Tencent/WeKnora · error

subqueries in FROM clause are not allowed

Error message

subqueries in FROM clause are not allowed

What it means

Policy error in validateFromItem: a RangeSubselect (subquery in FROM) was found while checkSubqueries is disabled, so the query is rejected outright. Even when subqueries are allowed the validator still recurses to validate their contents.

Source

Thrown at internal/utils/inject.go:1462

	if je := node.GetJoinExpr(); je != nil {
		if err := v.validateFromItem(je.Larg, tables, result); err != nil {
			return err
		}
		if err := v.validateFromItem(je.Rarg, tables, result); err != nil {
			return err
		}
		if je.Quals != nil {
			if err := v.validateNode(je.Quals, result); err != nil {
				return err
			}
		}
		return nil
	}

	// Handle RangeSubselect (subquery in FROM)
	if rss := node.GetRangeSubselect(); rss != nil {
		if v.checkSubqueries {
			return fmt.Errorf("subqueries in FROM clause are not allowed")
		}
		// SECURITY: Even when subqueries are permitted, recurse into the
		// subquery so dangerous constructs hidden inside it are still
		// validated. Without this, a FROM subquery like
		//   (SELECT * FROM read_text('/etc/passwd'))
		// smuggles a RangeFunction past the check below.
		return v.validateSubquery(rss.Subquery, tables, result)
	}

	// Handle RangeFunction (function in FROM)
	if node.GetRangeFunction() != nil {
		return fmt.Errorf("functions in FROM clause are not allowed")
	}

	return nil
}

// validateSubquery validates a SELECT statement nested in a FROM subquery.

View on GitHub (pinned to 988cbb0330)

Solutions

1. Rewrite the FROM subquery as a JOIN against an allowed table
2. Flatten the subquery into the outer WHERE clauses
3. Enable subquery support only if the trust model allows it

When it happens

Trigger: Thrown at internal/utils/inject.go:1462 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/36624e2c25203f81. Report an issue: GitHub.