{"record":{"id":"81bc497380da7286","repo":"Tencent/WeKnora","slug":"function-not-allowed-s","errorCode":null,"errorMessage":"function not allowed: %s","messagePattern":"function not allowed: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":2319,"sourceCode":"\t\t\t\"read_json\":         true,\n\t\t\t\"read_json_auto\":    true,\n\t\t\t\"read_ndjson\":       true,\n\t\t\t\"read_ndjson_auto\":  true,\n\t\t\t\"read_json_objects\": true,\n\t\t\t\"read_xlsx\":         true,\n\t\t\t\"sniff_csv\":         true,\n\t\t\t\"glob\":              true,\n\t\t\t\"st_read\":           true,\n\t\t\t\"st_read_meta\":      true,\n\t\t}\n\t\tif dangerousFunctions[funcName] {\n\t\t\treturn fmt.Errorf(\"function '%s' is not allowed\", funcName)\n\t\t}\n\t}\n\n\t// Check against whitelist if enabled\n\tif v.checkFunctionNames && !v.allowedFunctions[funcName] {\n\t\treturn fmt.Errorf(\"function not allowed: %s\", funcName)\n\t}\n\n\t// Validate function arguments recursively\n\tfor _, arg := range fc.Args {\n\t\tif err := v.validateNode(arg, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateColumnRef validates a column reference\nfunc (v *sqlValidator) validateColumnRef(cr *pg_query.ColumnRef) error {\n\tif !v.checkSystemColumns {\n\t\treturn nil\n\t}\n","sourceCodeStart":2301,"sourceCodeEnd":2337,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L2301-L2337","documentation":"Whitelist enforcement failed: the validator has checkFunctionNames enabled and the function name is not present in allowedFunctions. Only functions explicitly allowlisted can appear in validated expressions, so any unknown/unapproved function is rejected. This is the final per-function check after prefix and blocklist checks.","triggerScenarios":"checkFunctionNames is true and the expression uses any function not registered in v.allowedFunctions — including typos, newly added DB functions, or user-supplied expressions containing helper functions like date_trunc on a deployment where it was never allowlisted.","commonSituations":"Upgrading the database and using new built-ins before updating the allowlist; typos in function names (upper vs UPPER variants are exact-matched); third-party SQL snippets using functions not approved by the platform security team.","solutions":["Verify the exact function name spelling against the allowedFunctions configuration","Add the function to allowedFunctions if your security policy permits it","Rewrite the expression using an already-allowlisted function","If dynamic functions are expected, disable checkFunctionNames only in trusted internal contexts — never for user-supplied SQL"],"exampleFix":"// before (date_trunc not allowlisted)\nexpr := \"date_trunc('month', created_at) > x\" // error\n// after: allowlist it or use approved equivalent\nv.allowedFunctions[\"date_trunc\"] = true\n// or\nexpr := \"strftime(created_at, '%Y-%m') > x\"","handlingStrategy":"validation","validationCode":"func exprUsesOnlyAllowedFunctions(expr string, allowed map[string]bool) error {\n    for _, fn := range extractFunctionNames(expr) {\n        if !allowed[fn] {\n            return fmt.Errorf(\"function %q is not allowlisted\", fn)\n        }\n    }\n    return nil\n}","typeGuard":"func isAllowlisted(name string, allowed map[string]bool) bool {\n    return allowed[strings.ToLower(strings.TrimSpace(name))]\n}","tryCatchPattern":"if err := injector.Validate(expr); err != nil {\n    if strings.HasPrefix(err.Error(), \"function not allowed:\") {\n        fn := strings.TrimPrefix(err.Error(), \"function not allowed: \")\n        return fmt.Errorf(\"%q is not on the approved function list; contact an admin\", fn)\n    }\n    return err\n}","preventionTips":["Keep allowedFunctions in version-controlled config and review changes with security","Add allowlist entries as part of DB-upgrade runbooks so new built-ins don't break prod","Validate expressions in CI against the production allowlist to catch drift early"],"tags":["sql-injection","whitelist","validation","security"],"backgroundTag":"sql-function-not-allowlisted","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}