{"record":{"id":"f7a4e611a7c494cb","repo":"hs-web/hsweb-framework","slug":"undefined-column-column","errorCode":null,"errorMessage":"undefined column [\" + column + \"]","messagePattern":"undefined column \\[\" \\+ column \\+ \"\\]","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hsweb-commons/hsweb-commons-crud/src/main/java/org/hswebframework/web/crud/query/QueryAnalyzerImpl.java","lineNumber":690,"sourceCode":"//                            table = join.table;\n//                            column = split[1];\n//                        } else {\n//                            throw new IllegalArgumentException(\"undefined column [\" + column + \"]\");\n//                        }\n//                    }\n//                }\n//                RDBColumnMetadata columnMetadata = table\n//                    .getMetadata()\n//                    .getColumn(column)\n//                    .orElse(null);\n//                if (columnMetadata != null) {\n//                    col = new Column(column, column, table.alias, columnMetadata);\n//                } else {\n//                    throw new IllegalArgumentException(\"undefined column [\" + column + \"]\");\n//                }\n//            }\n            if (col == null) {\n                throw new IllegalArgumentException(\"undefined column [\" + column + \"]\");\n            }\n\n            if (!Objects.equals(impl.select.table.alias, col.getOwner())) {\n                QueryAnalyzer.Join join = impl.joins.get(col.getOwner());\n                if (null != join) {\n                    table = join.table;\n                } else {\n                    throw new IllegalArgumentException(\"undefined column [\" + column + \"]\");\n                }\n            }\n\n            FeatureSupportedMetadata metadata = col.metadata;\n            if (col.metadata == null) {\n                metadata = table.metadata;\n            }\n\n            String colName = col.metadata != null ? col.metadata.getRealName() : col.name;\n","sourceCodeStart":672,"sourceCodeEnd":708,"githubUrl":"https://github.com/hs-web/hsweb-framework/blob/b2cfc85a57c70bf5b5cf6e7edae2d37102652ec8/hsweb-commons/hsweb-commons-crud/src/main/java/org/hswebframework/web/crud/query/QueryAnalyzerImpl.java#L672-L708","documentation":"When building term (where-condition) fragments, the analyzer resolves the term's column via findColumn against the analyzed query. If no matching column is found in the FROM table, joins, or WITH items, an IllegalArgumentException `undefined column [...]` is thrown so invalid query parameters fail fast instead of generating broken SQL.","triggerScenarios":"Passing a Term whose `column` does not match any analyzed column, e.g. dynamic query terms built from request parameters with names like `unknownField` or `wrongAlias.field` that do not exist on the target table/joins.","commonSituations":"REST clients sending arbitrary query parameter names into dynamic-query endpoints; frontend renames a field while backend metadata is stale; typos in term column strings.","solutions":["Fix the term column name to match a column defined on the queried table or its joins.","Whitelist/validate query parameter names before converting them into Terms.","Add the missing column to the entity/table metadata if it should exist."],"exampleFix":"// before\nquery.where(\"usrName\", \"jack\")\n// after\nquery.where(\"username\", \"jack\")","handlingStrategy":"try-catch","validationCode":"if (analyzer.findColumn(term.getColumn()).isEmpty()) { throw new BadRequestException(\"unknown query field: \" + term.getColumn()); }","typeGuard":null,"tryCatchPattern":"try { return TERMS_BUILDER.createTermFragments(impl, term); } catch (IllegalArgumentException e) { if (e.getMessage().startsWith(\"undefined column\")) { throw new BadRequestException(e.getMessage()); } throw e; }","preventionTips":["Whitelist queryable/sortable fields on the API layer","Map client camelCase params to entity columns before building Terms","Reject unknown query parameters instead of passing them through"],"tags":["sql","undefined-column","dynamic-query","validation"],"backgroundTag":"resource-not-found","analyzedSha":"b2cfc85a57c70bf5b5cf6e7edae2d37102652ec8","analyzedAt":"2026-09-13T09:05:02.172Z","contentChangedAt":"2026-09-13T09:05:02.172Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}