{"record":{"id":"77f6cec5afbd53e9","repo":"Tencent/WeKnora","slug":"sql-query-too-long-max-d-characters","errorCode":null,"errorMessage":"SQL query too long (max %d characters)","messagePattern":"SQL query too long \\(max (.+?) characters\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":1336,"sourceCode":"\tfor k := range m {\n\t\tkeys = append(keys, k)\n\t}\n\treturn keys\n}\n\n// validateInput performs basic input validation\nfunc (v *sqlValidator) validateInput(sql string) error {\n\t// Check for null bytes\n\tif strings.Contains(sql, \"\\x00\") {\n\t\treturn fmt.Errorf(\"invalid character in SQL query\")\n\t}\n\n\t// Check length limits\n\tif len(sql) < v.minLength {\n\t\treturn fmt.Errorf(\"SQL query too short (min %d characters)\", v.minLength)\n\t}\n\tif len(sql) > v.maxLength {\n\t\treturn fmt.Errorf(\"SQL query too long (max %d characters)\", v.maxLength)\n\t}\n\n\treturn nil\n}\n\n// validateSelectStmt validates a SELECT statement with configured options\nfunc (v *sqlValidator) validateSelectStmt(stmt *pg_query.SelectStmt, result *SQLValidationResult) error {\n\ttablesInQuery := make(map[string]string) // table name -> alias\n\n\t// Check for UNION/INTERSECT/EXCEPT (compound queries)\n\tif stmt.Op != pg_query.SetOperation_SETOP_NONE {\n\t\treturn fmt.Errorf(\"compound queries (UNION/INTERSECT/EXCEPT) are not allowed\")\n\t}\n\n\t// Check for WITH clause (CTEs)\n\tif v.checkCTEs && stmt.WithClause != nil {\n\t\treturn fmt.Errorf(\"WITH clause (CTEs) is not allowed\")\n\t}","sourceCodeStart":1318,"sourceCodeEnd":1354,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L1318-L1354","documentation":"sqlValidator.validateInput rejects any SQL string whose byte length exceeds the validator's configured maxLength. The library enforces a length ceiling as a basic input-safety guard before deeper parsing/validation, so oversized queries fail fast instead of being processed. It is a configuration-vs-input mismatch: the query is fine, but it is longer than the validator was set up to accept.","triggerScenarios":"Calling the library's SQL validation/injection-check API with a query string whose len(sql) > v.maxLength (the configured maximum, reported in the error message). Happens on any API path that runs validateInput before statement parsing.","commonSituations":"Long ORM-generated queries with large IN (...) lists; many JOINs or wide column lists; queries with embedded long literals or bulk VALUES rows; maxLength left at a small default while the app legitimately builds big queries.","solutions":["Raise the validator's maxLength configuration to a value that fits your largest legitimate query.","Shorten the query: reduce the IN-list size, use a temp table/join instead of huge literals, or select fewer columns.","If the length check is not needed for your use case, disable/relax the length constraint in the validator options, if exposed.","Pre-truncate or split the workload into multiple smaller queries before calling the validator."],"exampleFix":"// before: validator with default/small limit\nv, _ := utils.NewSQLValidator(utils.ValidatorOptions{MaxLength: 1000})\nv.Validate(hugeQuery) // \"SQL query too long (max 1000 characters)\"\n\n// after\nv, _ := utils.NewSQLValidator(utils.ValidatorOptions{MaxLength: 50000})","handlingStrategy":"validation","validationCode":"const maxLen = 50000 // must match validator maxLength\nif len(sql) > maxLen {\n    return fmt.Errorf(\"query is %d bytes, exceeds max %d; shorten or raise maxLength\", len(sql), maxLen)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep maxLength config in sync with the largest query your application actually generates.","Log len(query) when building queries so oversized ones are visible before validation.","Avoid huge IN (...) lists and large embedded literals; use joins or parameters.","Add a unit test asserting your worst-case query passes validateInput."],"tags":["sql","input-validation","length-limit","configuration"],"backgroundTag":"sql-query-too-long","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}