{"record":{"id":"f8150d9149834368","repo":"jeecgboot/JeecgBoot","slug":"error-f8150d","errorCode":null,"errorMessage":"原始接口路径不能为空","messagePattern":"原始接口路径不能为空","errorType":"validation","errorClass":"JeecgBootBizTipException","httpStatus":null,"severity":"warning","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java","lineNumber":250,"sourceCode":"     * @param USERNAME\n     * @param PASSWORD\n     * @return\n     */\n    private String getToken(String USERNAME, String PASSWORD) {\n        String token = JwtUtil.sign(USERNAME, PASSWORD, CommonConstant.CLIENT_TYPE_PC);\n        redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + token, token);\n        redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + token, 60);\n        return token;\n    }\n\n    /**\n     * 校验原始接口路径是否合法：\n     *  - 相对路径：必须以 / 开头，不允许 // 和 .. 防止路径穿越\n     *  - 完整URL：仅允许 http/https 协议，禁止 file/ftp/gopher/jar/netdoc 等其它协议（用于微服务模式跨模块调用）\n     */\n    private void validOriginUrl(String originUrl) {\n        if (oConvertUtils.isEmpty(originUrl)) {\n            throw new JeecgBootBizTipException(\"原始接口路径不能为空\");\n        }\n        String decoded;\n        try {\n            decoded = java.net.URLDecoder.decode(originUrl, \"UTF-8\");\n            // 二次解码，防止 %252f 这类双重编码绕过\n            decoded = java.net.URLDecoder.decode(decoded, \"UTF-8\");\n        } catch (Exception e) {\n            throw new JeecgBootBizTipException(\"原始接口路径包含非法字符\");\n        }\n        //update-begin---author:scott ---date:20260429  for：【issues/9590】微服务nginx部署openApi接口访问不到-----------\n        // 微服务部署时，OpenAPI 配置的接口可能位于其他微服务模块（如 erp 7003），允许 originUrl 直接配置完整 http(s) URL\n        String lower = decoded.toLowerCase();\n        boolean isFullHttpUrl = lower.startsWith(\"http://\") || lower.startsWith(\"https://\");\n        if (!isFullHttpUrl) {\n            if (!decoded.startsWith(\"/\")) {\n                throw new JeecgBootBizTipException(\"原始接口路径必须以 / 开头，或填写完整的 http(s) URL\");\n            }\n            if (decoded.startsWith(\"//\") || decoded.startsWith(\"/\\\\\")) {","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java#L232-L268","documentation":"OpenApiController.validOriginUrl() validates the originUrl of an OpenAPI definition before proxying. The very first check rejects an empty/null originUrl with JeecgBootBizTipException. Subsequent checks (URL decode, scheme allow-list, '..' / '//' rejection) only run if a value is present, so this error specifically means the field was blank.","triggerScenarios":"Creating or updating an OpenAPI record (open_api table) with a null/empty originUrl; a form submission or data import that omits the path.","commonSituations":"Admin form submitted without filling the path; a bulk import/migration row missing originUrl; a script creating open_api rows without the column.","solutions":["Provide a non-empty originUrl: a relative path starting with '/' (e.g. '/jeecg-boot/api/foo') or a full http(s) URL for microservice mode.","Validate the field on the admin form (required) before submit.","For imports, ensure every row has a non-blank originUrl."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (oConvertUtils.isEmpty(originUrl)) {\n    return Result.error(\"原始接口路径不能为空\");\n}\n// then proceed to validOriginUrl only when non-empty","typeGuard":null,"tryCatchPattern":"// validOriginUrl throws JeecgBootBizTipException; let the global handler map it to a 400,\n// but validate on the form first for a better UX.","preventionTips":["Mark originUrl required on the admin form.","Validate non-empty on the client before submit.","For imports, reject rows with blank originUrl."],"tags":["openapi","validation","security","configuration"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}