Tencent/WeKnora · error

unsupported SQL expression type %T is not allowed

Error message

unsupported SQL expression type %T is not allowed

What it means

Default-deny fallback in validateNode: the AST node type is not in the validator's allowlist of known-safe expression nodes, so it is rejected regardless of content. The principle is reject-what-you-cannot-validate; %T names the unexpected node type.

Source

Thrown at internal/utils/inject.go:2148

		*pg_query.Node_CoerceToDomain,
		*pg_query.Node_AIndices,
		*pg_query.Node_AIndirection,
		// Recognized safe leaf nodes (no child expressions to smuggle through).
		*pg_query.Node_AConst,
		*pg_query.Node_ParamRef,
		*pg_query.Node_SetToDefault,
		*pg_query.Node_CurrentOfExpr,
		*pg_query.Node_CaseTestExpr,
		*pg_query.Node_SqlvalueFunction,
		*pg_query.Node_AStar,
		*pg_query.Node_Integer,
		*pg_query.Node_Float,
		*pg_query.Node_Boolean,
		*pg_query.Node_String_,
		*pg_query.Node_BitString:
		return nil
	default:
		return fmt.Errorf("unsupported SQL expression type %T is not allowed", node.Node)
	}
}

// validateJsonValueExpr validates a JsonValueExpr, which appears as a concrete
// (non-Node) field on several PG17 SQL/JSON expression nodes. Its RawExpr /
// FormattedExpr children can hold arbitrary expressions (including FuncCalls),
// so they must be recursed into.
func (v *sqlValidator) validateJsonValueExpr(jve *pg_query.JsonValueExpr, result *SQLValidationResult) error {
	if jve == nil {
		return nil
	}
	if err := v.validateNode(jve.RawExpr, result); err != nil {
		return err
	}
	return v.validateNode(jve.FormattedExpr, result)
}

// validateJsonBehavior validates the ON EMPTY / ON ERROR behavior of a PG17

View on GitHub (pinned to 988cbb0330)

Solutions

1. Simplify the expression to constructs the validator supports
2. If the node is genuinely safe, add it to the explicit allowlist after security review
3. Check for newer SQL syntax producing node types the validator predates

When it happens

Trigger: Thrown at internal/utils/inject.go:2148 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/0a673ffade730c70. Report an issue: GitHub.