{"record":{"id":"0a673ffade730c70","repo":"Tencent/WeKnora","slug":"unsupported-sql-expression-type-t-is-not-allowed","errorCode":null,"errorMessage":"unsupported SQL expression type %T is not allowed","messagePattern":"unsupported SQL expression type %T is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":2148,"sourceCode":"\t\t*pg_query.Node_CoerceToDomain,\n\t\t*pg_query.Node_AIndices,\n\t\t*pg_query.Node_AIndirection,\n\t\t// Recognized safe leaf nodes (no child expressions to smuggle through).\n\t\t*pg_query.Node_AConst,\n\t\t*pg_query.Node_ParamRef,\n\t\t*pg_query.Node_SetToDefault,\n\t\t*pg_query.Node_CurrentOfExpr,\n\t\t*pg_query.Node_CaseTestExpr,\n\t\t*pg_query.Node_SqlvalueFunction,\n\t\t*pg_query.Node_AStar,\n\t\t*pg_query.Node_Integer,\n\t\t*pg_query.Node_Float,\n\t\t*pg_query.Node_Boolean,\n\t\t*pg_query.Node_String_,\n\t\t*pg_query.Node_BitString:\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported SQL expression type %T is not allowed\", node.Node)\n\t}\n}\n\n// validateJsonValueExpr validates a JsonValueExpr, which appears as a concrete\n// (non-Node) field on several PG17 SQL/JSON expression nodes. Its RawExpr /\n// FormattedExpr children can hold arbitrary expressions (including FuncCalls),\n// so they must be recursed into.\nfunc (v *sqlValidator) validateJsonValueExpr(jve *pg_query.JsonValueExpr, result *SQLValidationResult) error {\n\tif jve == nil {\n\t\treturn nil\n\t}\n\tif err := v.validateNode(jve.RawExpr, result); err != nil {\n\t\treturn err\n\t}\n\treturn v.validateNode(jve.FormattedExpr, result)\n}\n\n// validateJsonBehavior validates the ON EMPTY / ON ERROR behavior of a PG17","sourceCodeStart":2130,"sourceCodeEnd":2166,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L2130-L2166","documentation":"Default-deny fallback in validateNode: the AST node type is not in the validator's allowlist of known-safe expression nodes, so it is rejected regardless of content. The principle is reject-what-you-cannot-validate; %T names the unexpected node type.","triggerScenarios":"Thrown at internal/utils/inject.go:2148 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Simplify the expression to constructs the validator supports","If the node is genuinely safe, add it to the explicit allowlist after security review","Check for newer SQL syntax producing node types the validator predates"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}