FlowiseAI/Flowise · error · Error

Disallowed filter operator: ${operator}

Error message

Disallowed filter operator: ${operator}

What it means

For `filter` calls with at least 2 args, the operator (arg[1]) is checked against `ALLOWED_OPERATORS` (eq, neq, gt, gte, lt, lte, like, ilike, is, in, cs, cd, sl, sr, nxl, nxr, adj, ov, fts, plfts, phfts, wfts). Any other operator string throws 'Disallowed filter operator:'. This prevents injection of unsupported/unsafe PostgREST operators through the filter DSL.

Source

Thrown at packages/components/nodes/vectorstores/Supabase/filterParser.ts:88

        let match

        while ((match = methodPattern.exec(filter)) !== null) {
            const method = match[1]
            const argsString = match[2]

            // Validate method name
            if (!this.ALLOWED_METHODS.includes(method)) {
                throw new Error(`Disallowed method: ${method}`)
            }

            // Parse arguments safely
            const args = this.parseArguments(argsString)

            // Additional validation for filter method
            if (method === 'filter' && args.length >= 2) {
                const operator = args[1]
                if (typeof operator === 'string' && !this.ALLOWED_OPERATORS.includes(operator)) {
                    throw new Error(`Disallowed filter operator: ${operator}`)
                }
            }

            chain.push({ method, args })
        }

        if (chain.length === 0) {
            throw new Error('No valid filter methods found')
        }

        return chain
    }

    private static parseArguments(argsString: string): any[] {
        if (!argsString.trim()) {
            return []
        }

View on GitHub (pinned to abe4a8601a)

Solutions

1. Use only operators from ALLOWED_OPERATORS (lowercase, exact).
2. Trim and lowercase the operator before building the filter string.
3. If a legitimate operator is missing, add it to ALLOWED_OPERATORS after review.
4. Validate the operator client-side against the allowlist.

Example fix

// before: filter("age","GT",5) -> Disallowed filter operator: GT
// after: filter("age","gt",5)

const ALLOWED_OPERATORS = ['eq','neq','gt','gte','lt','lte','like','ilike','is','in','cs','cd','sl','sr','nxl','nxr','adj','ov','fts','plfts','phfts','wfts']
function normalizeOperator(op: string): string {
  const o = op.trim().toLowerCase()
  if (!ALLOWED_OPERATORS.includes(o)) throw new Error(`Disallowed operator '${op}'`)
  return o
}

function isAllowedOperator(op: unknown): boolean { return typeof op === 'string' && ['eq','neq','gt','gte','lt','lte','like','ilike','is','in','cs','cd','sl','sr','nxl','nxr','adj','ov','fts','plfts','phfts','wfts'].includes(op.trim().toLowerCase()) }

null

When it happens

Trigger: Using an operator not in the allowlist, e.g. 'not.eq', 'eq.', 'matches', 'imatch', a typo like 'eq ' (trailing space) or wrong case ('EQ'), or a PostgREST operator the allowlist omits.

Common situations: User copying operators from PostgREST docs that are not in this allowlist; case mismatch; trailing whitespace inside the quoted operator; filter generated by an LLM hallucinating an operator.

Related errors

• Disallowed method: ${method}
• Failed to parse Supabase filter: ${error.message}
• Potentially dangerous argument: ${arg}
• No valid filter methods found
• Failed to call ${method}: ${error.message}

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/22f268c3c13a22e1. Report an issue: GitHub.