{"record":{"id":"36624e2c25203f81","repo":"Tencent/WeKnora","slug":"subqueries-in-from-clause-are-not-allowed","errorCode":null,"errorMessage":"subqueries in FROM clause are not allowed","messagePattern":"subqueries in FROM clause are not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":1462,"sourceCode":"\tif je := node.GetJoinExpr(); je != nil {\n\t\tif err := v.validateFromItem(je.Larg, tables, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := v.validateFromItem(je.Rarg, tables, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif je.Quals != nil {\n\t\t\tif err := v.validateNode(je.Quals, result); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t}\n\n\t// Handle RangeSubselect (subquery in FROM)\n\tif rss := node.GetRangeSubselect(); rss != nil {\n\t\tif v.checkSubqueries {\n\t\t\treturn fmt.Errorf(\"subqueries in FROM clause are not allowed\")\n\t\t}\n\t\t// SECURITY: Even when subqueries are permitted, recurse into the\n\t\t// subquery so dangerous constructs hidden inside it are still\n\t\t// validated. Without this, a FROM subquery like\n\t\t//   (SELECT * FROM read_text('/etc/passwd'))\n\t\t// smuggles a RangeFunction past the check below.\n\t\treturn v.validateSubquery(rss.Subquery, tables, result)\n\t}\n\n\t// Handle RangeFunction (function in FROM)\n\tif node.GetRangeFunction() != nil {\n\t\treturn fmt.Errorf(\"functions in FROM clause are not allowed\")\n\t}\n\n\treturn nil\n}\n\n// validateSubquery validates a SELECT statement nested in a FROM subquery.","sourceCodeStart":1444,"sourceCodeEnd":1480,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L1444-L1480","documentation":"Policy error in validateFromItem: a RangeSubselect (subquery in FROM) was found while checkSubqueries is disabled, so the query is rejected outright. Even when subqueries are allowed the validator still recurses to validate their contents.","triggerScenarios":"Thrown at internal/utils/inject.go:1462 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rewrite the FROM subquery as a JOIN against an allowed table","Flatten the subquery into the outer WHERE clauses","Enable subquery support only if the trust model allows it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}