What causes "SQL query too short (min %d characters)" in Tencent/WeKnora?

Ensure a real, complete SQL query is passed before validation

SQL query too short (min %d characters)

Error message

SQL query too short (min %d characters)

What it means

sqlValidator.validateInput enforces a minimum length (v.minLength) on the SQL string and returns this formatted error when len(sql) is below it. The library throws this because extremely short strings cannot be legitimate SELECT queries and are likely garbage or probing input.

Source

Thrown at internal/utils/inject.go:1333

// getMapKeys returns the keys of a map as a slice
func getMapKeys(m map[string]bool) []string {
	keys := make([]string, 0, len(m))
	for k := range m {
		keys = append(keys, k)
	}
	return keys
}

// validateInput performs basic input validation
func (v *sqlValidator) validateInput(sql string) error {
	// Check for null bytes
	if strings.Contains(sql, "\x00") {
		return fmt.Errorf("invalid character in SQL query")
	}

	// Check length limits
	if len(sql) < v.minLength {
		return fmt.Errorf("SQL query too short (min %d characters)", v.minLength)
	}
	if len(sql) > v.maxLength {
		return fmt.Errorf("SQL query too long (max %d characters)", v.maxLength)
	}

	return nil
}

// validateSelectStmt validates a SELECT statement with configured options
func (v *sqlValidator) validateSelectStmt(stmt *pg_query.SelectStmt, result *SQLValidationResult) error {
	tablesInQuery := make(map[string]string) // table name -> alias

	// Check for UNION/INTERSECT/EXCEPT (compound queries)
	if stmt.Op != pg_query.SetOperation_SETOP_NONE {
		return fmt.Errorf("compound queries (UNION/INTERSECT/EXCEPT) are not allowed")
	}

	// Check for WITH clause (CTEs)

View on GitHub (pinned to 988cbb0330)

Solutions

Ensure a real, complete SQL query is passed before validation
If short-but-valid queries are legitimate, lower minLength via the validator's length configuration option
Check upstream query construction for truncation or empty-value bugs

Example fix

// before
if sql == "" { sql = "SELECT 1" } // rejected: too short
// after
if len(strings.TrimSpace(sql)) < 20 {
    return fmt.Errorf("query must be a complete SELECT statement")
}
secured, _, err := utils.ValidateAndSecureSQL(sql)

Defensive patterns

Strategy: validation

Validate before calling

if len(strings.TrimSpace(sql)) < 20 {
    return fmt.Errorf("query is empty or truncated")
}

Try / catch

_, _, err := utils.ValidateAndSecureSQL(sql)
if err != nil && strings.Contains(err.Error(), "too short") {
    return fmt.Errorf("no query provided or query truncated: %w", err)
}

Prevention

Guard for empty/short input at the API boundary before invoking the validator
Avoid placeholder queries like "SELECT 1" if minLength is strict; configure minLength appropriately
Check upstream query builders for truncation bugs
Trim whitespace first so whitespace-only strings fail your own check, not the library's

When it happens

Trigger: Calling ValidateSQL/ValidateAndSecureSQL with an empty, whitespace, or very short SQL string (fewer than the configured minLength characters).

Common situations: Uninitialized/empty query variables; short-but-valid queries like "SELECT 1" rejected by a strict minLength; tests passing stub strings; upstream code producing truncated queries.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/8ead5fee05513bbf. Report an issue: GitHub.