Tencent/WeKnora · critical

function ' ' is not allowed

Error message

function '%s' is not allowed

What it means

The validator's explicit blocklist rejected a function name present in the dangerousFunctions map (e.g. sniff_csv, glob, st_read, st_read_meta). These functions expose filesystem or introspection capabilities that enable RCE or data exfiltration when injected SQL is allowed. Unlike the prefix check, this matches exact names.

Solutions

1. Replace the blocklisted function with an allowed equivalent (e.g. parse the CSV in application code instead of sniff_csv)
2. Load external files through the platform's file-upload/API surface, then reference the resulting table
3. For spatial data, pre-convert geometry outside the expression and store it in a supported column type
4. If the function is safe in your deployment, extend allowedFunctions by enabling the whitelist mechanism — do not edit the blocklist

Example fix

// before
expr := "st_read('zones.geojson')"
// after
// import geometry via the files API first, then:
expr := "ST_Contains(zone_geom, point)" // references pre-imported table/column

var blocked = map[string]bool{"sniff_csv": true, "glob": true, "st_read": true, "st_read_meta": true}
if blocked[funcName] {
    return fmt.Errorf("function %q is blocklisted; load the data via the files API instead", funcName)
}

func isBlocklistedFunction(name string) bool {
    var blocked = map[string]bool{"sniff_csv": true, "glob": true, "st_read": true, "st_read_meta": true}
    return blocked[strings.ToLower(name)]
}

defer func() {
    if r := recover(); r != nil { _ = r }
}()
if err := injector.Validate(expr); err != nil {
    var rejected *RejectError
    if errors.As(err, &rejected) && isBlocklistedFunction(rejected.FuncName) {
        return nil, fmt.Errorf("blocked function %q", rejected.FuncName)
    }
    return err
}

When it happens

Trigger: Validating an expression containing a direct call to a blocklisted function such as sniff_csv('path'), glob('pattern'), st_read('file.geojson'), or st_read_meta('file') in any validated SQL node.

Common situations: Users attempting CSV auto-detection (sniff_csv) or spatial file reads (st_read) inside computed columns; auto-generated analytics SQL that leans on DuckDB reader functions; attacks probing for file access via glob patterns.

Related errors

• access to ' ' is not allowed
• access to system column
• function not allowed
• function ' ' is not allowed (dangerous prefix)
• 2201

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/dfdd1c6e4a251412. Report an issue: GitHub.

Appendix: source

Thrown at internal/utils/inject.go:2313

			// allow reading any file on the app container.
			"read_text":         true,
			"read_blob":         true,
			"read_csv":          true,
			"read_csv_auto":     true,
			"read_parquet":      true,
			"read_json":         true,
			"read_json_auto":    true,
			"read_ndjson":       true,
			"read_ndjson_auto":  true,
			"read_json_objects": true,
			"read_xlsx":         true,
			"sniff_csv":         true,
			"glob":              true,
			"st_read":           true,
			"st_read_meta":      true,
		}
		if dangerousFunctions[funcName] {
			return fmt.Errorf("function '%s' is not allowed", funcName)
		}
	}

	// Check against whitelist if enabled
	if v.checkFunctionNames && !v.allowedFunctions[funcName] {
		return fmt.Errorf("function not allowed: %s", funcName)
	}

	// Validate function arguments recursively
	for _, arg := range fc.Args {
		if err := v.validateNode(arg, result); err != nil {
			return err
		}
	}

	return nil
}

View on GitHub (pinned to 988cbb0330)