Tencent/WeKnora · critical

function '%s' is not allowed

Error message

function '%s' is not allowed

What it means

The validator's explicit blocklist rejected a function name present in the dangerousFunctions map (e.g. sniff_csv, glob, st_read, st_read_meta). These functions expose filesystem or introspection capabilities that enable RCE or data exfiltration when injected SQL is allowed. Unlike the prefix check, this matches exact names.

Source

Thrown at internal/utils/inject.go:2313

			// allow reading any file on the app container.
			"read_text":         true,
			"read_blob":         true,
			"read_csv":          true,
			"read_csv_auto":     true,
			"read_parquet":      true,
			"read_json":         true,
			"read_json_auto":    true,
			"read_ndjson":       true,
			"read_ndjson_auto":  true,
			"read_json_objects": true,
			"read_xlsx":         true,
			"sniff_csv":         true,
			"glob":              true,
			"st_read":           true,
			"st_read_meta":      true,
		}
		if dangerousFunctions[funcName] {
			return fmt.Errorf("function '%s' is not allowed", funcName)
		}
	}

	// Check against whitelist if enabled
	if v.checkFunctionNames && !v.allowedFunctions[funcName] {
		return fmt.Errorf("function not allowed: %s", funcName)
	}

	// Validate function arguments recursively
	for _, arg := range fc.Args {
		if err := v.validateNode(arg, result); err != nil {
			return err
		}
	}

	return nil
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Replace the blocklisted function with an allowed equivalent (e.g. parse the CSV in application code instead of sniff_csv)
2. Load external files through the platform's file-upload/API surface, then reference the resulting table
3. For spatial data, pre-convert geometry outside the expression and store it in a supported column type
4. If the function is safe in your deployment, extend allowedFunctions by enabling the whitelist mechanism — do not edit the blocklist

Example fix

// before
expr := "st_read('zones.geojson')"
// after
// import geometry via the files API first, then:
expr := "ST_Contains(zone_geom, point)" // references pre-imported table/column

var blocked = map[string]bool{"sniff_csv": true, "glob": true, "st_read": true, "st_read_meta": true}
if blocked[funcName] {
    return fmt.Errorf("function %q is blocklisted; load the data via the files API instead", funcName)
}

func isBlocklistedFunction(name string) bool {
    var blocked = map[string]bool{"sniff_csv": true, "glob": true, "st_read": true, "st_read_meta": true}
    return blocked[strings.ToLower(name)]
}

defer func() {
    if r := recover(); r != nil { _ = r }
}()
if err := injector.Validate(expr); err != nil {
    var rejected *RejectError
    if errors.As(err, &rejected) && isBlocklistedFunction(rejected.FuncName) {
        return nil, fmt.Errorf("blocked function %q", rejected.FuncName)
    }
    return err
}

When it happens

Trigger: Validating an expression containing a direct call to a blocklisted function such as sniff_csv('path'), glob('pattern'), st_read('file.geojson'), or st_read_meta('file') in any validated SQL node.

Common situations: Users attempting CSV auto-detection (sniff_csv) or spatial file reads (st_read) inside computed columns; auto-generated analytics SQL that leans on DuckDB reader functions; attacks probing for file access via glob patterns.

Related errors

• function '%s' is not allowed (dangerous prefix)
• function not allowed: %s
• access to system column '%s' is not allowed
• access to '%s' is not allowed
• join request not found

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/dfdd1c6e4a251412. Report an issue: GitHub.