{"record":{"id":"8c457c2f3d40f7df","repo":"Tencent/WeKnora","slug":"alternativesubplan-nodes-are-not-allowed","errorCode":null,"errorMessage":"AlternativeSubPlan nodes are not allowed","messagePattern":"AlternativeSubPlan nodes are not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":2068,"sourceCode":"\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t\tif err := v.validateNode(wd.StartOffset, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := v.validateNode(wd.EndOffset, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// SubPlan - BLOCK: This is an internal representation, should not appear in user queries\n\tif node.GetSubPlan() != nil {\n\t\treturn fmt.Errorf(\"SubPlan nodes are not allowed\")\n\t}\n\n\t// AlternativeSubPlan - BLOCK\n\tif node.GetAlternativeSubPlan() != nil {\n\t\treturn fmt.Errorf(\"AlternativeSubPlan nodes are not allowed\")\n\t}\n\n\t// ============================================================\n\t// SECURITY: DEFAULT-DENY.\n\t// The recursive branches above validate every expression type we know how\n\t// to inspect. Any node type NOT in the recognized set below is REJECTED,\n\t// because an unhandled type can smuggle a dangerous FuncCall past the\n\t// blacklist (e.g. PG17's JSON_SCALAR wrapping pg_read_file). Whenever a new\n\t// recursive handler is added above, add its Node_* wrapper here as well.\n\t// ============================================================\n\tswitch node.Node.(type) {\n\tcase\n\t\t// Recognized expression types (validated recursively above).\n\t\t*pg_query.Node_FuncCall,\n\t\t*pg_query.Node_FuncExpr,\n\t\t*pg_query.Node_ColumnRef,\n\t\t*pg_query.Node_TypeCast,\n\t\t*pg_query.Node_AExpr,","sourceCodeStart":2050,"sourceCodeEnd":2086,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L2050-L2086","documentation":"Default-deny guard in validateNode: an AlternativeSubPlan node was found. Like SubPlan, it is an internal planner-only representation and its presence in a user query is treated as tampering, so validation fails closed.","triggerScenarios":"Thrown at internal/utils/inject.go:2068 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rewrite without subquery constructs","Log the request as a potential validation bypass attempt","Validate only freshly parsed ASTs, never planner output"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}