{"record":{"id":"b36863549cd38961","repo":"FlowiseAI/Flowise","slug":"disallowed-method-method","errorCode":null,"errorMessage":"Disallowed method: ${method}","messagePattern":"Disallowed method: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/vectorstores/Supabase/filterParser.ts","lineNumber":78,"sourceCode":"        }\n\n        return filter\n    }\n\n    private static parseFilterChain(filter: string): Array<{ method: string; args: any[] }> {\n        const chain: Array<{ method: string; args: any[] }> = []\n\n        // Split on method calls (e.g., .filter, .order, etc.)\n        const methodPattern = /\\.?(\\w+)\\s*\\((.*?)\\)(?=\\s*(?:\\.|$))/g\n        let match\n\n        while ((match = methodPattern.exec(filter)) !== null) {\n            const method = match[1]\n            const argsString = match[2]\n\n            // Validate method name\n            if (!this.ALLOWED_METHODS.includes(method)) {\n                throw new Error(`Disallowed method: ${method}`)\n            }\n\n            // Parse arguments safely\n            const args = this.parseArguments(argsString)\n\n            // Additional validation for filter method\n            if (method === 'filter' && args.length >= 2) {\n                const operator = args[1]\n                if (typeof operator === 'string' && !this.ALLOWED_OPERATORS.includes(operator)) {\n                    throw new Error(`Disallowed filter operator: ${operator}`)\n                }\n            }\n\n            chain.push({ method, args })\n        }\n\n        if (chain.length === 0) {\n            throw new Error('No valid filter methods found')","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/vectorstores/Supabase/filterParser.ts#L60-L96","documentation":"While tokenizing the filter chain, each matched method name is checked against `ALLOWED_METHODS` = ['filter','order','limit','range','single','maybeSingle']. Any method not on this allowlist throws 'Disallowed method:'. This is a security control preventing arbitrary PostgREST/builder methods (e.g. select, delete, insert, update, rpc) from being invoked through the filter DSL.","triggerScenarios":"A filter string containing `.select(...)`, `.delete(...)`, `.insert(...)`, `.update(...)`, `.rpc(...)`, or any builder method outside the six allowed names. Also triggered by typos like `.filtr(` or `.orderby(`.","commonSituations":"User pasting full Supabase client code into a filter field; assuming the DSL supports the full PostgREST builder; typo in a method name; LLM-generated filter using unsupported methods.","solutions":["Use only the six allowed methods in the filter string.","Move data-mutating operations (select/insert/update/delete) out of the filter DSL — they are intentionally blocked.","Add the desired method to ALLOWED_METHODS only after a security review.","Client-side validate method names against the allowlist before submission."],"exampleFix":"// before: '.select(\"*\").filter(\"a\",\"eq\",1)' -> Disallowed method: select\n// after: 'filter(\"a\",\"eq\",1)'","handlingStrategy":"validation","validationCode":"const ALLOWED_METHODS = ['filter','order','limit','range','single','maybeSingle']\nfunction validateMethods(filter: string) {\n  for (const m of filter.matchAll(/\\.?(\\w+)\\s*\\(/g)) {\n    if (!ALLOWED_METHODS.includes(m[1])) throw new Error(`Disallowed method '${m[1]}'. Allowed: ${ALLOWED_METHODS.join(', ')}`)\n  }\n}","typeGuard":"function isAllowedMethod(m: string): boolean { return ['filter','order','limit','range','single','maybeSingle'].includes(m) }","tryCatchPattern":"null","preventionTips":["Allow only the six methods in any user-facing filter editor.","Keep mutating methods (select/insert/update/delete) out of the DSL.","Client-side lint method names before submission.","Review any addition to ALLOWED_METHODS for security impact."],"tags":["supabase","filter-parser","security","allowlist","input-validation"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}