{"record":{"id":"480a8c736c59fa7e","repo":"Tencent/WeKnora","slug":"subqueries-are-not-allowed","errorCode":null,"errorMessage":"subqueries are not allowed","messagePattern":"subqueries are not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":1531,"sourceCode":"\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateNode recursively validates AST nodes\n// SECURITY: This function uses a COMPREHENSIVE approach to validate ALL node types.\n// Any node type that contains child expressions MUST be handled to prevent bypass attacks.\n// The principle is: if we don't know how to validate a node type, we REJECT it.\nfunc (v *sqlValidator) validateNode(node *pg_query.Node, result *SQLValidationResult) error {\n\tif node == nil {\n\t\treturn nil\n\t}\n\n\t// Check for subqueries (SubLink)\n\tif v.checkSubqueries {\n\t\tif sl := node.GetSubLink(); sl != nil {\n\t\t\treturn fmt.Errorf(\"subqueries are not allowed\")\n\t\t}\n\t}\n\n\t// Check for function calls\n\tif fc := node.GetFuncCall(); fc != nil {\n\t\tif err := v.validateFuncCall(fc, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// Check for column references\n\tif cr := node.GetColumnRef(); cr != nil {\n\t\tif err := v.validateColumnRef(cr); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// Check for type casts","sourceCodeStart":1513,"sourceCodeEnd":1549,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L1513-L1549","documentation":"Policy error in validateNode: a SubLink (scalar/EXISTS/IN subquery in an expression) was found while subqueries are disallowed. The validator walks every expression node, so nested subqueries anywhere in the statement are rejected.","triggerScenarios":"Thrown at internal/utils/inject.go:1531 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Replace the scalar subquery with a JOIN and aggregation","Precompute the subquery result into an allowed table or parameter","Rewrite IN/EXISTS clauses as joins against permitted tables"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}