript(...); }\ncatch (UnsupportedOperationException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"ENABLE_SCRIPT_FUNCTION\")) {\n    // feature not enabled — degrade to a registered Java function or reject the request; do NOT auto-enable in prod\n    return fallbackRegisteredFunction();\n  }\n  throw e;\n}","preventionTips":["Decide at deploy time whether script functions are allowed; set ENABLE_SCRIPT_FUNCTION once in app init, never per-request.","Audit client payloads for 'key():\"...\"' script functions when the flag is off; replace them with server-registered FunctionParser implementations.","Treat enabling this flag as a security review item — it permits execution of request-supplied code."],"tags":["apijson","script-execution","security-flag","configuration"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}