{"record":{"id":"2ad79f3a456fd14f","repo":"temporalio/temporal","slug":"invalid-filter-s-2ad79f","errorCode":null,"errorMessage":"invalid filter: %s","messagePattern":"invalid filter: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"service/matching/workers/worker_query_engine.go","lineNumber":199,"sourceCode":"\t\treturn nil, serviceerror.NewInvalidArgumentf(\"%s: 'limit' clause\", notSupportedErrMessage)\n\t}\n\n\tif selectStmt.Where == nil {\n\t\treturn nil, serviceerror.NewInvalidArgumentf(\"%s: 'where' clause is missing\", notSupportedErrMessage)\n\t}\n\n\treturn selectStmt.Where.Expr, nil\n}\n\nfunc prepareQuery(query string) (string, error) {\n\tquery = strings.TrimSpace(query)\n\tif query == \"\" {\n\t\treturn \"\", nil\n\t}\n\n\tif strings.HasPrefix(strings.ToLower(query), \"where \") ||\n\t\tstrings.HasPrefix(strings.ToLower(query), \"select \") {\n\t\treturn \"\", fmt.Errorf(\"invalid filter: %s\", query)\n\t}\n\n\t// sqlparser can't parse just WHERE clause but instead accepts only valid SQL statement.\n\tquery = fmt.Sprintf(\"select * from table1 where %s\", query)\n\n\treturn query, nil\n}\n\nfunc (w *workerQueryEngine) evaluateExpression(expr sqlparser.Expr) (bool, error) {\n\n\tif expr == nil {\n\t\treturn false, serviceerror.NewInvalidArgumentf(\"input expression cannot be nil\")\n\t}\n\n\tswitch e := (expr).(type) {\n\tcase *sqlparser.AndExpr:\n\t\treturn w.evaluateAnd(e)\n\tcase *sqlparser.OrExpr:","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/service/matching/workers/worker_query_engine.go#L181-L217","documentation":"The matching task query engine validates worker query filters (visibility list-filter queries) via prepareQuery, called by validateQuery. Filters must be a bare WHERE clause; a query starting with 'where ' or 'select ' is rejected because the engine itself wraps the expression in 'select * from table1 where ...', so a leading keyword would produce invalid SQL.","triggerScenarios":"Passing a list filter like \"WHERE ExecutionStatus='Running'\" or a full \"SELECT ...\" statement to worker query validation (e.g. DescribeTaskQueue with query, or the list-filter used by tctl taskqueue describe / worker visibility), instead of the expression alone.","commonSituations":"Users copying SQL-style examples or full visibility queries into the task-queue filter field; client SDKs or scripts that prepend 'WHERE'; confusion between Search Attribute visibility queries and task-queue worker filters.","solutions":["Strip the leading 'WHERE ' from the filter and pass only the predicate, e.g. `ExecutionStatus = 'Running'` instead of `WHERE ExecutionStatus = 'Running'`","If you used a full SELECT statement, reduce it to just the WHERE-clause expression","Ensure the client/SDK is not auto-prefixing 'where' before sending the query"],"exampleFix":"// before\nquery := \"WHERE TaskType = 'workflow' AND BuildId = 'v1'\"\n\n// after\nquery := \"TaskType = 'workflow' AND BuildId = 'v1'\"","handlingStrategy":"validation","validationCode":"func validateTaskQueueFilter(query string) error {\n\tq := strings.TrimSpace(strings.ToLower(query))\n\tif strings.HasPrefix(q, \"where \") || strings.HasPrefix(q, \"select \") {\n\t\treturn fmt.Errorf(\"pass only the WHERE-clause expression, not %q\", query)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass bare predicate expressions (no leading WHERE/SELECT) as task-queue filters","Trim user input and strip an optional leading 'where' keyword before sending","Document in tooling/UI that the filter is a WHERE clause, not full SQL","Test filters with validateQuery/DescribeTaskQueue before deploying automations"],"tags":["go","query-validation","matching-service","list-filter","task-queue"],"backgroundTag":"invalid-filter-syntax","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}