Tencent/WeKnora · error

SubPlan nodes are not allowed

Error message

SubPlan nodes are not allowed

What it means

Default-deny guard in validateNode: a SubPlan node was found. SubPlan is an internal planner representation that should never appear in a user-parsed query, so its presence indicates a smuggled or malformed AST and the query is rejected.

Source

Thrown at internal/utils/inject.go:2063

				return err
			}
		}
		for _, order := range wd.OrderClause {
			if err := v.validateNode(order, result); err != nil {
				return err
			}
		}
		if err := v.validateNode(wd.StartOffset, result); err != nil {
			return err
		}
		if err := v.validateNode(wd.EndOffset, result); err != nil {
			return err
		}
	}

	// SubPlan - BLOCK: This is an internal representation, should not appear in user queries
	if node.GetSubPlan() != nil {
		return fmt.Errorf("SubPlan nodes are not allowed")
	}

	// AlternativeSubPlan - BLOCK
	if node.GetAlternativeSubPlan() != nil {
		return fmt.Errorf("AlternativeSubPlan nodes are not allowed")
	}

	// ============================================================
	// SECURITY: DEFAULT-DENY.
	// The recursive branches above validate every expression type we know how
	// to inspect. Any node type NOT in the recognized set below is REJECTED,
	// because an unhandled type can smuggle a dangerous FuncCall past the
	// blacklist (e.g. PG17's JSON_SCALAR wrapping pg_read_file). Whenever a new
	// recursive handler is added above, add its Node_* wrapper here as well.
	// ============================================================
	switch node.Node.(type) {
	case
		// Recognized expression types (validated recursively above).

View on GitHub (pinned to 988cbb0330)

Solutions

1. Rewrite the query without subquery expressions
2. Treat this as an attempted bypass and log it for security review
3. Ensure only freshly parsed user SQL reaches the validator

When it happens

Trigger: Thrown at internal/utils/inject.go:2063 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/b50c997db9525a3a. Report an issue: GitHub.