{"record":{"id":"0ad06dbd8dd99505","repo":"windmill-labs/windmill","slug":"sanitized-raw-string-needs-to-receive-a-strin","errorCode":null,"errorMessage":"Sanitized raw string `{}` needs to receive a string","messagePattern":"Sanitized raw string `(.+?)` needs to receive a string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-worker/src/sanitized_sql_params.rs","lineNumber":110,"sourceCode":"                            variants\n                                .iter()\n                                .map(|s| format!(\"{s}\"))\n                                .collect::<Vec<String>>()\n                                .join(\",\"),\n                            replace,\n                        )));\n                    }\n\n                    sanitize_identifier(&arg, replace)?;\n                    ret = ret.replace(&pattern, replace);\n                    args_to_skip.push(arg.name.to_string());\n                }\n                SANITIZED_RAW_STRING_STR => {\n                    let replace =\n                        args_map\n                            .get(&arg.name)\n                            .and_then(|rv| rv.as_str())\n                            .ok_or(anyhow!(\n                                \"Sanitized raw string `{}` needs to receive a string\",\n                                arg.name\n                            ))?;\n                    let windmill_parser::Typ::Str(_) = &arg.typ else {\n                        return Err(error::Error::ArgumentErr(format!(\n                            \"Wrong type of argument for sanitized raw string `{}`\",\n                            arg.name\n                        )));\n                    };\n                    sanitize_identifier(&arg, replace)?;\n                    ret = ret.replace(&pattern, &replace);\n                    args_to_skip.push(arg.name.to_string());\n                }\n                _ => continue,\n            }\n        }\n    }\n","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-worker/src/sanitized_sql_params.rs#L92-L128","documentation":"Windmill's unsafe SQL interpolation (`sanitize_and_interpolate_unsafe_sql_args`) lets scripts declare `%%name%%` placeholders typed as `sanitized_raw_string` (or `sanitized_enum`). At execution the worker looks up that argument in the job's args and requires it to be a JSON string. This error is thrown when the argument is missing entirely from the args map, or is present but not a string (number, bool, object, null), so there is nothing to sanitize and substitute.","triggerScenarios":"Running a BigQuery/DuckDB/MSSQL/MySQL/Oracle/PostgreSQL script whose SQL text contains a `sanitized_raw_string` argument placeholder, but the caller does not supply that argument (e.g. a flow step or schedule omits it), or supplies a non-string value (integer, boolean, null, object) for it.","commonSituations":"Schedules or flows created before the argument was added, API/CLI calls with a partial payload, form/app inputs left empty producing null, or a caller passing a numeric value where the script author declared a raw string placeholder.","solutions":["Supply the missing argument as a JSON string in the job input (or fix the caller to always pass it)","If the value may be absent, make the placeholder optional in the script's argument signature or remove the sanitized_raw_string typing","Convert non-string values (numbers, enums) to strings before submitting the job","Check the flow/schedule definition for a renamed argument — placeholder name and arg name must match exactly"],"exampleFix":"// before: job input\n{ \"table\": 42 }\n// after\n{ \"table\": \"customers\" }","handlingStrategy":"validation","validationCode":"// before submitting the job\nconst arg = jobArgs[\"table\"];\nif (typeof arg !== \"string\") {\n  throw new Error(`sanitized_raw_string arg 'table' must be a string, got ${typeof arg}`);\n}","typeGuard":"function isSanitizedRawStringArg(v) { return typeof v === \"string\" && v.length > 0; }","tryCatchPattern":null,"preventionTips":["Always pass sanitized_raw_string arguments as JSON strings, never numbers or null","Keep flow step inputs mapped 1:1 with the script's declared sanitized arguments","Rename placeholders and args together to avoid mismatches","Dry-run scripts with representative args before scheduling them"],"tags":["sql","argument-validation","sanitization"],"backgroundTag":"missing-required-argument","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}