{"record":{"id":"8ead5fee05513bbf","repo":"Tencent/WeKnora","slug":"sql-query-too-short-min-d-characters","errorCode":null,"errorMessage":"SQL query too short (min %d characters)","messagePattern":"SQL query too short \\(min (.+?) characters\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":1333,"sourceCode":"// getMapKeys returns the keys of a map as a slice\nfunc getMapKeys(m map[string]bool) []string {\n\tkeys := make([]string, 0, len(m))\n\tfor k := range m {\n\t\tkeys = append(keys, k)\n\t}\n\treturn keys\n}\n\n// validateInput performs basic input validation\nfunc (v *sqlValidator) validateInput(sql string) error {\n\t// Check for null bytes\n\tif strings.Contains(sql, \"\\x00\") {\n\t\treturn fmt.Errorf(\"invalid character in SQL query\")\n\t}\n\n\t// Check length limits\n\tif len(sql) < v.minLength {\n\t\treturn fmt.Errorf(\"SQL query too short (min %d characters)\", v.minLength)\n\t}\n\tif len(sql) > v.maxLength {\n\t\treturn fmt.Errorf(\"SQL query too long (max %d characters)\", v.maxLength)\n\t}\n\n\treturn nil\n}\n\n// validateSelectStmt validates a SELECT statement with configured options\nfunc (v *sqlValidator) validateSelectStmt(stmt *pg_query.SelectStmt, result *SQLValidationResult) error {\n\ttablesInQuery := make(map[string]string) // table name -> alias\n\n\t// Check for UNION/INTERSECT/EXCEPT (compound queries)\n\tif stmt.Op != pg_query.SetOperation_SETOP_NONE {\n\t\treturn fmt.Errorf(\"compound queries (UNION/INTERSECT/EXCEPT) are not allowed\")\n\t}\n\n\t// Check for WITH clause (CTEs)","sourceCodeStart":1315,"sourceCodeEnd":1351,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L1315-L1351","documentation":"sqlValidator.validateInput enforces a minimum length (v.minLength) on the SQL string and returns this formatted error when len(sql) is below it. The library throws this because extremely short strings cannot be legitimate SELECT queries and are likely garbage or probing input.","triggerScenarios":"Calling ValidateSQL/ValidateAndSecureSQL with an empty, whitespace, or very short SQL string (fewer than the configured minLength characters).","commonSituations":"Uninitialized/empty query variables; short-but-valid queries like \"SELECT 1\" rejected by a strict minLength; tests passing stub strings; upstream code producing truncated queries.","solutions":["Ensure a real, complete SQL query is passed before validation","If short-but-valid queries are legitimate, lower minLength via the validator's length configuration option","Check upstream query construction for truncation or empty-value bugs"],"exampleFix":"// before\nif sql == \"\" { sql = \"SELECT 1\" } // rejected: too short\n// after\nif len(strings.TrimSpace(sql)) < 20 {\n    return fmt.Errorf(\"query must be a complete SELECT statement\")\n}\nsecured, _, err := utils.ValidateAndSecureSQL(sql)","handlingStrategy":"validation","validationCode":"if len(strings.TrimSpace(sql)) < 20 {\n    return fmt.Errorf(\"query is empty or truncated\")\n}","typeGuard":null,"tryCatchPattern":"_, _, err := utils.ValidateAndSecureSQL(sql)\nif err != nil && strings.Contains(err.Error(), \"too short\") {\n    return fmt.Errorf(\"no query provided or query truncated: %w\", err)\n}","preventionTips":["Guard for empty/short input at the API boundary before invoking the validator","Avoid placeholder queries like \"SELECT 1\" if minLength is strict; configure minLength appropriately","Check upstream query builders for truncation bugs","Trim whitespace first so whitespace-only strings fail your own check, not the library's"],"tags":["sql","validation","input-validation"],"backgroundTag":"sql-query-too-short","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}