{"record":{"id":"51043c9fc44f3276","repo":"apache/beam","slug":"fully-qualifed-name-s-not-allowed-by-filter-s","errorCode":null,"errorMessage":"Fully qualifed name \"%s\" not allowed by filter %s.","messagePattern":"Fully qualifed name \"(.+?)\" not allowed by filter (.+?)\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/transforms/fully_qualified_named_transform.py","lineNumber":84,"sourceCode":"        source = kwargs.pop('source')\n      if isinstance(source, str):\n        source = python_callable.PythonCallableWithSource(source)\n\n      if self._constructor == '__constructor__':\n        transform = source(*args, **kwargs)\n      else:\n        transform = ptransform._PTransformFnPTransform(source, *args, **kwargs)\n\n    else:\n      transform = self._resolve(self._constructor)(*self._args, **self._kwargs)\n\n    return pinput | transform\n\n  @classmethod\n  def _check_allowed(cls, fully_qualified_name):\n    if not cls._FILTER_GLOB or not fnmatch.fnmatchcase(fully_qualified_name,\n                                                       cls._FILTER_GLOB):\n      raise ValueError(\n          f'Fully qualifed name \"{fully_qualified_name}\" '\n          f'not allowed by filter {cls._FILTER_GLOB}.')\n\n  @classmethod\n  def _resolve(cls, fully_qualified_name):\n    cls._check_allowed(fully_qualified_name)\n    o = None\n    path = ''\n    for segment in fully_qualified_name.split('.'):\n      path = '.'.join([path, segment]) if path else segment\n      if o is not None and hasattr(o, segment):\n        o = getattr(o, segment)\n      else:\n        o = importlib.import_module(path)\n    return o\n\n  def to_runner_api_parameter(self, unused_context):\n    _args_schema = named_fields_to_schema([","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/transforms/fully_qualified_named_transform.py#L66-L102","documentation":"FullyQualifiedNamedTransform only instantiates transforms whose fully qualified names match an allowlist glob (set via the filter option, e.g. by Beam's interactive/YAML sandboxes); the resolved constructor's module path failed fnmatch against that filter, so the load is refused for safety.","triggerScenarios":"Thrown at sdks/python/apache_beam/transforms/fully_qualified_named_transform.py:84 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Widen or adjust the filter glob to include the needed module path","Move/reconstruct the transform under an already-allowed package"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}