{"record":{"id":"6b1950cd9242fc6a","repo":"FlowiseAI/Flowise","slug":"invalid-table-name-6b1950","errorCode":null,"errorMessage":"Invalid table name","messagePattern":"Invalid table name","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/memory/AgentMemory/SQLiteAgentMemory/sqliteSaver.ts","lineNumber":28,"sourceCode":"    protected isSetup: boolean\n    config: SaverOptions\n    threadId: string\n    tableName = 'checkpoints'\n\n    constructor(config: SaverOptions, serde?: SerializerProtocol<Checkpoint>) {\n        super(serde)\n        this.config = config\n        const { threadId } = config\n        this.threadId = threadId\n    }\n\n    sanitizeTableName(tableName: string): string {\n        // Trim and normalize case, turn whitespace into underscores\n        tableName = tableName.trim().toLowerCase().replace(/\\s+/g, '_')\n\n        // Validate using a regex (alphanumeric and underscores only)\n        if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {\n            throw new Error('Invalid table name')\n        }\n\n        return tableName\n    }\n\n    private async getDataSource(): Promise<DataSource> {\n        const { datasourceOptions } = this.config\n        const dataSource = new DataSource(datasourceOptions)\n        await dataSource.initialize()\n        return dataSource\n    }\n\n    private async setup(dataSource: DataSource): Promise<void> {\n        if (this.isSetup) {\n            return\n        }\n\n        try {","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/memory/AgentMemory/SQLiteAgentMemory/sqliteSaver.ts#L10-L46","documentation":"Thrown by SQLiteSaver.sanitizeTableName() when the (trim+lower+whitespace→underscore) tableName does not match ^[a-zA-Z0-9_]+$. This runs on every operation that interpolates the table name into SQL, so it is a pre-SQL injection / sanity guard.","triggerScenarios":"Setting this.tableName to a value containing dots, hyphens, spaces-after-collapse-residue, Unicode, or that is empty after trim. Also triggered by schema-qualified names like public.checkpoints or quoted identifiers.","commonSituations":"Configuring a custom tableName with schema prefix or kebab-case. Empty/whitespace tableName from a missing input field. International characters in the name.","solutions":["Use a plain alphanumeric+underscore table name, e.g. 'checkpoints', 'my_app_checkpoints'.","Drop schema prefixes from tableName (the saver does not support them); configure the schema via datasourceOptions if needed.","Convert kebab-case to snake_case before assigning.","If you maintain the saver and need dotted names, extend sanitize to allow '.' and use TypeORM's identifier quoting."],"exampleFix":"// before\nthis.tableName = 'public.app-checkpoints'\n// after\nthis.tableName = 'app_checkpoints'","handlingStrategy":"validation","validationCode":"const TABLE_NAME_RE = /^[a-zA-Z0-9_]+$/\nfunction sanitizeOrRejectTableName(name: string): string {\n  const normalized = name.trim().toLowerCase().replace(/\\s+/g, '_')\n  if (!TABLE_NAME_RE.test(normalized)) {\n    throw new Error(`tableName '${name}' is invalid; use only letters, digits, and underscores`)\n  }\n  return normalized\n}","typeGuard":"function isValidTableName(name: unknown): name is string {\n  return typeof name === 'string' && /^[a-zA-Z0-9_]+$/.test(name.trim().toLowerCase().replace(/\\s+/g, '_'))\n}","tryCatchPattern":"try {\n  saver.sanitizeTableName(proposedName)\n} catch (e) {\n  if ((e as Error).message === 'Invalid table name') {\n    // fall back to a safe default rather than crashing\n    proposedName = 'checkpoints'\n  } else throw e\n}","preventionTips":["Restrict tableName inputs to alphanumeric+underscore in the UI.","Avoid schema-qualified or kebab-case names.","Add a UI-level regex validator mirroring ^[a-zA-Z0-9_]+$."],"tags":["sqlite","validation","identifier","sql-injection","configuration"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}