Tencent/WeKnora · error

subqueries are not allowed

Error message

subqueries are not allowed

What it means

Policy error in validateNode: a SubLink (scalar/EXISTS/IN subquery in an expression) was found while subqueries are disallowed. The validator walks every expression node, so nested subqueries anywhere in the statement are rejected.

Source

Thrown at internal/utils/inject.go:1531

			return err
		}
	}
	return nil
}

// validateNode recursively validates AST nodes
// SECURITY: This function uses a COMPREHENSIVE approach to validate ALL node types.
// Any node type that contains child expressions MUST be handled to prevent bypass attacks.
// The principle is: if we don't know how to validate a node type, we REJECT it.
func (v *sqlValidator) validateNode(node *pg_query.Node, result *SQLValidationResult) error {
	if node == nil {
		return nil
	}

	// Check for subqueries (SubLink)
	if v.checkSubqueries {
		if sl := node.GetSubLink(); sl != nil {
			return fmt.Errorf("subqueries are not allowed")
		}
	}

	// Check for function calls
	if fc := node.GetFuncCall(); fc != nil {
		if err := v.validateFuncCall(fc, result); err != nil {
			return err
		}
	}

	// Check for column references
	if cr := node.GetColumnRef(); cr != nil {
		if err := v.validateColumnRef(cr); err != nil {
			return err
		}
	}

	// Check for type casts

View on GitHub (pinned to 988cbb0330)

Solutions

1. Replace the scalar subquery with a JOIN and aggregation
2. Precompute the subquery result into an allowed table or parameter
3. Rewrite IN/EXISTS clauses as joins against permitted tables

When it happens

Trigger: Thrown at internal/utils/inject.go:1531 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/480a8c736c59fa7e. Report an issue: GitHub.