GETS/HEADS/PUT/DELETE 不允许前端传 @combine，感谢 cloudAndMonkey 的贡献 Tencent#494

TommyLemon · web-flow · commit fb3fa39b375a · 2023-01-09T20:10:27.000+08:00
Tencent#494
diff --git a/APIJSONORM/src/main/java/apijson/orm/AbstractParser.java b/APIJSONORM/src/main/java/apijson/orm/AbstractParser.java
@@ -39,6 +39,7 @@
 import apijson.orm.exception.CommonException;
 import apijson.orm.exception.UnsupportedDataTypeException;
 
+import static apijson.JSONObject.KEY_COMBINE;
 import static apijson.JSONObject.KEY_EXPLAIN;
 import static apijson.RequestMethod.CRUD;
 import static apijson.RequestMethod.GET;
@@ -2192,6 +2193,10 @@ private JSONObject batchVerify(RequestMethod method, String tag, int version, St
 					RequestMethod  _method = null;
 					if (request.get(key) instanceof JSONObject) {
 						_method = RequestMethod.valueOf(request.getJSONObject(key).getString(apijson.JSONObject.KEY_METHOD).toUpperCase());
+						String combine = request.getJSONObject(key).getString(KEY_COMBINE);
+						if (combine != null && RequestMethod.isPublicMethod(_method) == false) {
+							throw new IllegalArgumentException(key + ":{} 里的 @combine:value 不合法！开放请求 GET、HEAD 才允许传 @combine:value !");
+						}
 					} else {
 						if (keyObjectAttributesMap.get(key) == null) {
 							if (method == RequestMethod.CRUD) {
