FlowiseAI/Flowise · error · Error

Disallowed method: ${method}

Error message

Disallowed method: ${method}

What it means

While tokenizing the filter chain, each matched method name is checked against `ALLOWED_METHODS` = ['filter','order','limit','range','single','maybeSingle']. Any method not on this allowlist throws 'Disallowed method:'. This is a security control preventing arbitrary PostgREST/builder methods (e.g. select, delete, insert, update, rpc) from being invoked through the filter DSL.

Source

Thrown at packages/components/nodes/vectorstores/Supabase/filterParser.ts:78

        }

        return filter
    }

    private static parseFilterChain(filter: string): Array<{ method: string; args: any[] }> {
        const chain: Array<{ method: string; args: any[] }> = []

        // Split on method calls (e.g., .filter, .order, etc.)
        const methodPattern = /\.?(\w+)\s*\((.*?)\)(?=\s*(?:\.|$))/g
        let match

        while ((match = methodPattern.exec(filter)) !== null) {
            const method = match[1]
            const argsString = match[2]

            // Validate method name
            if (!this.ALLOWED_METHODS.includes(method)) {
                throw new Error(`Disallowed method: ${method}`)
            }

            // Parse arguments safely
            const args = this.parseArguments(argsString)

            // Additional validation for filter method
            if (method === 'filter' && args.length >= 2) {
                const operator = args[1]
                if (typeof operator === 'string' && !this.ALLOWED_OPERATORS.includes(operator)) {
                    throw new Error(`Disallowed filter operator: ${operator}`)
                }
            }

            chain.push({ method, args })
        }

        if (chain.length === 0) {
            throw new Error('No valid filter methods found')

View on GitHub (pinned to abe4a8601a)

Solutions

1. Use only the six allowed methods in the filter string.
2. Move data-mutating operations (select/insert/update/delete) out of the filter DSL — they are intentionally blocked.
3. Add the desired method to ALLOWED_METHODS only after a security review.
4. Client-side validate method names against the allowlist before submission.

Example fix

// before: '.select("*").filter("a","eq",1)' -> Disallowed method: select
// after: 'filter("a","eq",1)'

const ALLOWED_METHODS = ['filter','order','limit','range','single','maybeSingle']
function validateMethods(filter: string) {
  for (const m of filter.matchAll(/\.?(\w+)\s*\(/g)) {
    if (!ALLOWED_METHODS.includes(m[1])) throw new Error(`Disallowed method '${m[1]}'. Allowed: ${ALLOWED_METHODS.join(', ')}`)
  }
}

function isAllowedMethod(m: string): boolean { return ['filter','order','limit','range','single','maybeSingle'].includes(m) }

null

When it happens

Trigger: A filter string containing `.select(...)`, `.delete(...)`, `.insert(...)`, `.update(...)`, `.rpc(...)`, or any builder method outside the six allowed names. Also triggered by typos like `.filtr(` or `.orderby(`.

Common situations: User pasting full Supabase client code into a filter field; assuming the DSL supports the full PostgREST builder; typo in a method name; LLM-generated filter using unsupported methods.

Related errors

• Disallowed filter operator: ${operator}
• Failed to parse Supabase filter: ${error.message}
• Potentially dangerous argument: ${arg}
• No valid filter methods found
• Failed to call ${method}: ${error.message}

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/b36863549cd38961. Report an issue: GitHub.