Tencent/WeKnora · error

function not allowed: %s

Error message

function not allowed: %s

What it means

Whitelist enforcement failed: the validator has checkFunctionNames enabled and the function name is not present in allowedFunctions. Only functions explicitly allowlisted can appear in validated expressions, so any unknown/unapproved function is rejected. This is the final per-function check after prefix and blocklist checks.

Source

Thrown at internal/utils/inject.go:2319

			"read_json":         true,
			"read_json_auto":    true,
			"read_ndjson":       true,
			"read_ndjson_auto":  true,
			"read_json_objects": true,
			"read_xlsx":         true,
			"sniff_csv":         true,
			"glob":              true,
			"st_read":           true,
			"st_read_meta":      true,
		}
		if dangerousFunctions[funcName] {
			return fmt.Errorf("function '%s' is not allowed", funcName)
		}
	}

	// Check against whitelist if enabled
	if v.checkFunctionNames && !v.allowedFunctions[funcName] {
		return fmt.Errorf("function not allowed: %s", funcName)
	}

	// Validate function arguments recursively
	for _, arg := range fc.Args {
		if err := v.validateNode(arg, result); err != nil {
			return err
		}
	}

	return nil
}

// validateColumnRef validates a column reference
func (v *sqlValidator) validateColumnRef(cr *pg_query.ColumnRef) error {
	if !v.checkSystemColumns {
		return nil
	}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Verify the exact function name spelling against the allowedFunctions configuration
2. Add the function to allowedFunctions if your security policy permits it
3. Rewrite the expression using an already-allowlisted function
4. If dynamic functions are expected, disable checkFunctionNames only in trusted internal contexts — never for user-supplied SQL

Example fix

// before (date_trunc not allowlisted)
expr := "date_trunc('month', created_at) > x" // error
// after: allowlist it or use approved equivalent
v.allowedFunctions["date_trunc"] = true
// or
expr := "strftime(created_at, '%Y-%m') > x"

func exprUsesOnlyAllowedFunctions(expr string, allowed map[string]bool) error {
    for _, fn := range extractFunctionNames(expr) {
        if !allowed[fn] {
            return fmt.Errorf("function %q is not allowlisted", fn)
        }
    }
    return nil
}

func isAllowlisted(name string, allowed map[string]bool) bool {
    return allowed[strings.ToLower(strings.TrimSpace(name))]
}

if err := injector.Validate(expr); err != nil {
    if strings.HasPrefix(err.Error(), "function not allowed:") {
        fn := strings.TrimPrefix(err.Error(), "function not allowed: ")
        return fmt.Errorf("%q is not on the approved function list; contact an admin", fn)
    }
    return err
}

When it happens

Trigger: checkFunctionNames is true and the expression uses any function not registered in v.allowedFunctions — including typos, newly added DB functions, or user-supplied expressions containing helper functions like date_trunc on a deployment where it was never allowlisted.

Common situations: Upgrading the database and using new built-ins before updating the allowlist; typos in function names (upper vs UPPER variants are exact-matched); third-party SQL snippets using functions not approved by the platform security team.

Related errors

• function '%s' is not allowed (dangerous prefix)
• join request not found
• failed to retrieve: %s
• opensearch: index not found
• 2201

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/81bc497380da7286. Report an issue: GitHub.