Tencent/WeKnora · error

schema-qualified function calls are not allowed: %s

Error message

schema-qualified function calls are not allowed: %s

What it means

Function-call guard in validateFuncCall: with schema access checking enabled, the call is schema-qualified (more than one name part) and the qualifier is neither empty nor pg_catalog, so the call is rejected to block functions defined in arbitrary schemas.

Source

Thrown at internal/utils/inject.go:2192

// validateFuncCall validates a function call
func (v *sqlValidator) validateFuncCall(fc *pg_query.FuncCall, result *SQLValidationResult) error {
	// Get function name
	funcName := ""
	for _, namePart := range fc.Funcname {
		if s := namePart.GetString_(); s != nil {
			funcName = strings.ToLower(s.Sval)
		}
	}

	// Check for schema-qualified function calls
	if v.checkSchemaAccess && len(fc.Funcname) > 1 {
		schemaName := ""
		if s := fc.Funcname[0].GetString_(); s != nil {
			schemaName = strings.ToLower(s.Sval)
		}
		if schemaName != "" && schemaName != "pg_catalog" {
			return fmt.Errorf("schema-qualified function calls are not allowed: %s", schemaName)
		}
	}

	// Block dangerous function prefixes
	if v.checkDangerousFuncs {
		dangerousPrefixes := []string{
			"pg_",     // All pg_* functions (pg_read_file, pg_reload_conf, pg_stat_*, etc.)
			"lo_",     // Large object functions (lo_import, lo_export, lo_from_bytea, lo_put, etc.)
			"dblink",  // Database link functions
			"file_",   // File functions
			"copy_",   // Copy functions
			"binary_", // Binary functions
		}
		for _, prefix := range dangerousPrefixes {
			if strings.HasPrefix(funcName, prefix) {
				return fmt.Errorf("function '%s' is not allowed (dangerous prefix)", funcName)
			}
		}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Call only whitelisted pg_catalog or unqualified functions
2. Remove the schema qualifier and rely on the allowed function list
3. Reject generated SQL that names custom schemas

When it happens

Trigger: Thrown at internal/utils/inject.go:2192 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/be38d3d137f9a8db. Report an issue: GitHub.