{"record":{"id":"09c78b31c9bf4453","repo":"FlowiseAI/Flowise","slug":"unsupported-modifier-modname","errorCode":null,"errorMessage":"Unsupported modifier: ${modName}","messagePattern":"Unsupported modifier: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/secureZodParser.ts","lineNumber":403,"sourceCode":"        if (!remainingPart.startsWith('.')) {\n            return { arrayPart: typeStr, modifiers: [], hasModifiers: false }\n        }\n\n        // Parse modifiers\n        const modifiers: any[] = []\n        const modifierParts = remainingPart.substring(1).split('.')\n\n        for (const part of modifierParts) {\n            const modMatch = part.match(/^(\\w+)(\\(.*\\))?$/)\n            if (!modMatch) {\n                throw new Error(`Invalid modifier: ${part}`)\n            }\n\n            const modName = modMatch[1]\n            const modArgs = modMatch[2] ? this.parseArguments(modMatch[2]) : []\n\n            if (!this.ALLOWED_TYPES.includes(modName)) {\n                throw new Error(`Unsupported modifier: ${modName}`)\n            }\n\n            modifiers.push({ name: modName, args: modArgs })\n        }\n\n        return { arrayPart, modifiers, hasModifiers: true }\n    }\n\n    private static extractObjectWithModifiers(typeStr: string): { objectPart: string; modifiers: any[]; hasModifiers: boolean } {\n        // Find the matching closing brace and parenthesis for z.object({...})\n        let braceDepth = 0\n        let parenDepth = 0\n        let objectEndIndex = -1\n        let startIndex = typeStr.indexOf('z.object(') + 8 // Position after \"z.object\"\n        let foundOpenBrace = false\n\n        for (let i = startIndex; i < typeStr.length; i++) {\n            if (typeStr[i] === '{') {","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/secureZodParser.ts#L385-L421","documentation":"Thrown by SecureZodSchemaParser.extractTypeWithModifiers when a schema type string chains a modifier whose name is not in the parser's ALLOWED_TYPES whitelist (string, number, int, boolean, date, object, array, enum, optional, max, min, describe, default). The parser is deliberately restrictive and uses no eval/Function, so only those Zod method names are permitted after a dot. It exists to prevent arbitrary code execution from user-supplied schema strings.","triggerScenarios":"Any schema string whose dotted part is a non-whitelisted Zod method, e.g. `z.string().email()`, `z.string().url()`, `z.string().uuid()`, `z.string().regex(...)`, `z.number().positive()`. The part is split on '.', regex-captured via `^(\\w+)(\\(.*\\))?$`, and the captured name is checked against ALLOWED_TYPES at secureZodParser.ts:402.","commonSituations":"Pasting a Zod schema from application code into a Flowise component's structured-output schema field; relying on Zod string formats (email/uuid/regex) or numeric refinements (positive/negative) that the secure parser intentionally omits.","solutions":["Replace the unsupported modifier with a whitelisted one or drop it, e.g. `z.string().max(255)` instead of `z.string().email()`.","Move format-level validation (email/uuid/regex) out of the schema string and into downstream validation after parsing.","Cross-check the schema tokens against ALLOWED_TYPES in packages/components/src/secureZodParser.ts:7 before submitting the schema."],"exampleFix":"// before\nconst schema = \"z.object({ email: z.string().email() })\"\n// after\nconst schema = \"z.object({ email: z.string().max(255) })\"","handlingStrategy":"validation","validationCode":"const ALLOWED = ['string','number','int','boolean','date','object','array','enum','optional','max','min','describe','default']\nfunction validateSchemaModifiers(schemaStr: string): string[] {\n  const issues: string[] = []\n  for (const m of schemaStr.matchAll(/\\.([a-zA-Z_]\\w*)\\s*\\(/g)) {\n    if (!ALLOWED.includes(m[1])) issues.push(`unsupported modifier: ${m[1]}`)\n  }\n  return issues\n}\n// before calling SecureZodSchemaParser.parseZodSchema(schema):\nconst issues = validateSchemaModifiers(schema)\nif (issues.length) throw new Error(issues.join('; '))","typeGuard":"function isWhitelistedModifier(name: string): boolean {\n  return ['string','number','int','boolean','date','object','array','enum','optional','max','min','describe','default'].includes(name)\n}","tryCatchPattern":"try {\n  const schema = SecureZodSchemaParser.parseZodSchema(schemaStr)\n} catch (e) {\n  if (/Unsupported modifier/.test(e.message)) {\n    // surface a user-friendly message listing allowed modifiers\n  }\n  throw e\n}","preventionTips":["Only chain methods present in ALLOWED_TYPES when authoring schema strings.","Validate the schema string against the whitelist before persistence, not just at parse time.","Keep a documented subset of supported Zod methods for end users."],"tags":["zod","schema","validation","security"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}