{"record":{"id":"22f268c3c13a22e1","repo":"FlowiseAI/Flowise","slug":"disallowed-filter-operator-operator","errorCode":null,"errorMessage":"Disallowed filter operator: ${operator}","messagePattern":"Disallowed filter operator: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/vectorstores/Supabase/filterParser.ts","lineNumber":88,"sourceCode":"        let match\n\n        while ((match = methodPattern.exec(filter)) !== null) {\n            const method = match[1]\n            const argsString = match[2]\n\n            // Validate method name\n            if (!this.ALLOWED_METHODS.includes(method)) {\n                throw new Error(`Disallowed method: ${method}`)\n            }\n\n            // Parse arguments safely\n            const args = this.parseArguments(argsString)\n\n            // Additional validation for filter method\n            if (method === 'filter' && args.length >= 2) {\n                const operator = args[1]\n                if (typeof operator === 'string' && !this.ALLOWED_OPERATORS.includes(operator)) {\n                    throw new Error(`Disallowed filter operator: ${operator}`)\n                }\n            }\n\n            chain.push({ method, args })\n        }\n\n        if (chain.length === 0) {\n            throw new Error('No valid filter methods found')\n        }\n\n        return chain\n    }\n\n    private static parseArguments(argsString: string): any[] {\n        if (!argsString.trim()) {\n            return []\n        }\n","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/vectorstores/Supabase/filterParser.ts#L70-L106","documentation":"For `filter` calls with at least 2 args, the operator (arg[1]) is checked against `ALLOWED_OPERATORS` (eq, neq, gt, gte, lt, lte, like, ilike, is, in, cs, cd, sl, sr, nxl, nxr, adj, ov, fts, plfts, phfts, wfts). Any other operator string throws 'Disallowed filter operator:'. This prevents injection of unsupported/unsafe PostgREST operators through the filter DSL.","triggerScenarios":"Using an operator not in the allowlist, e.g. 'not.eq', 'eq.', 'matches', 'imatch', a typo like 'eq ' (trailing space) or wrong case ('EQ'), or a PostgREST operator the allowlist omits.","commonSituations":"User copying operators from PostgREST docs that are not in this allowlist; case mismatch; trailing whitespace inside the quoted operator; filter generated by an LLM hallucinating an operator.","solutions":["Use only operators from ALLOWED_OPERATORS (lowercase, exact).","Trim and lowercase the operator before building the filter string.","If a legitimate operator is missing, add it to ALLOWED_OPERATORS after review.","Validate the operator client-side against the allowlist."],"exampleFix":"// before: filter(\"age\",\"GT\",5) -> Disallowed filter operator: GT\n// after: filter(\"age\",\"gt\",5)","handlingStrategy":"validation","validationCode":"const ALLOWED_OPERATORS = ['eq','neq','gt','gte','lt','lte','like','ilike','is','in','cs','cd','sl','sr','nxl','nxr','adj','ov','fts','plfts','phfts','wfts']\nfunction normalizeOperator(op: string): string {\n  const o = op.trim().toLowerCase()\n  if (!ALLOWED_OPERATORS.includes(o)) throw new Error(`Disallowed operator '${op}'`)\n  return o\n}","typeGuard":"function isAllowedOperator(op: unknown): boolean { return typeof op === 'string' && ['eq','neq','gt','gte','lt','lte','like','ilike','is','in','cs','cd','sl','sr','nxl','nxr','adj','ov','fts','plfts','phfts','wfts'].includes(op.trim().toLowerCase()) }","tryCatchPattern":"null","preventionTips":["Trim and lowercase operators before building the filter string.","Restrict the operator picker to the allowlist.","Reject compound operators (not.eq) — they are not supported.","Validate operators client-side against ALLOWED_OPERATORS."],"tags":["supabase","filter-parser","security","allowlist","input-validation"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}