Tencent/WeKnora · error

AlternativeSubPlan nodes are not allowed

Error message

AlternativeSubPlan nodes are not allowed

What it means

Default-deny guard in validateNode: an AlternativeSubPlan node was found. Like SubPlan, it is an internal planner-only representation and its presence in a user query is treated as tampering, so validation fails closed.

Source

Thrown at internal/utils/inject.go:2068

				return err
			}
		}
		if err := v.validateNode(wd.StartOffset, result); err != nil {
			return err
		}
		if err := v.validateNode(wd.EndOffset, result); err != nil {
			return err
		}
	}

	// SubPlan - BLOCK: This is an internal representation, should not appear in user queries
	if node.GetSubPlan() != nil {
		return fmt.Errorf("SubPlan nodes are not allowed")
	}

	// AlternativeSubPlan - BLOCK
	if node.GetAlternativeSubPlan() != nil {
		return fmt.Errorf("AlternativeSubPlan nodes are not allowed")
	}

	// ============================================================
	// SECURITY: DEFAULT-DENY.
	// The recursive branches above validate every expression type we know how
	// to inspect. Any node type NOT in the recognized set below is REJECTED,
	// because an unhandled type can smuggle a dangerous FuncCall past the
	// blacklist (e.g. PG17's JSON_SCALAR wrapping pg_read_file). Whenever a new
	// recursive handler is added above, add its Node_* wrapper here as well.
	// ============================================================
	switch node.Node.(type) {
	case
		// Recognized expression types (validated recursively above).
		*pg_query.Node_FuncCall,
		*pg_query.Node_FuncExpr,
		*pg_query.Node_ColumnRef,
		*pg_query.Node_TypeCast,
		*pg_query.Node_AExpr,

View on GitHub (pinned to 988cbb0330)

Solutions

1. Rewrite without subquery constructs
2. Log the request as a potential validation bypass attempt
3. Validate only freshly parsed ASTs, never planner output

When it happens

Trigger: Thrown at internal/utils/inject.go:2068 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/8c457c2f3d40f7df. Report an issue: GitHub.